Directory service user synchronization

Patent metadata

Field	Value
Publication number	US-11818112-B2
Application number	US-202217712704-A
Country	US
Kind code	B2
Filing date	Apr 4, 2022
Priority date	Sep 11, 2015
Publication date	Nov 14, 2023
Grant date	Nov 14, 2023

Abstract

Disclosed are various examples for enrolling a client device and synchronizing user attributes for the client device across multiple directory services. A search request for user attributes can be sent to a first directory service with an identifier for a user account. The first directory service can query for the identifier and send back user attributes. If a global identifier is included in the attributes, another search request for user attributes can be sent to a second directory service with the global identifier. The second directory service can query for the global identifier and send back user attributes.

First claim

Therefore, the following is claimed:

1. A method, comprising:
in an instance in which a user account comprising an identifier is detected as omitted from a list of managed users managed by a management service, searching a first directory service for a plurality of first user attributes based at least in part on an identifier;
receiving the plurality of first user attributes from the first directory service;
determining whether the plurality of first user attributes includes a global identifier; and
in response to determining that the plurality of first user attributes includes the global identifier:
searching a second directory service for a plurality of second user attributes based at least in part on the global identifier; and
receiving the plurality of second user attributes from the second directory service.

2. The method of claim 1 , further comprising receiving an authentication confirmation comprising the identifier from a client device associated with a user account.

3. The method of claim 2 , further comprising updating a plurality of user properties corresponding to the user account based at least in part on at least one of: the plurality of first user attributes or the plurality of second user attributes.

4. The method of claim 3 , further comprising scheduling a periodic query of the first directory service and the second directory service for changes to the user account, wherein updating the plurality of user properties corresponding to the user account occurs in response in response to the periodic query.

5. The method of claim 1 , wherein the searching of the first directory service for the plurality of first user attributes is performed in response to detecting that a user account is omitted from a list of managed users.

6. The method of claim 1 , wherein the global identifier is an immutable identifier.

7. The method of claim 1 , further comprising
detecting a conflict between the plurality of first user attributes and the plurality of second user attributes; and
resolving the conflict based at least in part on a last modified timestamp associated with a conflicting set of user attributes.

8. A non-transitory computer-readable medium embodying a program that, when executed by at least one computing device, causes the at least one computing device to at least:
in an instance in which a user account comprising an identifier is detected as omitted from a list of managed users managed by a management service, search a first directory service for a plurality of first user attributes based at least in part on an identifier;
receive the plurality of first user attributes from the first directory service;
determine whether the plurality of first user attributes includes a global identifier; and
in response to a determination that the plurality of first user attributes includes the global identifier:
search a second directory service for a plurality of second user attributes based at least in part on the global identifier; and
receive the plurality of second user attributes from the second directory service.

9. The non-transitory computer-readable medium of claim 8 , wherein the program further causes the at least one computing device to at least receive an authentication confirmation comprising the identifier from a client device associated with a user account.

10. The non-transitory computer-readable medium of claim 9 , wherein the program further causes the at least one computing device to at least update a plurality of user properties corresponding to the user account based at least in part on at least one of: the plurality of first user attributes or the plurality of second user attributes.

11. The non-transitory computer-readable medium of claim 10 , wherein the program further causes the at least one computing device to at least schedule a periodic query of the first directory service and the second directory service for changes to the user account, wherein updating the plurality of user properties corresponding to the user account occurs in response in response to the periodic query.

12. The non-transitory computer-readable medium of claim 8 , wherein the search of the first directory service for the plurality of first user attributes is in response to detecting that a user account is omitted from a list of managed users.

13. The non-transitory computer-readable medium of claim 8 , wherein the global identifier is an immutable identifier.

14. The non-transitory computer-readable medium of claim 8 , wherein the program further causes the at least one computing device to at least:
detect a conflict between the plurality of first user attributes and the plurality of second user attributes; and
resolve the conflict based at least in part on a last modified timestamp associated with a conflicting set of user attributes.

15. A system, comprising:
a data store;
at least one computing device in communication with the data store, the at least one computing device being configured to at least:
in an instance in which a user account comprising an identifier is detected as omitted from a list of managed users managed by a management service, search a first directory service for a plurality of first user attributes based at least in part on an identifier;
receive the plurality of first user attributes from the first directory service;
determine whether the plurality of first user attributes includes a global identifier; and
in response to a determination that the plurality of first user attributes includes the global identifier:
search a second directory service for a plurality of second user attributes based at least in part on the global identifier; and
receive the plurality of second user attributes from the second directory service.

16. The system of claim 15 , wherein the at least one computing device is further configured to at least receive an authentication confirmation comprising the identifier from a client device associated with a user account.

17. The system of claim 16 , wherein the at least one computing device is further configured to at least update a plurality of user properties corresponding to the user account based at least in part on at least one of: the plurality of first user attributes or the plurality of second user attributes.

18. The system of claim 17 , wherein the at least one computing device is further configured to at least schedule a periodic query of the first directory service and the second directory service for changes to the user account, wherein updating the plurality of user properties corresponding to the user account occurs in response in response to the periodic query.

19. The system of claim 15 , wherein the search of the first directory service for the plurality of first user attributes is in response to detecting that a user account is omitted from a list of managed users.

20. The system of claim 15 , wherein the global identifier is an immutable identifier.

Assignees

• Airwatch Llc

Inventors

• Regula Kalyan
• Shantharam Shravan
• Manjunath Nishita
• Murthy Varun
• Roszak Jason

Classifications

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L67/1044

  Group management mechanisms  (management of multicast group membership H04L12/185; reconfiguring of node membership in a computing system to eliminate errors G06F11/1425) · CPC title

• H04L67/306

  User profiles · CPC title