TECHNICAL FIELD

The present invention relates to the seamless migration of identity information in business intelligence environments.

BACKGROUND

In modern business, increasing standards, automation, and technologies have led to vast amounts of data becoming available. BI systems make it possible to collect, identify, extract, analyze, and report business data in a User- and business-friendly manner.

Users may access a Business Intelligence (BI) environment to access one or more functions resources and/or capabilities of the BI environment. Namespaces in the BI environment may be used in conjunction with external security sources to authenticate, authorize and/or validate users. An external security source may verify user identification (e.g., username and/or password, biometric identifiers, security tokens, etc.) provided by a user or the user's computing environment to authenticate the user and allow access to the BI environment.

SUMMARY

In various implementations, at least a portion of a plurality of security principals defined in a First External Security Source may be retrieved, and at least one or more local identifiers associated with the retrieved security principal(s) may be retrieved from a First Security Namespace. Each local identifier uniquely identifies one of the security principals in a Business Intelligence Environment. The local identifier(s) may be generated by the First Security Namespace, and the First Security Namespace may expose the security principal(s) from the First External Security Source for functions in the Business Intelligence Environment using the local identifier(s). A mapping of at least a portion of the retrieved security principals and the retrieved associated local identifier(s) may be generated and the generated mapping may be stored in a memory coupled to a Security Migration System. A Security Migration System Namespace may be provided that coordinates with the Security Migration System to expose the security principal(s) to the Business Intelligence Environment using the local identifier(s), from the generated mapping and previously used by the First Security Namespace. wherein the Security Migration System Namespace is adapted to enable access in the Business Intelligence Environment that is based on the generated mapping and that is not limited to user authentication by the First External Security Source.

Implementations may include one or more of the following features. Access to the First External Security Source may be restricted and the Security Migration System Namespace may provide access in the Business Intelligence Environment, for the security principal(s) defined in the First External Security Source, based on the local identifier(s) in the generated mapping, when access to the First External Security Source is restricted. The First Security Namespace may be replaced with the Security Migration System Namespace. The Security Migration System may self-validate at least a portion of the security principals based at least partially on the generated mapping. The Security Migration System Namespace may replace the First Security Namespace and may provide access in the Business Intelligence Environment using the local identifier(s) previously generated by the First Security Namespace. In some implementations, the Security Migration System Namespace may enable access in the Business Intelligence Environment, for the security principal(s) defined in the First External Security Source, based on the local identifier(s) generated by the First Security Namespace, when access to the First Security Namespace is restricted. In some implementations, the security principal(s) in the mapping may be authenticated based at least partially on the Security Migration System Namespace, and access in the Business Intelligence environment may be allowed using the local identifier(s) in the generated mapping.

In some implementations, additional security principals defined in a Second External Security Source may be retrieved, and the Security Migration System Namespace may be allowed to be associated with the additional security principal(s). The Security Migration System Namespace may generate additional local identifier(s). Each additional local identifier uniquely identifies one of the additional security principal(s). The Security Migration System Namespace may expose the security principal(s) from the Second External Security Source for functions in the Business Intelligence Environment using the additional local identifier(s). Authentication of security principals may be allowed utilizing the Second External Security Source and/or the Security Migration System Namespace. Access in the Business Intelligence environment may be enabled based on the local identifier(s) in the generated mapping and/or the additional local identifier(s) generated by the Security Migration System Namespace for the additional security principals. The Security Migration System Namespace may delegate validation of at least a portion of the security principals in the generated mapping to the Second External Security Source. In some implementations, one or more matching security principals may be identified based on a determination of whether security principal(s) in the generated mapping are the same as the additional security principal(s), and the additional association(s) in the mapping may be generated. The additional association(s) may include an association of the local identifier(s) in the mapping that are associated with the matching security principal(s) and the additional security principal(s) such that validation of a matching security principal may be delegated to the Second External Security Source and such that access in the Business Intelligence Environment may be allowed based on at least one of the local identifiers from the generated mapping. In some implementations, candidate improvement(s) may be identified. Identifying candidate improvement(s) may include analyzing the generated mapping, security information and/or access information, and determining candidate improvement(s) based at least partially on the analysis. In some implementations, the generated mapping may be analyzed. The analysis of the generated mapping may identify difference(s) in access, roles, and/or privilege for a user, and identifying candidate improvement(s) may include identifying the difference(s).

