Abstract: Methods, systems, and computer program products are provided for managing contact proxies and security proxies in networks that are organized as forests. For instance, contact proxies may be generated to represent user accounts and groups in forests other than the home forests of the user accounts and groups. Security proxy objects may be generated to represent group members (e.g., security principals and groups) in groups in forests other than the home forests of the group members. Furthermore, when both a contact object and a security proxy object exist for a member added to a group, one of the contact object or the security proxy object may be selected to represent the member in the group.

Abstract: Methods, systems, and computer program products are provided for managing contact proxies and security proxies in networks that are organized as forests. For instance, contact proxies may be generated to represent user accounts and groups in forests other than the home forests of the user accounts and groups. Security proxy objects may be generated to represent group members (e.g., security principals and groups) in groups in forests other than the home forests of the group members. Furthermore, when both a contact object and a security proxy object exist for a member added to a group, one of the contact object or the security proxy object may be selected to represent the member in the group.

Abstract: Identification of the root cause of a change in the system, as well as any side-effects (“ancillary changes”) caused by the change via an object attribute. A change resulting from a request in a system, whether originating from a user, service, or workflow, has an associated request object that captures the details of the change. An ancillary change resulting from the prior change is correlated to the prior change through a parent attribute on the request object that identifies the prior change as the immediate parent. Thus, all downstream ancillary changes resulting from a request can be correlated back to the root request (change) via the parent attributes of the ancillary changes.

Abstract: Methods, systems, and computer program products are provided for managing contact proxies and security proxies in networks that are organized as forests. For instance, contact proxies may be generated to represent user accounts and groups in forests other than the home forests of the user accounts and groups. Security proxy objects may be generated to represent group members (e.g., security principals and groups) in groups in forests other than the home forests of the group members. Furthermore, when both a contact object and a security proxy object exist for a member added to a group, one of the contact object or the security proxy object may be selected to represent the member in the group.

Abstract: The present invention extends to methods, systems, and computer program products for managing set membership. A set definition is translated into one or more membership conditions. Each membership condition includes statements about the attributes of a resource that are to be true if the resource is to be included in the set. For any given resource request, resources touched by the request are compared to membership conditions applicable to the touched resources. Thus, embodiments of the invention minimize the work that is done to determine which sets a resource may or may not belong to whenever a resource is modified. Accordingly, based on available resources, embodiments of the invention can scale to accommodate larger numbers of sets and larger numbers of potential members of sets.

Abstract: Disclosed herein is a system and method for enforcement of management policies by automatically trigging action-based processes that are mapped to the management policies. This may occur when: a new management policy is created; a final set of a management policy is modified; a new workflow is added to the management policy; and the membership filter or explicit membership of a set referenced by the management policy's final set is modified.

Abstract: Managing data for an object, including managing data in the object itself and alternative data applicable to an object dependent on one or more locales. Locales may refer to languages, geographic locations or other user preferences. A first object is stored. The first object includes a first identifier for the first object and a first plurality of properties. The first plurality of properties includes locale invariant values for the first plurality of properties. One or more localized objects are stored. The localized objects are unique from the first object. The localized objects each include a specification of a locale, a related identifier related to the first identifier, and one or more related properties related to one or more of the properties in the first plurality of properties. The related properties store localized values, including one or more alternatives to the locale invariant values particular to the specified locale.

Abstract: Managing resources. A resource manager includes programmatic code for managing resources in the computing environment. Resources available from resource systems within the computing environment are managed. Methods may include receiving user input indicating one or more of that a new entity should be added to the resource manager, that an entity represented by an entity object of the resource manager should have permissions removed at the resource manager, or that an entity represented by an entity object of the resource manager should have permissions added at the resource manager. In response to receiving user input, events may be generated and objects created or removed from the resource manager for from downstream resource systems. The events may specify workflows that should be executed to perform synchronization between objects at the resource manager and objects at a downstream resource system by adding or changing rules in an expected rules list.

Abstract: Managing resources. A computing environment may include a resource manager. The resource manager includes programmatic code for managing resources. Expected rule entries are added to an expected rules list. Each of the expected rule entries includes: an indicator used to identify a synchronization rule, a definition of flow type, a specification of an object type in the resource manager to which the synchronization rule applies, a specification of a downstream resource system, a specification of an object type in the downstream resource system to which the synchronization rule applies, a specification of relationship criteria including one or more conditions for linking objects in the resource manager and the downstream resource system, and a specification of attribute flow information. Objects in downstream resource systems can be synchronized with objects in the resource manager based on the expected rule entries in the expected rules list.