US 12,218,906 B1
Centralized technology access control
Yuhu Zhong, Shanghai (CN); Jun Wu, Shanghai (CN); Yihua Tian, Shanghai (CN); and Wei Jan, Shanghai (CN)
Assigned to Morgan Stanley Services Group Inc., New York, NY (US)
Filed by Morgan Stanley Services Group Inc., New York, NY (US)
Filed on Nov. 2, 2022, as Appl. No. 18/051,964.
Int. Cl. H04L 61/4523 (2022.01); H04L 9/40 (2022.01); H04L 101/30 (2022.01); H04L 101/60 (2022.01)
CPC H04L 61/4523 (2022.05) [H04L 63/104 (2013.01); H04L 2101/30 (2022.05); H04L 2101/60 (2022.05)] 19 Claims
OG exemplary drawing
 
1. A method for automated entitlement creation and control for IT applications of an enterprise IT Infrastructure System for an enterprise, the method comprising:
storing, in a configuration management database (CMDB) for the enterprise IT infrastructure system, meta data for IT resources of the enterprise, wherein the meta data comprise, for each IT resource, data of registered IT assets of the enterprise associated with each IT resource, wherein the meta data stored in the CMDB comprise new IT resource meta data for an unmanaged, new IT resource for the IT Infrastructure System;
automatically discovering, by an access control system of the enterprise IT Infrastructure System, the unmanaged, new IT resource for the IT Infrastructure System, based on automatically discovering the new IT resource meta data for the unmanaged, new IT resource in the CMDB database, wherein the new IT resource meta data are associated with the unmanaged, new IT resource;
in response to discovery of the unmanaged, new IT resource, generating, by the access control system, based on the new IT resource meta data, in a lightweight directory access protocol (LDAP) server of the enterprise IT infrastructure system, an entitlement for one or more groups of enterprise users, wherein, for each of the one or more groups, a value for each of one or more parameters of the entitlement is included in an LDAP group name, wherein the value for each of the one or more parameters is based on the new IT resource meta data and the value for each of the one or more parameters is arranged in the LDAP group name based on a pre-defined LDAP group naming convention; and
mapping, by the access control system, the entitlement for each of the one or more groups to one or more target IT assets of the enterprise IT infrastructure system that are already registered with the enterprise IT infrastructure system, wherein the mapping for each of the one or more groups is based on the LDAP group name for each of the one or more groups.