MANAGEMENT AND APPLICATION OF ENTITLEMENTS

Abstract

A method and system for managing and applying entitlements is described herein. An identity integration server centrally manages data associated with entitlements for a plurality of identities. The integration server may select one of a plurality of workflows. One or more of a plurality of entitlements to be used in the workflow are selected, and a set of identities for which the workflow is applicable is selected. A determination is made as to whether the workflow should be run on the identities. If so, then the workflow is initiated. The one or more entitlements are then added to a granted entitlements list. Then, a separate process may be initiated to apply the one or more entitlements to the one or more identities.

Description

DESCRIPTION OF THE DRAWINGS

The present description will be better understood from the following detailed description read in light of the accompanying drawings, wherein:

FIG. 1 is a block diagram illustrating an exemplary system for managing and applying entitlements.

FIG. 2 is a flow diagram illustrating an exemplary process for selecting and applying entitlements to selected identities.

FIG. 3 is a flow diagram illustrating an exemplary process for applying an entitlement to an identity upon request.

FIG. 4 is a screenshot illustrating an exemplary user interface for managing entitlements.

FIG. 5 is a screenshot illustrating an exemplary user interface for defining an identity rule.

FIG. 6 is a screenshot illustrating an exemplary user interface for defining a workflow.

FIG. 7 illustrates an exemplary computing environment in which certain aspects of the invention may be implemented.

Claims

1. A method comprising: selecting one of a plurality of workflows;selecting one or more of a plurality of entitlements to be used in the selected workflow;selecting one or more of a plurality of identities for which the workflow is applicable;initiating the workflow on the one or more selected identities to grant the one or more entitlements to the one or more selected identities; andinitiating a process to apply the one or more selected entitlements to the one or more selected identities.

2. The method of claim 1, wherein each identity is associated with a stored metaverse object.

3. The method of claim 1, further comprising determining whether a selected identity has a selected entitlement.

4. The method of claim 3, further comprising initiating the workflow when the selected identity does not have the selected entitlement.

5. The method of claim 1, further comprising determining a workflow for revoking a selected entitlement.

6. The method of claim 5, further comprising determining whether the selected identity has a selected entitlement that should be revoked.

7. The method of claim 6, further comprising initiating the workflow for revoking a selected entitlement when the selected identity has a selected entitlement that should be revoked.

8. The method of claim 1, wherein one or more of the plurality of entitlements is an account.

9. The method of claim 1, wherein one or more of the plurality of entitlements is an access right.

10. A system comprising: a data store to store metaverse objects, each metaverse object associated with an identity;one or more management agents coupled to one or more directories to send requests for entitlements and to apply entitlements to the corresponding directories; andan integration server coupled to the data store and to the one or more management agents to centrally manage data associated with entitlements for a plurality of identities, the integration server to receive the requests for entitlements from the management agents, to initiate corresponding workflows for the requests, and to initiate processes to apply the entitlements to the corresponding directories through the corresponding management agents.

11. The system of claim 10, where the integration server to maintain for each metaverse object a granted entitlements list indicating one or more entitlements that have been granted to the metaverse object via the corresponding workflows.

12. The system of claim 10, where the integration server to maintain for each metaverse object a current entitlements list indicating one or more entitlements the metaverse object currently has.

13. The system of claim 10, further comprising a data store coupled to the integration server to store workflows, each workflow associated with a business process to grant or revoke at least one of the entitlements for at least one of the identities managed by the integration server.

14. The system of claim 10, further comprising a data store coupled to the integration server to store definitions for the entitlements managed by the integration server.

15. One or more device-readable media with device-executable instructions for performing steps comprising: receiving a request to grant an entitlement to an identity, the identity associated with a metaverse object;determining a business process associated with granting the requested entitlement to the identity;initiating the business process to grant the requested entitlement to the identity; andinitiating a separate process to apply the requested entitlement to the identity.

16. The one or more device-readable media of claim 15, wherein the steps further comprise adding the requested entitlement to a list of granted entitlements associated with the identity.

17. The one or more device-readable media of claim 15, wherein initiating a separate process to apply the requested entitlement to the identity comprises sending a request to a management agent to apply the requested entitlement to the identity.

18. The one or more device-readable media of claim 17, wherein the steps further comprise adding the requested entitlement to a list of current entitlements associated with the identity when the requested entitlement has been applied to the identity.

19. The one or more device-readable media of claim 15, wherein the requested entitlement is an account.

20. The one or more device-readable media of claim 15, wherein the requested entitlement is an access right.