Managed directory service with extension

Patent metadata

Field	Value
Publication number	US-10511566-B2
Application number	US-201314098454-A
Country	US
Kind code	B2
Filing date	Dec 5, 2013
Priority date	Nov 11, 2013
Publication date	Dec 17, 2019
Grant date	Dec 17, 2019

Abstract

Techniques for connecting computer system entities to remotely extended local computer system resources are described herein. A computer system entity that requests access to a local computer system resource has that request fulfilled by a managed directory service which receives the request and connects the computer system entity to the local computer system resource. While connected, the managed directory service extends the local computer system resource to a corresponding extended remote computer system resource, receives commands to perform operations on the local or extended remote computer system resources and, if the computer system entity is authorized to perform the operations on the appropriate computer system resource, the managed directory service performs the operations on the appropriate computer system resource.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
receiving, at a managed directory service, a request from a customer of a computing resources service provider to extend a customer computer system directory hosted in a customer computing environment by at least creating an extended customer computer system directory in a virtual network managed on behalf of the customer by the computing resources service provider in a computing environment of the computing resource service provider, the customer computer system directory referencing a set of data stored in the customer computing environment, wherein extending the customer computer system directory provides a service of the computing resource service provider access to the set of data based at least in part on a uniform resource identifier associated with the customer computer system directory;
determining whether fulfillment of the request is authorized based at least in part on a first set of credentials associated with the customer;
obtaining, by the managed directory service, information usable to access the customer computer system directory, the information based at least in part on a second set of credentials associated with the customer computer system directory; and
using the information to replicate the customer computer system directory from the customer computing environment to the extended customer computer system directory hosted in the computing environment of the computing resource service provider, based at least in part on the second set of credentials.

2. The computer-implemented method of claim 1 , wherein the extended customer computer system directory utilizes a read-only replica of the customer computer system directory.

3. The computer-implemented method of claim 2 , wherein the extended customer computer system directory is configured to cause requests to modify the customer computer system directory received by the read-only replica to be processed by the customer computer system directory in the customer computing environment.

4. The computer-implemented method of claim 1 , further comprising:
receiving information indicative of changes to the customer computer system directory; and
synchronizing the extended customer computer system directory in accordance with the information indicative of the changes.

5. The computer-implemented method of claim 1 , wherein the extended customer computer system directory is configured to fulfill requests to perform directory write operations and to cause the customer computer system directory to be updated in accordance with the fulfilled requests.

6. The computer-implemented method of claim 1 , wherein the extended customer computer system directory is configured such that, for each non-administrative user of a set of non-administrative users of the extended customer computer system directory, the non-administrative user is able to use a single set of credentials to authenticate with the extended customer computer system directory using a service of computing resource service provider.

7. A system, comprising:
one or more processors; and
memory to store executable instructions that, as a result of execution by the one or more processors, cause the system to at least:
receive a request from a customer of a computing resources service provider to extend a customer computer system directory hosted in a customer computing environment by at least instantiating an extended customer computer system directory in a virtual network managed on behalf of the customer by the computing resource service provider in a computing environment of the computing resource service provider, the customer computer system directory referencing a set of data stored in the customer computing environment, wherein extending the customer computer system directory provides a service of the computing resource service provider access to the set of data based at least in part on a uniform resource locator associated with the customer computer system directory;
determine whether fulfillment of the request is authorized based at least in part on a first set of credentials associated with the customer;
obtain information usable to access the customer computer system directory, the information based at least in part on a second set of credentials associated with the customer computer system directory; and
use the information to replicate at least a portion of the customer computer system directory from the customer computing environment to the extended customer computer system directory hosted by the computing resources service provider.

8. The system of claim 7 , wherein the extended customer computer system directory is read-only.

9. The system of claim 8 , wherein the extended customer computer system directory is configured to:
receive requests to update the extended customer computer system directory; and
cause the received requests to be fulfilled by the customer computer system directory hosted in the customer computing environment.

10. The system of claim 7 , wherein the extended customer computer system directory is configured to:
receive requests to update the extended customer computer system directory; and
cause the received requests to be fulfilled by the customer computer system directory hosted in the customer computing environment.

11. The system of claim 7 , wherein the instructions that cause the system to manage the extended customer computer system directory, if executed by the one or more processors, cause the system to perform management operations on the extended customer computer system directory, the management operations including updates to executable code used to operate the extended customer computer system directory.

12. The system of claim 11 , wherein:
the request specifies a domain name system in a computing environment of the customer; and
the extended customer computer system directory is configured to utilize the specified domain name system to communicate with the customer computer system directory.

13. A non-transitory computer-readable storage medium comprising executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
receive a request from a customer of a computing resources service provider to extend a customer computer system directory hosted in a customer computing environment by at least creating an extended customer computer system directory in a virtual network managed on behalf of the customer by the computing resources service provider in a computing environment of the computing resource service provider, the customer computer system directory referencing a set of data stored in the customer computing environment, wherein extending the customer computer system directory provides a service of the computing resource service provider access to the set of data based at least in part on a uniform resource locator associated with the customer computer system directory;
determine whether fulfillment of the request is authorized based at least in part on a first set of credentials associated with the customer;
obtain information usable to access the customer computer system directory, the information based at least in part on a second set of credentials associated with the customer computer system directory; and
use the information to replicate at least a portion of the customer computer system directory from the customer computing environment to the extended customer computer system directory of the computing resources service provider.

14. The non-transitory computer-readable storage medium of claim

Assignees

• Amazon Tech Inc

Inventors

• Shah Shon Kiran
• Rizzo Thomas Christopher
• Mehta Gaurang Pankaj
• Rao Guruprakash Bangalore
• Palande Sameer
• Rai Krithi

Classifications

• G06F40/134

  Hyperlinking · CPC title

• H04L41/50

  Network service management, e.g. ensuring proper service fulfilment according to agreements · CPC title

• H04L61/10

  of different types · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title