US 2006/0080440 A1 · Authentication and authorization pipeline architecture for use in a server

Abstract

A method, system, and article of manufacture for providing an authentication and authorization pipeline for use in a web server to grant access to web resources to users. The server creates an entry within an userID to roles database for each user who may access resources present on the web server and creates an entry within the roles to resource database for each resource that may be accessed on the web server. The server then authenticates the identify of each user accessing a resource on the web server using a userID, one or more authentication parameters, and a resource access request, creates a data object having an authenticated userID and one or more roles corresponding to the authenticated userID obtained from the userID to roles database, and authorizes access to a resource identified within the resource access request if one or more roles within the data object correspond to an access role corresponding to the roles listed within the roles to resource database for the identified resource.

Claims20

Dependent claims

One or more computer-readable media having one or more data objects stored thereon, the data objects comprising:

an identity programmatic interface that provides programmatic access to user identity information identifying a user represented by the one or more data objects and includes a name field associated with a userID of the user represented by the one or more data objects;
and
a user programmatic interface that provides programmatic access to user identity and role information and includes:
an identity field that references the identity programmatic interface;
and
a programmatic function that includes:
a role name parameter that accepts a name of a role;
member determination executable instructions that determine if the user represented by the one or more data objects is a member of a role identified by the role name parameter;
and
executable instructions for returning a result of the member determination executable instructions.

7 more elements

A method for providing an authentication and authorization pipeline in a server providing access to userID-roles data and resource-roles data, the userID-roles data including one or more data entries for at least one user who has access to at least one resource accessible from the server and the resource-roles data including one or more data entries for at least one resource accessible from the server, the pipeline being configured to use the userID-roles data and the resource-roles data to grant user access to resources accessible from the server, the method comprising:

receiving a plurality of resource access requests for a server resource;
using a userID and one or more authentication parameters to authenticate an identity of a user attempting to access the server resource;
for each resource access request, creating a distinct data object having an authenticated userID and one or more access roles corresponding to the authenticated userID obtained from the userID-roles data;
and
authorizing access to a resource identified within a resource access request if one or more access roles associated with the data object correspond to a resource role listed within the resource-roles data for the identified resource;
and wherein, in pipeline fashion, the data object is passed from an operation authenticating the identity of the user and the data object is received by an operation authorizing access to the resource.

3 more elements

Dependencies are inferred from the claim text.

Authentication and authorization pipeline architecture for use in a server

Life of this patent

Authentication and authorization pipeline architecture for use in a server

Life of this patent

Abstract

Claims20