Unified user identification with automatic mapping and database absence handling
View Patent ↗An identification system that may be used in heterogeneous computing environments provides a fail-free path to providing identifiers from a single canonical namespace. Objects or gateways requiring an identifier for access are accessed using an identifier for the canonical namespace. If an entity requests access using an identifier from another namespace, an external database is consulted to determine if a mapping exists for the identifier to another identifier the canonical namespace. If no mapping exists, or the external database is unavailable, then an identifier is automatically generated in the canonical namespace and is used for the access. An internal database is updated with the automatically generated identifier, providing a mechanism to add mappings without administrative intervention. To access resources requiring an identifier from another particular namespace, a canonical namespace identifier may be mapped to another identifier in the particular namespace, or a generic identifier may be used.
1. A computer-performed method for controlling access to a resource in a computer system, the method comprising:
receiving a request to access a resource including a first identifier associated with an entity, wherein the first identifier is a member of a canonical namespace, and wherein the receiving receives a request to access an object not directly accessible using an identifier from the canonical namespace but otherwise accessible using a third identifier from another namespace;
determining whether or not the first identifier is a member of the canonical namespace containing identifiers used to access resources in the computer system;
responsive to determining that the first identifier is a member of the canonical namespace, accessing the resource using the first identifier;
determining whether the first identifier has a mapping to the canonical namespace stored in an internal database;
responsive to determining that the first identifier is not a member of the canonical namespace and does not have a mapping to the canonical namespace stored in the internal database, automatically generating a second identifier for the entity within the canonical namespace and storing the second identifier in the internal database for further identification of the entity;
responsive to generating and storing the second identifier, accessing the resource using the second identifier;
obtaining the third identifier in the another namespace using the first identifier, wherein the obtaining assigns a default identifier from the another namespace as the third identifier, wherein the default identifier is automatically assigned to accesses from the canonical namespace to the another namespace; and
accessing the resource using the third identifier.
2. A computer system, comprising:
a processor for executing program instructions; and
a memory coupled to the processor for executing the program instructions, wherein the program instructions include program instructions for controlling access to a resource in the computer system, wherein the program instructions comprise program instructions for receiving a request to access a resource including a first identifier associated with an entity, wherein the first identifier is a member of a canonical namespace, and wherein the program instructions for receiving receive a request to access an object not directly accessible using an identifier from the canonical namespace but otherwise accessible using a third identifier from another namespace, determining whether or not the first identifier is a member of the canonical namespace containing identifiers used to access resources in the computer system, responsive to determining that the first identifier is a member of the canonical namespace, accessing the resource using the first identifier, responsive to determining that the first identifier is not a member of the canonical namespace and does not have a mapping to the canonical namespace stored in the internal database, automatically generating a second identifier for the entity within the canonical namespace and storing the second identifier in the internal database for further identification of the entity, responsive to generating and storing the second identifier, accessing the resource using the second identifier, obtaining the third identifier in the another namespace using the first identifier, and accessing the object using the third identifier, wherein the program instructions for obtaining assign a default identifier from the another namespace as the third identifier, and wherein the default identifier is automatically assigned to accesses from the canonical namespace to the another namespace.
3. A computer program product comprising non-transitory computer-readable storage media storing program instructions for execution within a computer system, wherein the program instructions include program instructions for controlling access to a resource in the computer system, wherein the program instructions comprise program instructions for:
receiving a request to access a resource including a first identifier associated with an entity , wherein the first identifier is a member of a canonical namespace, and wherein the program instructions for receiving receive a request to access an object not directly accessible using an identifier from the canonical namespace but otherwise accessible using a third identifier from another namespace;
determining whether or not the first identifier is a member of the canonical namespace containing identifiers used to access resources in the computer system;
responsive to determining that the first identifier is a member of the canonical namespace, accessing the resource using the first identifier;
responsive to determining that the first identifier is not a member of the canonical namespace and does not have a mapping to the canonical namespace stored in the internal database, automatically generating a second identifier for the entity within the canonical namespace and storing the second identifier in the internal database for further identification of the entity;
responsive to generating and storing the second identifier, accessing the resource using the second identifier;
obtaining the third identifier in the another namespace using the first identifier, wherein the program instructions for obtaining assign a default identifier from the another namespace as the third identifier, wherein the default identifier is automatically assigned to accesses from the canonical namespace to the another namespace; and
accessing the object using the third identifier.