Role policy management
AssigneeNovell, Inc.
InventorsStephen R. Carter, Duane Fredrick Buss
Life of this patent
Estimating the term…
Abstract
In various embodiments, techniques for role management systems are provided. According to an embodiment, a method is provided to allow a role management system to be configured, modified, and restricted. Specific roles assignments may be decorated to be meaningful to an application but which are not generally applicable to an original role specification. A Policy Enforcement Point (PEP) role request response may be modified by an augmentation service, which evaluates a resource association to identify an appropriate resource profile. Resource decorations are identified by the selected profile, and are applied to the role request response.
Claims27
A method, comprising:
- receiving a role request and role assignment, wherein the role request identifies a requesting Policy Enforcement Point (PEP) service and a principal, and wherein the PEP service is acting on behalf of the principal and the role assignment represents permissible roles of that principal;
- evaluating a resource association in response to the role request and role assignment in order to identify a resource profile;
- applying one or more resource decorations in response to the identified resource profile to modify the role assignment when dictated by policy;
- and
- sending a modified role assignment to the PEP service.
A method, comprising:
- receiving a role request from a first resource on behalf of a second resource;
- acquiring a response that associates one or more roles with the second resource;
- forwarding the role request and the response to an augmentation service;
- receiving a modified response from the augmentation service, wherein the modified response is customized for the second resource by applying resource decorations to the original response;
- and
- sending the modified response to the first resource, wherein the first resource enforces the access restriction defined in the modified response against the second resource.
A method, comprising:
- receiving a role request from an application on behalf of a principal;
- forwarding the role request to a role calculation engine (RCE), wherein the RCE generates a response by assigning one or more roles to the principal or the application and forwards the response to an augmentation service for customization;
- receiving a modified response from the augmentation service, wherein the augmentation service customizes the RCE response for the application and the principal by applying resource decorations;
- and
- enforcing the access rights defined in the modified response against the application and the principal.
A role management system, comprising:
- a Role/Policy Disposition service, the Role/Policy Disposition service adapted to receive role requests from one or more principals, to forward the role requests to a role calculation engine (RCE), to receive a response from an augmentation service, and to enforce access rights, role assignments, and role policy included in the response against processing actions of the one or more principals;
- and
- an augmentation service, the augmentation service adapted to have access to resource decorations, resource associations, and resource profiles, and wherein the augmentation service is further adapted to receive a role request and role assignments, to customize a response for the Role/Policy Disposition service, an application, and/or the one or more principals, and to cause to be forwarded the customized response to the Role/Policy Disposition service.
Dependencies are inferred from the claim text.