Access management system

1. A method of operating a computer as a fulfillment server in an access management system managing access-control records at endpoint computer systems, the access-control records describing rights and restrictions of users with respect to resources of the endpoint computer systems and being used by access-control mechanisms of the endpoint computer systems to enforce the rights and restrictions, the method comprising:

executing computer program instructions, by a processor, to form a set of connectors, the connectors being communicatively coupled to respective endpoint computer systems and being structured and operative to translate change requests provided to the connectors into corresponding transactions with the endpoint computer systems, the transactions using system management protocols native to the respective endpoint computer systems to modify the access-control records of the endpoint computer systems according to contents of the transactions;

periodically engaging, by the processor, in fulfillment polling communications with an access management server of the access management system, the access management server maintaining a database of active change requests describing modifications to be made to the access-control records, the fulfillment polling communications including request messages sent from the fulfillment server to the access management server and corresponding response messages sent from the access management server to the fulfillment server, the request messages requesting retrieval of active change requests from the database and the response messages containing active change requests retrieved from the database; and

providing, by the processor, the active change requests from the response messages to the connectors to cause the connectors to translate the change requests into corresponding transaction and to perform the corresponding transactions with the endpoint computer systems to make the modifications to the access-control records of the endpoint computer systems,

the method further comprising:

periodically engaging, by the processor, in connector polling communications with the access management server, the access management server storing new connectors in the database to be sent to the fulfillment server for use thereby, the connector polling communications including request messages sent from the fulfillment server to the access management server and corresponding response messages sent from the access management server to the fulfillment server, the request messages requesting retrieval of new connectors from the database and the response messages containing new connectors retrieved from the database; and

deploying, by the processor, the connectors received in the response messages for fulfilling change requests directed to associated ones of the endpoint computer systems,

wherein creating a new connector includes configuring endpoint data to be used at runtime, in particular defining endpoint instances by specifying (i) a type of connector to use when talking to the endpoint instances; (ii) how to connect to the endpoint instances; (iii) which of a set of common commands an endpoint instance will support; and (iv) for each supported command, what information the endpoint instance will require as part of the command and how to implement the command,

and wherein creating a new connector includes specifying capabilities and required parameters for using the connector, a capability being support for a particular command or operation with respect to one or more of a group, account, or role,

and further including, for each capability, receiving a set of required parameters that must be supplied in a change request to exercise the capability.

2. A method according to claim 1 , wherein the change requests include requests to add access, remove access, and modify access by a user to the resources of the endpoint computer systems.

3. A method according to claim 1 , wherein the fulfillment server is deployed inside a firewall of an organization and the access management server is deployed in a compute cloud outside the firewall of the organization, and wherein the fulfillment polling communications employ a standard client-server request/response protocol over a secure transport session.

4. A method according to claim 1 , wherein the fulfillment server is a first one of a plurality of fulfillment servers coupled to the access management server and employing respective fulfillment polling communications to obtain respective change requests from the database.

5. A method according to claim 4 , wherein the access management server is deployed within a firewall of an organization, and wherein a first set of the fulfillment servers are also located within the firewall and a second set of the fulfillment servers are located outside the firewall.

6. A method according to claim 1 , wherein the response messages are first response messages each including at least one active change request, and the fulfillment polling communications also includes second response messages indicating that no active change requests are being returned, and further including the fulfillment server (i) immediately sending a second request message for additional active change requests upon receiving one of the first response messages and (ii) refraining from immediately sending a second request message for additional active change requests upon receiving one of the second response messages.

7. A method according to claim 1 , wherein the fulfillment server includes a fulfillment server application executed by the computer, and further including instantiating and initializing the fulfillment server prior to performing the method of claim 1 .

8. A method according to claim 7 , wherein instantiating the fulfillment server includes (i) requesting download of a server archive from the access management computer, and (ii) downloading the server archive from a location specified by the access management computer.

9. A method according to claim 1 , further comprising:

gathering logs from the endpoint computer systems, the logs containing records of activity of the endpoint computer systems pertaining to the access-control records; and

periodically uploading gathered logs to the access management system for storage in the database in support of workflows retrieving and using the logs from the database.

