Patent ID: 8407331

Claim:
In a computing environment including a resource manager and a plurality of downstream resource systems, the resource manager comprising programmatic code for managing resources in the computing environment, a method of managing resources available from the plurality of resource systems within the computing environment, including managing permissions for entities to access the resources, the method comprising: receiving user input indicating that a new entity should be added to the resource manager; in response to receiving user input indicating that a new entity should be added to the resource manager: creating a new entity object at the resource manager, the new entity object corresponding to the new entity; and generating an event, the event specifying a workflow that should be executed in connection with creation of the new entity object, wherein the workflow is configured to add one or more synchronization rules to an expected rules list that is particular to the new entity object, wherein the one or more synchronization rules on the expected rules list define how to transform one or more objects at the resource manager into a plurality of different objects at the downstream resource systems; in response to generating the event, executing the workflow specified in the event thereby causing the one or more synchronization rules to be added to the expected rules list; generating a detected rules list, the detected rules list specifying existing permissions for the new entity for the downstream resource systems, wherein generating the detected rules list comprises examining one or more of the plurality of different objects in the downstream resource systems and correlating the examined objects in the downstream resource systems with entity objects managed by the resource manager; comparing the detected rules list with the expected rules list, and determining that the detected rules list indicates that at least one of the plurality of different objects in the downstream resource systems includes an attribute that is not included in the one or more synchronization rules of the expected rules list; and based on comparing the detected rules list with the expected rules list, updating at least one synchronization rule of the expected rules list.