In various implementations, an authentication request may be received, for a Security Migration System Namespace, for authorization for access to a Business Intelligence Environment of a user based on provided user identification information. A determination may be made whether to authorize the access by requesting validation of the user based at least partially on the provided user identification information, and a local identifier associated with the validated user may be determined at least partially based on a retrieved mapping, if a determination is made to authorize a user. The retrieved mapping may include local identifiers generated by a different Security Namespace. Access in the Business Intelligence Environment may enable at least partially on the determined local identifier.

Implementations may include one or more of the following features. The request for authentication may be delegated, based at least partially on the provided user identification information, from the Security Migration System Namespace to an External Security Source. In some implementations, a type of user may be determined at least partially based on the provided user identification information, and the provided user identification information may be authenticated independently of an External Security Source if the type includes a local user. Privileges of the user in the Business Intelligence environment may be determined based at least partially on the determined local identifier. In some implementations, one or more new security principals may be defined to have access to the business intelligence environment. Defining a new user may include determining whether the new user is a local user, and authentication of the new user independent of an external security source may be allowed if the new user is a local user. Defining a new user may include allowing authentication of the new user through the external security source if the new user is not a local user, and generating a new local identifier associated with the external security source if the new user is not a local user.

In various implementations, a request from a first user for access, as a second user, to a business intelligence environment may be received. The first user may provide first user identification information associated with the first user and second user identification information associated with the second user. The first user identification information may include a set of two or more types of user identification information and the second user identification information includes a subset of the types of user identification information in the provided first user identification information. A determination may be made whether to allow the first user to access the business intelligence environment as the second user based at least partially on an access listing. The access listing may include user identification information for one or more authorized users authorized to access the business intelligence environment as another user, and at least one of user identities, user identification information, roles, or groups of users on which one or more of the authorized users is authorized to request access. A local identifier of the second user may be determined if the determination is made to allow the first user access as the second user, and the first user may be allowed access to the business intelligence environment as the second user, if the determination is made to allow the access. The access in the business intelligence environment may be enabled based on the determined local identifier of the second user.

Implementations may include one or more of the following features. An audit trail of access by the first user as the second user when the requested access is allowed and/or attempted access when the requested access is denied may be generated and/or stored. In some implementations, the audit trail may be retrieved, presented, and alteration of at least a portion of the audit trail may be restricted. Determining a local identifier of a second user may be at least partially based on a mapping retrieved through a Security Migration System Namespace. The retrieved mapping may include local identifier(s) generated by a different Security Namespace. In some implementations, the first user identification information may be authenticated and the second user identification may be validated through a Security Migration System Namespace. The Security Migration System Namespace may authenticate based at least partially on a type of user. Authenticating the first user identification information based at least partially on the type of user may include: determining the type of user based at least partially on the provided first user identification information; authenticating the provided first user identification information independently of an External Security Source if the user type comprises a local user; and if the user type does not comprises a local user, delegating the authentication of the first user identification information to the external security source. In some implementations, validating the second user identification information based at least partially on the type of user includes: determining the type of user based at least partially on the provided second user identification information; validating the provided second user identification information independently of an External Security Source if the user type comprises a local user; and if the user type does not comprises a local user, delegating the validation of the second user identification information to the external security source.

The details of one or more implementations are set forth in the accompanying drawings and the description below. Other features, objects, and advantages of the implementations will be apparent from the description and drawings.

