Microsoft Technology Licensing, LLC

Yi Zeng

Liqiang Zhu

Paul J Leach

Mark Fishel Novak

Yu Huang

K Michiko Short

Andrea D'Amato

Lokesh Srinivas Koppolu

Saurav Sinha

Gopinathan Kannan

Vikas Ahuja

Sai Sudhir Anantha Padmanaban

Joel T Hendrickson

Xiaoting Zhang

Rajalakshmi Dani

Neil Shipp

David Hetherington

Nick Voicu

Jiahui Wang

Anand Madhava Menon

Gavin Ackroyd

Zhaoan Liu

Guanghui He

Matthias Adam Leibmann

Xin Zhang

Yang Yang

Yang Yang Zhang

Marc Andrew Power

Grigory V Kaplin

Paranthaman Saravanan

Paul J Miller

Jeremy Dominic Viegas

Daxin Jiang

Alexandru Hanganu

Filip Sebesta

Yu (Kyle) Huang

Siming Tian

Lingxia Chen

Yu Lin Sie

Yang Zhang

A method enhances authentication requirements to documents of a document repository based, at least in part, on a security policy associated with a branch under which the documents are organized. The method implements an approval service that is identified in a branch policy. The approval service determines whether a user is authorized to modify documents included in the branch. The method further selectively requires multiple authentications from multiple authentication systems in order to access one or more particular branches in a document repository. Further, the multiple authentication systems are based on separate and independent sets of authentication credentials.

Selective security augmentation in source control environments

The present disclosure provides method and apparatus for query conversion. A first query for a first graph database may be obtained. A syntax tree may be generated through parsing the first query. A query graph may be created based on the syntax tree. The query graph may be converted into a second query for a second graph database.

Query conversion for different graph query languages

Disclosed in various examples are methods, systems, and machine-readable media for exposing a Representational State Transfer (RESTful) interface to users whereby management commands on a datacenter may be issued remotely from the users' workstations for secure, remote management of the datacenter. An application task automation command (e.g., a POWERSHELL® command) is executed remotely by creating a proxy command (e.g., based on a POWERSHELL® cmdlet code) to cause the application task automation command to be executed when the proxy command is remotely invoked and deploying the proxy command to a remote computer, such as the user's workstation. The remote computer issues a request including a user identifier and any parameters for the application task automation command when the corresponding proxy command has been invoked by the remote computer. The datacenter determines whether the user is authorized to execute the application task automation command invoked by the proxy command, and upon authorization of the user, the datacenter computer runs the application task automation command with any parameters provided in the request to control configuration of, or data stored on, at least one computer in the datacenter.

System and method to securely execute datacenter management operations remotely

Disclosed in various examples are methods, systems, and machine-readable media for exposing a Representational State Transfer (RESTful) interface to users whereby management commands on a datacenter may be issued remotely from the users' workstations for secure, remote management of the datacenter. An application task automation command (e.g., a POWERSHELL&#xae; command) is executed remotely by creating a proxy command (e.g., based on a POWERSHELL&#xae; cmdlet code) to cause the application task automation command to be executed when the proxy command is remotely invoked and deploying the proxy command to a remote computer, such as the user's workstation. The remote computer issues a request including a user identifier and any parameters for the application task automation command when the corresponding proxy command has been invoked by the remote computer. The datacenter determines whether the user is authorized to execute the application task automation command invoked by the proxy command, and upon authorization of the user, the datacenter computer runs the application task automation command with any parameters provided in the request to control configuration of, or data stored on, at least one computer in the datacenter.

Techniques of keyless authentication of computing services in distributed computing systems are disclosed herein. One example technique includes upon receiving a command to instantiate a computing service, transmitting a request to an authentication service for an identity assertion token corresponding to an application execution of which instantiates the computing service. The example technique can also include upon receiving the requested identity assertion token, storing the received identity assertion token in the container and modifying an entry of a configuration file in the container that allows the instantiated computing service to access the stored identity assertion token and authenticate to the authentication service using the identity assertion token.

Keyless authentication scheme of computing services

The description relates to password reset security. One example can receive a login request and a password for a cloud-based user account. The example can also retrieve stored authenticated user information associated with the password. The example can further send a notification of the login request to a contact address associated with the cloud-based user account. The notification can contain at least some of the stored authenticated user information.

Password security

Services from domainless machines are made available in a security domain under a virtual name. Each machine is not joined to the domain but can reach a security domain controller. The controller controls at least one security domain using an authentication protocol, such as a modified Kerberos protocol. One obtains a set of security domain credentials, generates a cluster name secret, gives the cluster a virtual name, and authenticates the machines to the domain controller using these items. In some cases, authentication uses a ticket-based protocol which accepts the cluster name secret in place of a proof of valid security domain membership. In some, the domain controller uses a directory service which is compatible with an active directory service; the cluster virtual name is provisioned as an account in the directory service. The cluster virtual name may concurrently serve clients on different security domains of the directory service.

Domain joined virtual names on domainless servers

When a user inputs an action request, such as a requested command, to be performed on a target machine, a management system receives the request and verifies it with a separate authentication and permission system. The verified command request is sent to the target machine. An authentication worker on the target machine accesses a set of policies, local to the target machine, to identify a least privileged execution environment in which the requested command can be performed. The authentication worker on the target machine launches the requested command within the identified least privileged execution environment on the target machine.

Security and permission architecture

A web application that is attempting to access a site hosted by a system that needs authentication based on a hardware-protected key is redirected to a local authority service on the machine. The local authority service interacts with a hardware key reader to obtain authentication information from a hardware key holder. The local authority service illustratively interacts with the system being accessed in order to obtain an operation result, based on the hardware-protected key obtained through the hardware key reader. The operation result is then posted to the web application, by the local authority service, for use in authenticating the user.

Local claim-based security service with cross-browser compatibility

A client can communicate with a middle tier, which can then, in turn, communicate with a back end tier to access information and resources on behalf of the client within the context of a system that can scale well. Each individual back end can establish a policy that defines which computing device can delegate to that back end. That policy can be enforced by a domain controller within the same administrative domain as the particular back end. When a middle tier requests to delegate to a back end, the domain controller to which that request was directed can either apply the policy, or, if the domain controller is in a different domain than the targeted back end, it can direct the middle tier to a domain controller in a different domain and can sign relevant information that the middle tier can utilize when communicating with that different domain controller.

Back-end constrained delegation model

Growing community of inventors

Bothell, WA, United States of America

Yi Zeng