Authorization policy objects sharable across applications, persistence model, and application-level decision-combining algorithm

An apparatus comprising:

• means for creating a global policy container that includes global policies that are shared by multiple applications;
• means for creating multiple application-specific policy containers that include application-specific policies for individual applications;
• means for determining, based on a global policy in the global policy container and a first application-specific policy in a first application-specific policy container, whether a first application is permitted to access a particular resource;
• and
• means for determining, based on the global policy in the global policy container and a second application-specific policy in a second application-specific policy container, whether a second application is permitted to access the particular resource.

A computer-implemented method comprising:

• storing first data that maps a first policy-combining algorithm to a first application in an environment;
• storing second data that maps a second policy-combining algorithm to a second application in the environment;
• when evaluating a first set of policies to determine access to resources in the first application, reconciling results of evaluation of policies in the first set using the first policy-combining algorithm;
• and
• when evaluating a second set of policies to determine access to resources in the second application, reconciling results of evaluation of policies in the second set using the second policy-combining algorithm;
• wherein the first policy-combining algorithm differs from the second policy-combining algorithm.

A computer-implemented method comprising:

• setting up a targetExpression array;
• setting up an anyOfOrder variable;
• initializing an anyOf count to an initial value;
• for each particular anyOf element in a Target element, performing first operations, and updating a policy based on the targetExpression array and the anyOfOrder variable;
• wherein the first operations comprise:
• incrementing the anyOf count;
• initializing an allOf count to the initial value;
• constructing a unique name for the particular anyOf element based on the anyOf count;
• adding the unique name to the anyOfOrder variable;
• and
• for each particular allOf element in the particular anyOf element, performing second operations;
• wherein the second operations comprise:
• incrementing the allOf count;
• fetching a composite match entry;
• splitting the composite match entry into principals, resource-actions, and environmental attributes;
• fetching a grantee identified by the principals;
• constructing a permission having a target equal to a resource from the composite match entry, an action equal to a resource-action from the composite match entry, and an environment constraint equal to an environmental attribute from the composite match entry;
• setting an assignee in the permission based on a grantee, a rule name, a policy domain name, and a unique anyOf name;
• and
• saving a globally unique identifier for the permission in an element of the targetExpression array indexed by values of the allOf and anyOf counts.