10. A method of operating a computer as an access management server in an access management system managing access-control records at endpoint computer systems, the access-control records describing rights and restrictions of users with respect to resources of the endpoint computer systems and being used by access-control mechanisms of the endpoint computer systems to enforce the rights and restrictions, the method comprising:

receiving, by a processor, user specifications of modifications to be made to the access-control records;

creating, by the processor, corresponding change request records and storing them in a database; and

engaging, by the processor, in fulfillment polling communications with a fulfillment server responsible for causing the changes described by the change requests to be made on the endpoint computer systems, the fulfillment polling communications including (i) receiving request messages from the fulfillment server requesting retrieval of active change requests from the database, and (ii) sending corresponding response messages to the fulfillment server containing active change requests retrieved from the database,

the method further comprising:

creating, by the processor under control of a user, new connectors for use with corresponding endpoint computer systems and storing the new connectors in the database to be sent to the fulfillment server for use in fulfilling change requests directed to associated ones of the endpoint computer systems; and

periodically engaging, by the processor, in connector polling communications with the fulfillment server, the connector polling communications including request messages sent from the fulfillment server to the access management server and corresponding response messages sent from the access management server to the fulfillment server, the request messages requesting retrieval of new connectors from the database and the response messages containing new connectors retrieved from the database,

wherein creating a new connector includes configuring endpoint data to be used at runtime, in particular defining endpoint instances by specifying (i) a type of connector to use when talking to the endpoint instances; (ii) how to connect to the endpoint instances; (iii) which of a set of common commands an endpoint instance will support; and (iv) for each supported command, what information the endpoint instance will require as part of the command and how to implement the command,

and wherein creating a new connector includes specifying capabilities and required parameters for using the connector, a capability being support for a particular command or operation with respect to one or more of a group, account, or role,

and further including, for each capability, specifying a set of required parameters that must be supplied in a change request to exercise the capability.

11. A method according to claim 10 , further including monitoring for completion by the fulfillment server of active change requests stored in the database, the monitoring including receiving callback messages from the fulfillment server and using completion status information from the callback messages to update completion status information for the active change requests stored in the database.

12. A method according to claim 10 , wherein the response messages are first response messages each including at least one active change request, and the fulfillment polling communications also includes second response messages indicating that no active change requests are being returned, and further including, by the access management server upon receiving a request message when no active change requests are in the database, (i) waiting a predetermined period for a new change request to be added to the database, (ii) upon addition of one or more new change requests to the database, sending a first response message to the fulfillment server containing at least one of the new change requests, and (iii) upon the predetermined period ending without a new change request being added to the database, sending a second response message to the fulfillment server.

13. A method according to claim 10 , further including, in response to a request for deployment of a new fulfillment server, (i) generating a new fulfillment server archive containing an instance of a fulfillment server application program and (ii) storing the new fulfillment server archive in a location accessible to a physical computer that is to execute the fulfillment server application program to form the new fulfillment server.

14. A method according to claim 10 , further comprising:

periodically receiving uploaded logs from the fulfillment server, the logs containing records of activity at the endpoint computer systems pertaining to the access-control records; and

storing the received logs in the database in support of workflows retrieving and using the logs from the database.

15. A method according to claim 10 , wherein configuring the endpoint data is performed using a GUI-based workbench tool of workbenches included in the access management server.

16. A method according to claim 10 , wherein creating a new connector includes specifying identification information for the connector, the identification information including a name, a description, and a type, the type being selected from among a set of predetermined types previously created or established.

17. A method according to claim 10 , wherein creating a new connector includes specifying settings for the new connector, the settings being of multiple classes including (i) connection settings for a connection to an endpoint, and ii) distinguished name settings for an account or group at the endpoint.

18. A method according to claim 1 , wherein configuring the endpoint data is performed using a GUI-based workbench tool of workbenches included in the access management server.

19. A method according to claim 1 , wherein creating a new connector includes receiving identification information for the connector, the identification information including a name, a description, and a type, the type being selected from among a set of predetermined types previously created or established.

20. A method according to claim 1 , wherein creating a new connector includes receiving settings for the new connector, the settings being of multiple classes including (i) connection settings for a connection to an endpoint, and ii) distinguished name settings for an account or group at the endpoint.