Extensible and/or distributed authorization system and/or methods of providing the same

An authorization system for granting access to a resource of a computing application, the system comprising:

• a storage medium that is configured to store a three part permission structure that is associated with the resource, the three part permission structure including:
• a first part that includes a domain or type of the resource,
• a second part that defines at least one action that is done on the resource, and
• a third part that includes a regular expression that, upon evaluation, produces output including an indication of the resource;
• and
• a processing system that includes at least one processor, the processing system being configured to evaluate an authorization request to the resource based on the three part permission structure.

A computer implemented method of evaluating an authorization request in an authorization application on a processing system including at least one processor and a memory, where the authorization request is made from a first computing application, the method comprising:

• receiving the authorization request from the first computing application;
• creating a security context based on the authorization request, the security context including information on:
• a requesting client;
• a resource associated with the request, and at least one permission associated with the resource;
• retrieving at least one rule that is associated with a callback function that calls an authentication process that is defined in a second computing application;
• building an abstract syntax tree based on the security context and the at least one rule;
• evaluating the abstract syntax tree;
• performing a callback to the authentication process defined in the second computing application during the evaluation of the abstract syntax tree;
• returning a result of the authorization request based on the evaluation of the abstract syntax tree to the first computing application.

A computer-implemented method of providing distributed authorization, the method comprising the following steps performed by a first application:

• accepting a connection from a client to the first application;
• authenticating the client to the first application;
• accepting a request from the client to access at least one resource of the first application;
• and
• in response to the request, communicating with a second application to determine whether the authenticated client is authorized to access the at least one resource;
• wherein the communication with the second application comprises a security context for the client, wherein the security context comprises information on the client, the at least one resource associated with the request, and at least one permission associated with the at least one resource.