Identity management protocol router

1. A method for identity management comprising:

maintaining, at an identity management (IM) router:

a definition of a plurality of geographic regions;

associations between the plurality of geographic regions and IM consumers;

a set of data compliance policies associated with the plurality of geographic regions;

receiving, at the IM router, IM requests from the plurality of geographic regions;

routing, by the IM router, the IM requests to an IM producer to obtain identity management data;

obtaining, by the IM router, the identity management data from the IM producer;

filtering, by the IM router, the obtained identity management data to produce filtered identity management data, the filtering comprising:

enforcing, by the IM router, the set of data compliance policies to filter out prohibited data from the obtained identity management data, wherein the filtering out of the prohibited data includes the removal of identity management data that is non-compliant such that a sub-set of a received response is provided in response to the IM requests; and

returning, by the IM router, the filtered identity management data in IM responses to the IM requests.

2. The method of claim 1 , wherein receiving the IM requests from the plurality of geographic regions comprises receiving a first IM request routed to a first geographic region from a second geographic region by a chained router to request first IM data from the IM producer, wherein the IM producer is in the first geographic region;

wherein enforcing the set of data compliance policies comprises filtering the first IM data to produce first filtered IM data, the filtering of the first IM data comprising applying a first data compliance policy defined for the second geographic region that applies to routing IM data from the first geographic region to the second geographic region; and

wherein returning the filtered identity management data in the IM responses to the IM requests comprises returning the first filtered IM data to the chained router.

3. The method of claim 2 , wherein the first IM request is routed by the chained router from an IM consumer in a subregion of the second geographic region, wherein the definition of the plurality of geographic regions comprises a definition of the subregion of the second geographic region, and wherein the chained router further comprises a second data compliance policy associated with the subregion that governs provisioning of IM data from the first geographic region to the subregion to further filter the first filtered IM data.

4. The method of claim 1 , further comprising:

receiving at the IM router in a first geographic region from a chained router in a second geographic region, a first IM response to a first IM request, the first IM response comprising first filtered IM data responsive to the first IM request, the first filtered IM data filtered by the chained router based on a first data compliance policy defined for the first geographic region that governs provisioning of IM data from the second geographic region to the first geographic region; and

wherein routing the IM requests to obtain the identity management data comprises routing the first IM request from an IM consumer in the first geographic region to the chained router in the second geographic region, and wherein enforcing the set of data compliance policies comprises filtering the first filtered IM data to produce second filtered IM data, and wherein returning the IM responses to the IM requests comprises returning, to the IM consumer, the second filtered IM data.

5. The method of claim 4 , wherein filtering the first filtered IM data to produce the second filtered IM data comprises applying a second data compliance policy that governs the IM router providing IM data received from the second geographic region to the IM consumer.

6. The method of claim 5 , wherein the associations between the plurality of geographic regions and the IM consumers comprises an association of the IM consumer to a subregion of the first geographic region, wherein the definition of the plurality of geographic regions includes a definition of the subregion of the first geographic region, and wherein the second data compliance policy comprises a data compliance policy defined for the subregion of the first geographic region.

7. The method of claim 5 , wherein filtering the first filtered IM data to produce the second filtered IM data further comprises applying a third data compliance policy that governs the IM router receiving IM data from the second geographic region.

8. A non-transitory, computer-readable storage medium, including computer instructions executable by a processor, the computer instructions comprising instructions for:

maintaining a definition of a plurality of geographic regions;

maintaining a set of data compliance policies associated with the plurality of geographic regions;

maintaining associations between IM consumer identities and the set of data compliance policies;

receiving IM requests from the plurality of geographic regions;

routing the IM requests to an IM producer to obtain identity management data;

obtaining the identity management data from the IM producer;

filtering the obtained identity management data to produce filtered identity management data, filtering the obtained identity management data comprising:

enforcing the set of data compliance policies to filter out prohibited data the obtained identity management data, wherein the filtering out of the prohibited data includes the removal of identity management data that is non-compliant such that a sub-set of a received response is provided in response to the IM requests; and

returning the filtered identity management data in IM responses to the IM requests.

9. The non-transitory, computer-readable storage medium of claim 8 , wherein receiving the IM requests from the plurality of geographic regions comprises receiving a first IM request routed to a first geographic region from a second geographic region by a chained router to request first IM data from the IM producer, wherein the IM producer is in the first geographic region;

wherein enforcing the set of data compliance policies comprises filtering the first IM data to produce first filtered IM data, the filtering of the first IM data comprising applying a first data compliance policy defined for the second geographic region that applies to routing IM data from the first geographic region to the second geographic region; and

wherein returning the filtered identity management data in the IM responses to the IM requests comprises returning the first filtered IM data to the chained router responsive to the first IM request.

10. The non-transitory, computer-readable storage medium of claim 9 , wherein the first IM request is routed by the chained router from an IM consumer in a subregion of the second geographic region, wherein the definition of the plurality of geographic regions comprises a definition of the subregion of the second geographic region, and wherein the chained router further comprises a second data compliance policy associated with the subregion that governs provisioning of IM data from the first geographic region to the subregion to further filter the first filtered IM data.

