Method and apparatus for flexible configuration managment using external identity management service
AssigneeARRIS Enterprises LLC
InventorsTat Keung CHAN, Alexander MEDVINSKY
Life of this patent
Estimating the term…
Abstract
To address the requirements described above, this document discloses a system and method for performing an action on at least one resource node of a hierarchical organization of resource nodes is disclosed. The system utilizes an external Identity Provider that provide more flexible authentication and authorization services, and leverages such services with secure server such as an on-line data signing service to provide flexible permission management.
Claims20
A method of performing an action on at least one resource node of a hierarchical organization of resource nodes, comprising:
- receiving a login request in secure server;
- redirecting the login request to an identity provider, the identity provider defining a hierarchical organization of node resources, each node resource having one or more scopes and one or more attributes, each one or more scope associated with a scope permission, wherein each node resource is either a management node resource for maintaining the hierarchical organization of the node resources or a configuration node resource for performing the action;
- receiving a second login request in the secure server, the second login request comprising:
- client authorization credentials identifying a source of the second login request and permission information describing a permission to perform an action on a node resource, the client authorization credentials provided by the identity provider in response to the redirected login request;
- receiving a request to perform an action on the node resource;
- determining if the action is permitted according to the permission information of the client authorization credentials;
- and
- if the action is permitted, performing the action on the node resource.
A system for performing an action on at least one resource node of a hierarchical organization of resource nodes, comprising:
- a processor;
- a memory, communicatively coupled to the processor, the memory storing processor instructions including processor instructions for:
- receiving a login request in secure server;
- redirecting the login request to an identity provider, the identity provider defining a hierarchical organization of node resources, each node resource having one or more scopes and one or more attributes, each one or more scope associated with a scope permission, wherein each node resource is either a management node resource for maintaining the hierarchical organization of the node resources or a configuration node resource for performing the action;
- receiving a second login request in the secure server, the second login request comprising:
- client authorization credentials identifying a source of the second login request and permission information describing a permission to perform an action on a node resource, the client authorization credentials provided by the identity provider in response to the redirected login request;
- receiving a request to perform an action on the node resource;
- determining if the action is permitted according to the permission information of the client authorization credentials;
- and
- if the action is permitted, performing the action on the node resource.
A system for performing an action on at least one resource node of a hierarchical organization of resource nodes, comprising:
- means for receiving a login request in secure server;
- means for redirecting the login request to an identity provider, the identity provider defining a hierarchical organization of node resources, each node resource having one or more scopes and one or more attributes, each one or more scope associated with a scope permission, wherein each node resource is either a management node resource for maintaining the hierarchical organization of the node resources or a configuration node resource for performing the action;
- means for receiving a second login request in the secure server, the second login request comprising:
- client authorization credentials identifying a source of the second login request and permission information describing a permission to perform an action on a node resource, the client authorization credentials provided by the identity provider in response to the redirected login request;
- means for receiving a request to perform an action on the node resource;
- means for determining if the action is permitted according to the permission information of the client authorization credentials;
- and
- means for performing the action on the node resource if the action is permitted.
Dependencies are inferred from the claim text.