System and method for multitenant management of domains

1. A method comprising, on a multitenant shared-resources system:

for each managed domain of a plurality of managed domains:

collecting configuration data for the managed domain via a configuration interface provided to an authorized user;

identifying domain-information sources for the managed domain based, at least in part, on the configuration data;

wherein the domain-information sources comprise a catalog server and an authentication server;

acquiring domain information for the managed domain from at least one domain-information source of the domain-information sources;

enumerating users for the managed domain; and

assigning at least a portion of the users to shared resources maintained by the multitenant shared-resources system; and

wherein at least a portion of the plurality of managed domains have independent security boundaries;

receiving a management request from an authorized user in connection with shared resources in use across the plurality of managed domains;

monitoring calls to management application programming interfaces (APIs) that do not accept credentials;

intercepting intermediate calls to one or more APIs that do accept credentials;

inserting appropriate credentials into each intercepted intermediate call;

completing each intercepted intermediate call;

receiving information responsive to the management request; and

providing the information to the authorized user.

2. The method of claim 1 , comprising storing a result of the assigning in a data store.

3. The method of claim 1 , wherein:

the configuration data identifies at least one domain name system (DNS) server; and

the identifying comprises:

connecting to the at least one DNS server; and

retrieving a list of one or more authentication servers and a list of one or more catalog servers.

4. The method of claim 1 , wherein the configuration data comprises information selected from the group consisting of: a domain long name, a domain short name, a DNS server network location, credentials, and a protocol selection.

5. The method of claim 1 , wherein the configuration data specifies a default protocol for communication related to the managed domain.

6. The method of claim 5 , wherein the default protocol comprises Secure Lightweight Directory Access Protocol (SLDAP).

7. The method of claim 5 , wherein the configuration interface allows the authorized user to deviate from the default protocol for a particular domain-information source and/or for a particular managed domain.

8. The method of claim 1 , wherein at least one of the managed domains is subsumed in a higher level directory that defines an applicable security boundary.

9. The method of claim 8 , wherein:

the multitenant shared-resources system implements MICROSOFT Active Directory;

the higher level directory comprises a forest; and

the authentication server is a domain controller.

10. The method of claim 9 , wherein the domain information comprises forest information related to the forest.

11. The method of claim 10 , wherein the forest information comprises information selected from the group consisting of: flatname, a root domain naming context, a configuration naming context, and user principal name (UPN) suffixes.

12. The method of claim 10 , wherein, for each domain of the forest, the forest information comprises a distinguished name for the domain.

13. The method of claim 1 , wherein the shared resources comprise virtual desktops.

14. The method of claim 1 , where the acquiring comprises;

searching a connection cache for an existing connection session to the at least one domain-information source; and

responsive to a match, using the existing connection session to connect to the at least one domain-information source.

15. The method of claim 1 , comprising allowing a managed service provider (MSP) to maintain the plurality of managed domains.

16. The method of claim 1 , wherein the enumerating comprises enumerating users, groups, and organizational units for the managed domains.

17. The method of claim 16 , wherein the assigning comprises assigning at least a portion of the users, at least a portion of the groups, and at least a portion of the organizational units to shared resources maintained by the multitenant shared-resources system.

18. An information handling system comprising:

at least one computer processor, wherein the at least one computer processor is operable to implement a method, the method comprising:

for each managed domain of a plurality of managed domains:

collecting configuration data for the managed domain via a configuration interface provided to an authorized user;

identifying domain-information sources for the managed domain based, at least in part, on the configuration data;

wherein the domain-information sources comprise a catalog server and an authentication server;

acquiring domain information for the managed domain from at least one domain-information source of the domain-information sources;

enumerating users for the managed domain; and

assigning at least a portion of the users to shared resources maintained by the information handling system; and

wherein at least a portion of the plurality of managed domains have independent security boundaries;

receiving a management request from an authorized user in connection with shared resources in use across the plurality of managed domains;

monitoring calls to management application programming interfaces (APIs) that do not accept credentials;

intercepting intermediate calls to one or more APIs that do accept credentials;

inserting appropriate credentials into each intercepted intermediate call;

completing each intercepted intermediate call;

receiving information responsive to the management request; and

providing the information to the authorized user.

19. A computer-program product comprising a non-transitory computer-usable medium having computer-readable program code embodied therein, the computer-readable program code adapted to be executed to implement a method comprising:

for each managed domain of a plurality of managed domains:

collecting configuration data for the managed domain via a configuration interface provided to an authorized user;

identifying domain-information sources for the managed domain based, at least in part, on the configuration data;

wherein the domain-information sources comprise a catalog server and an authentication server;

acquiring domain information for the managed domain from at least one domain-information source of the domain-information sources;

enumerating users for the managed domain; and

assigning at least a portion of the users to shared resources maintained by a multitenant shared-resources system; and

wherein at least a portion of the plurality of managed domains have independent security boundaries;

receiving a management request from an authorized user in connection with shared resources in use across the plurality of managed domains;

monitoring calls to management application programming interfaces (APIs) that do not accept credentials;

intercepting intermediate calls to one or more APIs that do accept credentials;

inserting appropriate credentials into each intercepted intermediate call;

completing each intercepted intermediate call;

receiving information responsive to the management request; and

providing the information to the authorized user.