11. The non-transitory, computer-readable storage medium of claim 8 , wherein the computer instructions further comprise instructions for:

receiving, in a first geographic region from a chained router in a second geographic region, a first IM response to a first IM request, the first IM response comprising first filtered IM data responsive to the first IM request, the first filtered IM data filtered by the chained router based on a first data compliance policy that governs provisioning of IM data from the second geographic region to the first geographic region;

wherein routing the IM requests to obtain the identity management data comprises routing the first IM request from an IM consumer in the first geographic region to the chained router in the second geographic region;

wherein enforcing the set of data compliance policies comprises filtering the first filtered IM data to produce second filtered IM data; and

wherein returning the IM responses to the IM requests comprises returning, to the IM consumer, the second filtered IM data.

12. The non-transitory, computer-readable storage medium of claim 11 , wherein filtering the first filtered IM data to produce the second filtered IM data comprises applying a second data compliance policy that governs providing IM data received from the second geographic region to the IM consumer.

13. The non-transitory, computer-readable storage medium of claim 12 , wherein the definition of the plurality of geographic regions comprises a definition of a subregion of the first geographic region, wherein the associations between the IM consumers and the plurality of geographic regions comprises an association of the IM consumer to the subregion of the first geographic region, and wherein the second data compliance policy comprises a data compliance policy defined for the subregion.

14. The non-transitory, computer-readable storage medium of claim 12 , wherein filtering the first filtered IM data to produce the second filtered IM data further comprises applying a third data compliance policy that governs receiving IM data from the second geographic region.

15. An identity management (IM) router comprising:

a processor;

a non-transitory, computer-readable storage medium, including computer instructions for:

maintaining a definition of a plurality of geographic regions;

maintaining a set of data compliance policies for the plurality of geographic regions;

maintaining associations between IM consumers and the plurality of geographic regions;

receiving, at an IM protocol router, IM requests from the plurality of geographic regions;

routing, by the IM protocol router, the IM requests to an IM producer to obtain identity management data;

obtaining the identity management data from the IM producer responsive to the IM requests;

filtering, by the IM protocol router, the obtained identity management data to produce filtered identity management data, the filtering comprising:

enforcing, by the IM protocol router, the set of data compliance policies for the plurality of geographic regions to filter out prohibited data from the obtained identity management data, wherein the filtering out of the prohibited data includes the removal of identity management data that is non-compliant such that a sub-set of a received response is provided in response to the IM requests; and

returning, by the IM protocol router, the filtered identity management data in IM responses to the IM requests.

16. The IM router of claim 15 , wherein receiving the IM requests from the plurality of geographic regions comprises receiving a first IM request routed to a first geographic region from a second geographic region by a chained router to request first IM data from the IM producer, wherein the IM producer is located in the first geographic region;

wherein routing the IM requests to obtain the identity management data comprises further routing the first IM request to obtain the first IM data;

wherein enforcing the set of data compliance policies comprises filtering the first IM data to produce first filtered IM data, the filtering of the first IM data comprising applying a first data compliance policy defined for the second geographic region that applies to routing IM data from the first geographic region to the second geographic region; and

wherein returning the filtered identity management data in IM responses to the IM requests comprises returning the first filtered IM data to the chained router.

17. The IM router of claim 16 , wherein the first IM request is routed by the chained router from an IM consumer in a subregion of the second geographic region, wherein the definition of the plurality of geographic regions comprises a definition of the subregion of the second geographic region, and wherein the chained router further comprises a second data compliance policy associated with the subregion that governs provisioning of IM data from the first geographic region to the subregion to further filter the first filtered IM data.

18. The IM router of claim 15 , wherein routing the IM requests to obtain the identity management data comprises routing a first IM request from an IM consumer in a first geographic region to a chained router in a second geographic region;

wherein the non-transitory, computer-readable medium further comprises instructions for receiving, from the chained router, a first IM response to the first IM request, the first IM response comprising first filtered IM data responsive to the first IM request, the first filtered IM data filtered by the chained router based on a first data compliance policy defined for the first geographic region that governs provisioning of IM data from the second geographic region to the first geographic region;

wherein enforcing the set of data compliance policies comprises filtering the first filtered IM data to produce second filtered IM data; and

wherein returning the IM responses to the IM requests comprises returning, to the IM consumer, the second filtered IM data.

19. The IM router of claim 18 , wherein filtering the first filtered IM data to produce the second filtered IM data comprises applying a second data compliance policy that governs the IM protocol router providing IM data received from the second geographic region to the IM consumer.

20. The IM router of claim 19 , wherein the definition of the plurality of geographic regions comprises a definition of a subregion of the first geographic region, wherein the associations between the plurality of geographic regions and the IM consumers comprises an association of the IM consumer to the subregion of the first geographic region, and wherein the second data compliance policy comprises a data compliance policy defined for the subregion of the first geographic region.

21. The IM router of claim 19 , wherein filtering the first filtered IM data to produce the second filtered IM data further comprises applying a third data compliance policy that governs the IM protocol router receiving IM data from the second geographic region.