Moving principals across security boundaries without service interruption
View Patent ↗An improved network architecture employs a super authority having an identity catalog to direct login authentication tasks to appropriate authorities. Authentication tasks may be performed by authorities across namespace boundaries if so directed by the super authority, such that a principal account may be moved without alteration of the account ID. In an embodiment of the invention, the identity catalog comprises a listing associating account IDs with appropriate authenticating authorities.
1. At a super authority connected to a network environment, an assigned authenticating authority and one or more other authenticating authorities also being connected to the network environment, each authenticating authority configured to authenticate of subset of principals that access the network environment through different domains, a method of controlling authentication of a principal for access to network resources in the network environment, wherein the principal's account identifier is configured for authentication at an authenticating authority from among the assigned authenticating authority and the one or more other authenticating authorities, the method comprising:
receiving at the super authority a request for an authenticating authority resolution from an authenticating authority that is not authorized to authenticate the principal, wherein the request comprises an account ID of the principal to be authenticated, the account ID including an individual identifier and a domain identifier;
accessing an assignment mapping that maps each account ID in a plurality of account IDs to a corresponding plurality of authenticating authorities that are authorized to authenticate the account ID, the account ID including an individual identifier and a domain identifier, the account ID being used to identify comprising the identity of the principal;
locating within the mapping an identity of an assigned authenticating authority from among the one or more authenticating authorities that corresponds to the individual identifier and domain identifier in the account ID of the principal to be authenticated;
causing an authentication request to be transmitted to the assigned authenticating authority located from among the one or more other authenticating authorities, the assigned authenticating authority having been located using the principal's individual identifier and domain identifiers in the principal's account ID, wherein the request asks the assigned authenticating authority to authenticate the principal;
altering the assignment mapping whereby an account ID previously mapped to a first authenticating authority is remapped to a second authenticating authority.
2. The method according to claim 1 , wherein each account ID comprises a namespace identifier, and wherein the plurality of account IDs comprises at least two account IDs having a common namespace identifier, wherein the at least two account IDs are mapped to at least two different respective ones of the plurality of authenticating authorities via the assignment mapping.
3. The method according to claim 1 , wherein each account ID comprises a namespace identifier, and wherein the plurality of account IDs comprises at least two account IDs having different namespace identifiers, wherein the at least two account IDs are mapped to the same one of the plurality of authenticating authorities via the assignment mapping.
4. The method according to claim 1 , wherein the assignment mapping is based at least in part on the organizational affiliation of principals within an entity.
5. The method according to claim 1 , wherein the assignment mapping is based at least in part on the geographical location of principals.
6. At a super authority connected to a network environment, an assigned authenticating authority and one or more other authenticating authorities also being connected to the network environment, each authenticating authority configured to authenticate of subset of principals that access the network environment through different domains, an apparatus for controlling authentication of a principal for access to network resources in the network environment, wherein the principal's account identifier is configured for authentication at an authenticating authority from among the assigned authenticating authority and the one or more other authenticating authorities, the apparatus comprising:
means for receiving at the super authority a request for an authenticating authority resolution from an authenticating authority that is not authorized to authenticate the principal, wherein the request comprises an account ID of the principal to be authenticated, the account ID including an individual identifier and a domain identifier;
means for accessing an assignment mapping that maps each account ID in a plurality of account IDs to a corresponding plurality of authenticating authorities that are authorized to authenticate the account ID, the account ID including an individual identifier and a domain identifier, the account ID being used to identify comprising the identity of the principal;
means for locating within the mapping an identity of an assigned authenticating authority from among the one or more authenticating authorities that corresponds to the individual identifier and domain identifier in the account ID of the principal to be authenticated;
means for causing an authentication request to be transmitted to the assigned authenticating authority located from among the one or more other authenticating authorities, the assigned authenticating authority having been located using the principal's individual identifier and domain identifiers in the principal's account ID, wherein the request asks the assigned authenticating authority to authenticate the principal;
means for altering the assignment mapping whereby an account ID previously mapped to a first authenticating authority is remapped to a second authenticating authority.
7. The apparatus according to claim 6 , wherein each account ID comprises a namespace identifier, and wherein the plurality of account IDs comprises at least two account IDs having a common namespace identifier, wherein the at least two account IDs are mapped to at least two different respective ones of the plurality of authenticating authorities via the assignment mapping.
8. The apparatus according to claim 6 , wherein each account ID comprises a namespace identifier, and wherein the plurality of account IDs comprises at least two account IDs having different namespace identifiers, wherein the at least two account IDs are mapped to the same one of the plurality of authenticating authorities via the assignment mapping.
9. At a super authority connected to a network environment, an assigned authenticating authority and one or more other authenticating authorities also being connected to the network environment, each authenticating authority configured to authenticate of subset of principals that access the network environment through different domains, computer executable instructions stored in a volatile or non-volatile computer readable medium to execute a method of controlling authentication of a principal for access to network resources in the network environment, wherein the principal's account identifier is configured for authentication at an authenticating authority from among the assigned authenticating authority and the one or more other authenticating authorities, the method comprising the steps of:
receiving at the super authority a request for an authenticating authority resolution from an authenticating authority that is not authorized to authenticate the principal, wherein the request comprises an account ID of the principal to be authenticated, the account ID including an individual identifier and a domain identifier;
accessing an assignment mapping that maps each account ID in a plurality of account IDs to a corresponding plurality of authenticating authorities that are authorized to authenticate the account ID, the account ID including an individual identifier and a domain identifier, the account ID being used to identify comprising the identity of the principal;
locating within the mapping an identity of an assigned authenticating authority from among the one or more authenticating authorities that corresponds to the individual identifier and domain identifier in the account ID of the principal to be authenticated;
causing an authentication request to be transmitted to the assigned authenticating authority located from among the one or more other authenticating authorities, the assigned authenticating authority having been located using the principal's individual identifier and domain identifiers in the principal's account ID, wherein the request asks the assigned authenticating authority to authenticate the principal;
altering the assignment mapping whereby an account ID previously mapped to a first authenticating authority is remapped to a second authenticating authority.
10. The computer executable instructions according to claim 9 , wherein each account ID comprises a namespace identifier, and wherein the plurality of account IDs comprises at least two account IDs having a common namespace identifier, wherein the at least two account IDs are mapped to at least two different respective ones of the plurality of authenticating authorities via the assignment mapping.
11. The computer executable instructions according to claim 9 , wherein each account ID comprises a namespace identifier, and wherein the plurality of account IDs comprises at least two account IDs having different namespace identifiers, wherein the at least two account IDs are mapped to the same one of the plurality of authenticating authorities via the assignment mapping.
12. The computer executable instructions according to claim 9 , wherein the assignment mapping is based at least in part on the organizational affiliation of principals within an entity.
13. The computer executable instructions according to claim 9 , wherein the assignment mapping is based at least in part on the geographical location of principals.