Request authorization
AssigneeKyndryl, Inc.
InventorsMansura Habiba, Shyamal Kumar Saha, Bashar Akil, Utz Bacher
Life of this patent
Estimating the term…
Abstract
A computer implemented method for generating a dispatch datagram is disclosed. The computer implemented method includes receiving, at a dispatcher, a request from a client. The method further includes generating an authorization header based on the received request. The authorization header includes one or more rules for handling the request. The method further includes wrapping the received request and the generated authorization header together to generate a dispatch datagram.
Claims20
A computer implemented method for generating a dispatch datagram, the computer implemented method comprising:
- receiving, at a dispatcher, a request from a client, the received request being associated with a first service of a distributed system;
- obtaining, at the dispatcher, a policy from a policy database based on a parameter of the received request;
- generating, at the dispatcher, an authorization header based on the received request and the policy, wherein the authorization header includes one or more rules for handling the request that specifies which services in the distributed system call one another and the one or more rules including communication access policies;
- wrapping, at the dispatcher, the received request and the generated authorization header together to generate the dispatch datagram;
- and
- passing, at the dispatcher, the dispatch datagram to the first service via a first validator that authorizes receipt of the received request by the first service by comparing the authorization header to a parameter of the first service to verify that the first service is authorized to receive the request as indicated by the authorization header.
A computer implemented method for authorizing a request from a client, the computer implemented method comprising:
- receiving, at a first validator, a dispatch datagram from a dispatcher, wherein the received dispatch datagram includes the request for a first service in a distributed system wrapped together with an authorization header that includes one or more rules for handling the request specifying which services in the distributed system call one another, and wherein the first validator is adapted to provide access to the first service, wherein the first validator exists on a layer outside of the first service to decouple authorization of the request from a workload of the request;
- separating the request and the authorization header from the dispatch datagram;
- and
- determining, by the first validator, whether the first service is authorized to receive the request based on a comparison of the authorization header to a parameter of the first service to verify that the first service is authorized by the dispatcher to receive the request as indicated by the authorization header.
A computer implemented method for authorizing a request from a client, the computer implemented method comprising:
- receiving, at a first validator, the dispatch datagram from a dispatcher, the first validator being adapted to provide access to a first service, and the dispatch datagram having been created by the dispatcher between the client and the first validator, wherein the received dispatch datagram includes the request for the first service in the distributed system wrapped together with an authorization header that includes one or more rules for handling the request specifying which services in the distributed system call one another and the first validator exists on a layer outside of the first service to decouple authorization of the request from a workload of the request;
- separating the request and the authorization header from the dispatch datagram;
- determining, by the first validator, whether the first service is authorized to receive the request based on comparing the authorization header to a parameter of the first service to verify that the first service is authorized by the dispatcher to receive the request as indicated by the authorization header;
- sending only the request to the first service when the first service is determined to be authorized to receive the request;
- and
- rejecting the request when the first service is not determined to be authorized to receive the request.
Dependencies are inferred from the claim text.