Discovery and mapping of a cloud-based authentication, authorization, and user management service

Patent metadata

Field	Value
Publication number	US-11240241-B2
Application number	US-201916445984-A
Country	US
Kind code	B2
Filing date	Jun 19, 2019
Priority date	Jun 19, 2019
Publication date	Feb 1, 2022
Grant date	Feb 1, 2022

Abstract

A computing system includes persistent storage and a discovery application configured to perform operations including obtaining, from a remote computing system, first attributes of a first computing resource, which indicate a first unique resource identifier associated with an authentication system provided by the remote computing system and utilized by the first computing resource. The operations also include obtaining, from the remote computing system, second attributes of the authentication system, which indicate a second unique resource identifier used by the authentication system. The operations additionally include determining that the first unique resource identifier matches the second unique resource identifier and, based on this determination, generating a mapping between the first computing resource and the authentication system to indicate that access to the first computing resource is controlled by the authentication system. The operations further include storing, in the persistent storage, the mapping as one or more configuration items.

First claim

What is claimed is:

1. A computing system comprising:
persistent storage configured to store data on behalf of a managed network, wherein a remote computing system provides a plurality of computing resources on behalf of the managed network; and
a discovery application configured to perform operations comprising:
obtaining, from the remote computing system, first attributes of a first computing resource of the plurality of computing resources, wherein the first attributes indicate a first unique resource identifier associated with an authentication system provided by the remote computing system and utilized by the first computing resource;
obtaining, from the remote computing system, second attributes of the authentication system, wherein the second attributes indicate a second unique resource identifier used by the authentication system;
determining that the first unique resource identifier matches the second unique resource identifier;
based on the first unique resource identifier matching the second unique resource identifier, generating a mapping between the first computing resource and the authentication system to indicate that access to the first computing resource is controlled by the authentication system; and
storing, in the persistent storage, the mapping as one or more configuration items.

2. The computing system of claim 1 , wherein the second attributes of the authentication system comprise one or more of: (i) a partition of the remote computing system in which the authentication system is disposed, (ii) a service name of the authentication system, (iii) a geographic region in which the authentication system resides, (iv) an account associated with the authentication system, or (v) an alphanumeric identifier associated with the authentication system, and wherein the operations comprise:
obtaining the second unique resource identifier by combining two or more of the second attributes according to a predetermined format.

3. The computing system of claim 1 , wherein the second attributes identify a user pool of the authentication system, wherein the user pool defines a plurality of service identifiers usable to access one or more computing resources of the plurality of computing resources, wherein the first computing resource utilizes the user pool to control access to the first computing resource, and wherein the mapping indicates the user pool of the authentication system.

4. The computing system of claim 1 , wherein the second attributes identify an identity pool of the authentication system, wherein the identity pool defines one or more temporary resource credentials usable to provide access to one or more other computing resources of the plurality of computing resources, and wherein the mapping indicates the identity pool of the authentication system.

5. The computing system of claim 1 , wherein the first attributes are obtained prior to obtaining the second attributes, and wherein obtaining the second attributes of the authentication system comprises:
in response to obtaining the first attributes which indicate the first unique resource identifier, identifying an entry point corresponding to the authentication system;
transmitting, to the remote computing system and based on the entry point, a request for the second attributes of the authentication system; and
receiving, from the remote computing system, the second attributes.

6. The computing system of claim 1 , wherein the first attributes are obtained prior to obtaining the second attributes, and wherein the operations comprise:
determining a content of the first unique resource identifier, wherein the plurality of computing resources comprises a plurality of types of computing resources, and wherein each respective type of computing resource of the plurality of types of computing resources is associated with a corresponding unique resource identifier content;
based on the content, selecting a discovery pattern from a plurality of discovery patterns available for discovering the plurality of types of computing resources; and
executing the selected discovery pattern to cause the discovery application to obtain the second attributes of the authentication system.

7. The computing system of claim 1 , wherein the first attributes are obtained prior to obtaining the second attributes, wherein the first attributes are stored in the persistent storage as one or more additional configuration items, and wherein determining that the first unique resource identifier matches the second unique resource identifier comprises:
in response to obtaining the second attributes, parsing the one or more additional configuration items to identify therein one or more unique resource identifiers; and
identifying the first unique resource identifier within the one or more unique resource identifiers.

8. The computing system of claim 1 , wherein the second attributes are obtained prior to obtaining the first attributes, wherein the first attributes are stored in the persistent storage as one or more additional configuration items, and wherein determining that the first unique resource identifier matches the second unique resource identifier comprises:
in response to storing the first attributes in the persistent storage, parsing the one or more additional configuration items to identify therein one or more unique resource identifiers; and
identifying the first unique resource identifier within the one or more unique resource identifiers.

9. The computing system of claim 1 , wherein the first attributes additionally indicate a third unique resource identifier associated with an additional computing resource of the plurality of computing resources, wherein the operations comprise:
obtaining, from the remote computing system, third attributes of the additional computing resource associated with the third unique resource identifier;
determining, based on the third attributes, that the additional computing resource utilizes the authentication system by way of the first computing resource;
updating the mapping to indicate that the additional computing resource utilizes the authentication system by way of the first computing resource to control access to the additional computing resource; and
storing, in the persistent storage, the mapping as updated.

10. The computing system of claim 1 , wherein the first computing resource comprises a dynamically triggerable software function, and wherein the first attributes include programmatic code that contains therein the first unique resource identifier.

11. The computing system of claim 1 , wherein the first computing resource comprises a data storage structure, and wherein the first attributes include: (i) contents of the data storage structure that indicate the first unique resource identifier or (ii) metadata associated with the data storage structure that indicates the first unique resource identifier.

12. The computing system of claim 1 , wherein the first attributes comprise trigger events that cause the first computing resource to invoke execution of or provide access to another computing resource of the plurality of computing resources, and wherein at least one trigger event of the trigger events indicates the first unique resource identifier.

13. The computing system of claim 1 , wherein obtaining at least one of (i) the first attributes or (ii) the second attributes comprises:
generating a hypertext transfer protocol (HTTP) request that: (i) specifies, by way of one or more HTTP parameters, a function of an application programming interface (API) provided by the remote computing system, and (ii) includes authentication credentials for interacting wi

Assignees

• Servicenow Inc

Inventors

• Bitterfeld Robert
• Garty Asaf
• Solomon Bary
• Badyan Daniel

Classifications

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L67/025

  for remote control or remote monitoring of applications · CPC title

• H04L63/0884 Primary

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L63/0807 Primary

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L63/0281

  Proxies · CPC title