Abstract: An authentication management system receives a resource request directed to a software service, which may require password-based authentication. The system redirects the resource request to an authentication identity provider (IdP), and receives an authentication token generated by the authentication IdP. The redirecting of the resource request comprises transmission of an authentication request, which includes user identity information that can be authenticated by the IdP but does not include a password for the software service. In response to receiving the authentication token, the system causes a shadow account to be created with the software service. For password-based authentication, this may include setting a temporary, random password for the shadow account. The system is then able to generate authenticated connection information (e.g.

Abstract: An authentication management system receives a resource request directed to a software service, which may require password-based authentication. The system redirects the resource request to an authentication identity provider (IdP), and receives an authentication token generated by the authentication IdP. The redirecting of the resource request comprises transmission of an authentication request, which includes user identity information that can be authenticated by the IdP but does not include a password for the software service. In response to receiving the authentication token, the system causes a shadow account to be created with the software service. For password-based authentication, this may include setting a temporary, random password for the shadow account. The system is then able to generate authenticated connection information (e.g.

Abstract: A management user interface can be generated at run time via subtractive extensible context-based filtering. Definitions of user interface elements can include an indication of appropriate contexts for which the user interface elements are to be shown. Context factors can include application state, external state, surface or element definitions, or some combination thereof. The context-based filtering approach allows definition of user interface elements and user interface surfaces so that appearance of additional elements in the appropriate surfaces can be accomplished without programming. For example, a user interface surface definition can specify categories of user interface elements. At run time, those user interface elements of the category can be chosen for display. When new elements relating to the category are added, the new elements appear when the surface is rendered. Other features include heterogeneous type selection and exact number homogeneous type selection.

Abstract: Systems and methods for extending a directory schema independent of schema modification are described. In one aspect, a directory schema data structure includes a flexible attribute data field. The flexible attribute data field identifies a complex data type. The complex data type is used to express one or more operational or data providing properties of a flexible attribute. The one or more operational or data providing properties are independent of the complex data type and independent of directory schema modification. The directory schema data structure also includes a flexible structural object content class to encapsulate the flexible attribute.

Abstract: A mechanism is provided for signing on a user of a first domain into an affiliate application in a second domain. When the user needs access to the affiliate application, the request for access causes a ticket to be generated. The ticket identifies the user and is passed to an adapter. The adapter, which ultimately will perform the sign on in the affiliate application, redeems the ticket for the user's credentials (e.g., a valid userID/password combination for the affiliate application), and then presents the credentials to the affiliate application. A service is provided that issues tickets, redeems tickets, manages the registration and de-registration of affiliate applications, manages the correlation between a user and the user's credentials with an affiliate application, and manages encryption of stored records.

Abstract: Systems and methods for extending a directory schema independent of schema modification are described. In one aspect, a directory schema data structure includes a flexible attribute data field. The flexible attribute data field identifies a complex data type. The complex data type is used to express one or more operational or data providing properties of a flexible attribute. The one or more operational or data providing properties are independent of the complex data type and independent of directory schema modification. The directory schema data structure also includes a flexible structural object content class to encapsulate the flexible attribute.

Abstract: The systems, methods, and data structure described herein relates to the consolidated management of administrative tasks in an asynchronous, multi-application environment. An information technology (IT) system management application is configured to manage administrative tasks for multiple work centers. Processes associated with the administrative tasks are initiated on the work centers by an IT system management application in an asynchronous manner such that the asynchronous processes can be executed without being actively controlled by the IT system management application. The IT system management application instructs the work centers to provide status information of the asynchronous processes in a specified format. The IT system management application provides a graphical user interface that includes a status pane to publish the status information for monitoring the ongoing administrative tasks.

Abstract: The described arrangements and procedures provide a directory schema with object classes that have flexible attributes. This means that attributes can be extended independent of modifications to the directory schema. Specifically, an object instance of a content class described in the directory schema is instantiated. The content class includes a flexible attribute having a data type. A property is assigned to the attribute. The property is any combination of an operational and data providing property. The property is independent of the attribute's data type. Thus, without modifying the directory schema, multiple instances of the same object class can have attributes that provide completely different data types and completely different data operations.

Abstract: Systems and methods for extending a directory schema independent of schema modification are described. In one aspect, a directory schema data structure includes a flexible attribute data field. The flexible attribute data field identifies a complex data type. The complex data type is used to express one or more operational or data providing properties of a flexible attribute. The one or more operational or data providing properties are independent of the complex data type and independent of directory schema modification. The directory schema data structure also includes a flexible structural object content class to encapsulate the flexible attribute.

Abstract: Systems and methods for extending a directory schema independent of schema modification are described. In one aspect, a directory schema data structure includes a flexible attribute data field. The flexible attribute data field identifies a complex data type. The complex data type is used to express one or more operational or data providing properties of a flexible attribute. The one or more operational or data providing properties are independent of the complex data type and independent of directory schema modification. The directory schema data structure also includes a flexible structural object content class to encapsulate the flexible attribute.

Abstract: A mechanism is provided for signing on a user of a first domain into an affiliate application in a second domain. When the user needs access to the affiliate application, the request for access causes a ticket to be generated. The ticket identifies the user and is passed to an adapter. The adapter, which ultimately will perform the sign on in the affiliate application, redeems the ticket for the user's credentials (e.g., a valid userID/password combination for the affiliate application), and then presents the credentials to the affiliate application. A service is provided that issues tickets, redeems tickets, manages the registration and de-registration of affiliate applications, manages the correlation between a user and the user's credentials with an affiliate application, and manages encryption of stored records.

Abstract: The described arrangements and procedures provide a directory schema with object classes that have flexible attributes. This means that attributes can be extended independent of modifications to the directory schema. Specifically, an object instance of a content class described in the directory schema is instantiated. The content class includes a flexible attribute having a data type. A property is assigned to the attribute. The property is any combination of an operational and data providing property. The property is independent of the attribute's data type. Thus, without modifying the directory schema, multiple instances of the same object class can have attributes that provide completely different data types and completely different data operations.

Abstract: A method for developing system resource usage "cost" equations, creating models based upon such cost equations, and estimating total system resource usage and computer program product incorporating such cost equations. A server application is analyzed and certain transactions are defined therein that occur in response to interaction with a client application that in many instances originates from user behavior. System resources are also identified and resource usage measurements are determined for each transaction. One way of determining the resource usage measurements is by creating a load of a particular transaction on an "instrumented" server application and measuring the resources used in connection with the transaction. Cost equations for each type of system resource can then be constructed taking a component from each transaction that uses a particular system resource so that the cost equations are defined in terms of transactions.