Granted Patent B1

US 11,146,564 · App. 16/044,000 · Granted Oct 12, 2021

Inventors: Shiva Ankam (Sammamish, WA); Yu Tan (Sammamish, WA)

Assignee: Pure Storage, Inc.

H04L63/102H04L9/3213H04L41/0869H04L41/145H04L63/083H04L63/0876H04L63/104H04L67/1097

Abstract

Claims (42)

1. A method comprising:

extracting, based on a user identifier for a user, a domain registered with a cloud storage platform, wherein each domain registered with the cloud storage platform is associated with an identity authentication endpoint and one or more groups to which users from the domain may be assigned;

providing, to an identity authentication endpoint associated with the extracted domain, login credentials for the user;

receiving an identity authorization from the identity authentication endpoint associated with the extracted domain, wherein the identity authorization comprises a plurality of groups for the user;

filtering out from the plurality of groups included in the identity authorization, one or more groups that are not registered with the cloud storage platform, wherein the filtering generates a set of one or more registered groups that are a subset of the plurality of groups included in the identity authorization;

creating a token based on the set of one or more registered groups that are a subset of the plurality of groups included in the identity authorization; and

utilizing the token for authorization and authentication by applications accessible via the cloud storage platform.

2. The method of claim 1 further comprising:

associating, with a domain registered in the cloud storage platform, an identity authentication endpoint.

3. The method of claim 2 wherein registering a domain in the cloud storage platform further comprises extracting the domain from telemetry data provided to the cloud storage platform from a storage system.

4. The method of claim 2 further comprising:

extracting, from telemetry data provided to the cloud storage platform from a storage system, one or more groups.

5. The method of claim 1 further comprising:

responsive to receiving a request to modify an identity authentication endpoint configuration, performing a validation test utilizing a test configuration environment established based on the requested modification.

6. The method of claim 5 further comprising:

if the test configuration environment passes the validation test, committing the requested modification to the identity authentication endpoint configuration only upon receipt of a confirmation within a predefined period of time.

7. The method of claim 1 wherein the identity authentication endpoint comprises a cloud-based identity provider.

8. The method of claim 1 wherein the identity authentication endpoint comprises an on-premises directory service.

9. An apparatus comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions that, when executed by the computer processor, cause the apparatus to carry out:

extracting, based on a user identifier for a user, a domain registered with a cloud storage platform, wherein each domain registered with the cloud storage platform is associated with an identity authentication endpoint and one or more groups to which users from the domain may be assigned;

providing, to an identity authentication endpoint associated with the extracted domain, login credentials for the user;

receiving an identity authorization from the identity authentication endpoint associated with the extracted domain, wherein the identity authorization comprises a plurality of groups for the user;

filtering out from the plurality of groups included in the identity authorization, one or more groups that are not registered with the cloud storage platform, wherein the filtering generates a set of one or more registered groups that are a subset of the plurality of groups included in the identity authorization;

creating a token based on the set of one or more registered groups that are a subset of the plurality of groups included in the identity authorization; and

utilizing the token for authorization and authentication by applications accessible via the cloud storage platform.

10. The apparatus of claim 9 further comprising computer program instructions that, when executed by the computer processor, cause the apparatus to carry out:

associating, with a domain registered in the cloud storage platform, an identity authentication endpoint.

11. The apparatus of claim 10 wherein registering a domain in the cloud storage platform further comprises extracting the domain from telemetry data provided to the cloud storage platform from a storage system.

12. The apparatus of claim 10 further comprising computer program instructions that, when executed by the computer processor, cause the apparatus to carry out:

extracting, from telemetry data provided to the cloud storage platform from a storage system, one or more groups.

13. The apparatus of claim 9 further comprising computer program instructions that, when executed by the computer processor, cause the apparatus to carry out:

responsive to receiving a request to modify an identity authentication endpoint configuration, performing a validation test utilizing a test configuration environment established based on the requested modification.

14. The apparatus of claim 13 further comprising computer program instructions that, when executed by the computer processor, cause the apparatus to carry out:

if the test configuration environment passes the validation test, committing the requested modification to the identity authentication endpoint configuration only upon receipt of a confirmation within a predefined period of time.

15. A computer program product comprising a non-transitory computer readable medium, the computer program product comprising computer program instructions that, when executed, cause a computer to carry out:

extracting, based on a user identifier for a user, a domain registered with a cloud storage platform, wherein each domain registered with the cloud storage platform is associated with an identity authentication endpoint and one or more groups to which users from the domain may be assigned;

providing, to an identity authentication endpoint associated with the extracted domain, login credentials for the user;

receiving an identity authorization from the identity authentication endpoint associated with the extracted domain, wherein the identity authorization comprises a plurality of groups for the user;

filtering out from the plurality of groups included in the identity authorization, one or more groups that are not registered with the cloud storage platform, wherein the filtering generates a set of one or more registered groups that are a subset of the plurality of groups included in the identity authorization;

creating a token based on the set of one or more registered groups that are a subset of the plurality of groups included in the identity authorization; and

utilizing the token for authorization and authentication by applications accessible via the cloud storage platform.

16. The method of claim 5 , further comprising; if the test configuration environment fails the validation test, rolling-back the test configuration environment.

Assignments (3)

Cited By (8)

US 12,204,797 US 12,244,717 US 12,267,252 US 12,299,561 US 12,316,681 US 12,400,029 US 12,407,732 US 12,445,499