Distributed access management of information resources

A method of controlling access to one or more information resources stored on a protected server, the method comprising the steps of:

• receiving, at the protected server, login information describing a user who desires to access one of the resources;
• determining that the user is authentic and permitted to access one of the resources;
• identifying, at a second server coupled to the protected server, a subset of the resources that the user is authorized to access, based on at least one role that is stored in association with user information;
• communicating information defining the subset to the protected server;
• storing first information defining the subset, and second information defining the roles, in one or more tokens;
• communicating the one or more tokens to a client that is associated with the user;
• and
• thereafter resolving requests to use the resources at the protected server based on the one or more tokens by performing, for each request of said requests to use the resources at the protected server, one or more steps that include examining one or more copies of said one or more tokens, whereby a single secure sign-on gives the user access to the one of the resources.

An apparatus for controlling access to an information resource, comprising:

• a first server at which the information resource is stored and having an element that intercepts a request of a client to use the information resource;
• a second server, coupled to the first server, having an element that generates a customized access menu in response to the request, and an element that determines whether the client is authentic and may access the resource;
• and
• a third server, coupled to the second server, having a data store that defines at least one role of the user and that defines whether the user may use the resource based on the role.

A computer-readable medium carrying one or more sequences of instructions for controlling access to information resources, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of:

• receiving information describing a user at the first server;
• identifying, at a second server coupled to the first server, a subset of the resources that the user is authorized to access, based on one or more roles that are stored in association with user identifying information;
• communicating information defining the subset to the first server;
• storing first information defining the subset, and second information defining the roles, in one or more tokens;
• communicating the tokens to a client that is associated with the user;
• and
• thereafter resolving requests to use the resources at the first server based on the tokens.

A computer-readable carrying one or more sequences of instructions for controlling access to one or more information resources stored on a protected server, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of:

• receiving, at the protected server, login information describing a user who desires to access one of the resources;
• determining that the user is authentic and permitted to access one of the resources;
• identifying, at a second server coupled to the protected server, a subset of the resources that the user is authorized to access, based on at least one role that is stored in association with user information;
• communicating information defining the subset to the protected server;
• storing first information defining the subset and second information defining the roles, in one or more tokens;
• communicating the one or more tokens to a client that is associated with the user;
• and
• thereafter resolving requests to use the resources at the protected server based on the one or more tokens by performing, for each request of said requests to use the information resources, one or more steps that include examining one or more copies of said one or more tokens, whereby a single secure sign-on gives the user access to the one of the resources.