Claims-aware role-based access control
AssigneeMicrosoft Corporation
InventorsRakesh P. Bilaney, Samuel R. Devasahayam
Life of this patent
Estimating the term…
Abstract
The formulation of a security token that specifies role information corresponding to one or more roles of a requesting entity that is to request an action to be performed on a resource. The formulation begins by accessing one or more claims, each having an expression regarding the requesting entity. The expression for at least one of the claims is evaluated to thereby assign the requesting entity to one or more identities. The identities are then used determine role information to include in a role-based security token that may be submitted to the computing system that manages the resources.
Claims20
A computer program product comprising one or more computer-readable storage media having thereon computer-executable instructions that, when executed by one or more processors of the computing system, cause the computing system to perform the following:
- an act of accessing one or more claims having an expression regarding a requesting entity;
- an act of evaluating the expression of at least one of each of the one or more claims;
- an act of assigning the requesting entity to one or more identities using the evaluation of the expression of the claim;
- an act of identifying an access policy corresponding to at least one of the one or more identities, the access policy specifying an action and a permission status corresponding to one or more resources belonging to a relying party;
- for each of at least one of the one or more corresponding resources, an act of identifying role information corresponding to one or more roles that, if held by the requesting entity, would cause a provider of the corresponding resource to enforce the permission status for the action should the requesting entity request to perform the action on the corresponding resource;
- and
- an act of constructing a security token that indicates the role information for each of the at least one of the corresponding one or more resources.
A method for a computing system to issue a security token, the method comprising:
- an act of accessing one or more claims having an expression regarding a requesting entity;
- an act of evaluating the expression of at least one of each of the one or more claims;
- an act of assigning the requesting entity to one or more identities using the evaluation of the expression of the claim;
- and
- an act of acquiring a role-based security token applicable to the requesting entity using the assigned one or more identities.
A computer program product comprising one or more computer-readable storage media having thereon computer-executable instructions that, when executed by one or more processors of the computing system, cause the computing system to perform the following:
- an act of accessing one or more claims having an expression regarding a requesting entity;
- an act of evaluating the expression of at least one of each of the one or more claims;
- an act of assigning the requesting entity to one or more identities using the evaluation of the expression of the claim;
- an act of identifying an access policy corresponding to at least one of the one or more identities, the access policy specifying an action that is to be allowed corresponding to one or more resources belonging to a replying party;
- for each of at least one of the one or more corresponding resources, an act of identifying role information corresponding to the one or more roles that, if held by the requesting entity, would cause a provider of the corresponding resource to allow the action should the requesting entity request to perform the action on the corresponding resource;
- an act of constructing a security token that indicates the role information for each of the at least one of the corresponding one or more resources;
- and
- an act of providing the security token to the requesting entity.
Dependencies are inferred from the claim text.