Management of credentials used by software applications
An identity management (“IdM”) system can change the credentials at certain intervals. If credentials change, there is no way for an application that uses the credentials to know that the credentials have changed because the application dependency relationships are unknown. When service account credentials change, credentials are typically manually updated for each dependent application. Some embodiments of the inventive subject matter allow IdM systems to track application dependencies for service accounts. The IdM systems can detect when service account credentials change and automatically notify dependent applications of the new service account credentials.
1. A method comprising:
determining with a computer processor that a first set of service credentials is used to access a first service account, dependent applications available via the first service account, and other service accounts accessible via the dependent applications;
detecting that the first set of service credentials of the first service account have changed to a changed set of service credentials;
retrieving first account information associated with the first service account from a database, wherein the first account information comprises a dependent application list, and dependent application information;
determining the dependent applications from the dependent application list, wherein the dependent applications log in to the other service accounts using the first set of service credentials; and
sending, to the dependent application, the changed set of credentials;
detecting a registration request from a first application;
authenticating the first application;
determining a second service account to be used by the first application based on the registration request;
associating the first application with the second service account;
retrieving a second set of service credentials associated with the second service account from the database; and
transmitting the second set of service credentials to the first application.
2. The method of claim 1 , wherein the first account information comprises, one or more of, an account type, a username, a password, application owners of the dependent applications, notification addresses of the dependent applications.
3. The method of claim 1 , wherein said sending to the dependent applications further comprises determining notification addresses of the dependent applications indicated in the dependent application list.
4. The method of claim 1 , wherein said authenticating the first application further comprises determining that a digital certificate of the first application is valid.
5. The method of claim 1 , wherein said associating the first application with the first service account further comprises storing an application identifier, a digital certificate and a notification address in the database.
6. The method of claim 1 further comprising:
detecting, from a second application, a credentials request for a third set of service credentials;
determining, based on the credentials request, a third service account to be used by the second application;
retrieving, from the database, a third account information associated with the third service account;
determining, based on the third account information, that the second application is authorized to use the third service account; and
transmitting a third set of service credentials to the second application, wherein the third account information contains the third set of service credentials.
7. One or more non-transient computer readable mediums having stored therein a program product, which when executed by a set of one or more processor units causes the set of one or more processor units to perform operations that comprise:
determining that a first set of service credentials is used to access a first service account, dependent applications available via the first service account, and other service accounts accessible via the dependent applications;
detecting that the first set of service credentials of the first service account have changed to a changed set of service credentials;
retrieving first account information associated with the first service account from a database, wherein the first account information comprises a dependent application list, and dependent application information;
determining the dependent applications from the dependent application list, wherein the dependent applications log in to, using the first set of service credentials, the other service accounts; and
sending, to the dependent application, the changed set of credentials;
detecting a registration request from a first application;
authenticating the first application;
determining a second service account to be used by the first application based on the registration request;
associating the first application with the second service account;
retrieving a second set of service credentials associated with the second service account from the database; and
transmitting the second set of service credentials to the first application.
8. The non-transient computer readable medium of claim 7 , wherein the first account information comprises, one or more of, an account type, a username, a password, application owners of the of dependent applications, notification addresses of the dependent applications.
9. The non-transient computer readable medium of claim 7 , wherein said sending to the dependent applications further comprises determining notification addresses of the dependent applications indicated in the dependent application list.
10. The non-transient computer readable medium of claim 7 , wherein said authenticating the first application further comprises determining that a digital certificate of the first application is valid.
11. The non-transient computer readable medium of claim 7 , wherein said associating the first application with the first service account further comprises storing an application identifier, a digital certificate and a notification address in the database.
12. The non-transient computer readable medium of claim 7 , wherein the operations further comprise:
detecting a credentials request for a third set of service credentials from an second application;
determining a third service account to be used by the second application based on the credentials request;
retrieving a third account information associated with the third service account from a database;
determining that the second application is authorized to use the third service account based on the third account information; and
transmitting a third set of service credentials to the second application, wherein the third account information contains the third set of service credentials.
13. An apparatus comprising:
A set of one or more processing units;
A network interface; and
An application update unit to,
determine that a first set of service credentials is used to access a first service account, dependent applications available via the first service account, and other service accounts accessible via the dependent applications;
detect that the first set of service credentials of the first service account have changed to a changed set of service credentials;
retrieve first account information associated with the first service account from a database, wherein the first account information comprises a dependent application list, and dependent application information;
determine the dependent applications from the dependent application list, wherein the dependent applications log in to, using the first set of service credentials, the other service accounts; and
send, to the dependent application, the changed set of credentials;
detect a registration request from a first application;
authenticate the first application;
determine a second service account to be used by the first application based on the registration request;
associate the first application with the second service account;
retrieve a second set of service credentials associated with the second service account from the database; and
transmit the second set of service credentials to the first application.
14. The apparatus of claim 13 , wherein the application update unit comprises one or more non-transient computer readable medium.