Integrating heterogeneous authentication and authorization mechanisms into an application access control system

A method of providing a security mechanism for one or more computer systems, the method comprising the steps:

• a first server receiving a message specifying a request to register a user that is unregistered on the first server;
• wherein the first server is configured to receive requests to authenticate users and supply information that indicates access rights of users;
• the first server causing a transmission to a second server requesting data that indicates access rights specified by the second server for the user;
• wherein the second server is configured to receive requests to authenticate users and supply information that indicates access rights of users;
• the first server receiving data, transmitted by the second server in response to receiving the transmission, that indicates access rights specified by the second server for the user including at least one authorization;
• storing data that indicates the at least one authorization;
• persistently storing data in one or more access information records that indicates:
• the user is registered on the first server, and
• whether access rights for the user should be obtained from the second server;
• the first server subsequently receiving a request to login the user;
• and
• in response to receiving the request to login the user, establishing access rights based on the one or more access information records.

A method of providing a security mechanism for one or more computer systems, the method comprising the steps:

• a first server receiving a message specifying a request to determine access rights of a user registered on the first server;
• wherein the first server is configured to receive requests to authenticate users and supply information that indicates access rights of the users;
• the first server causing a transmission to a second server that requests data that indicates the access rights specified by the second server for the user;
• wherein the second server is configured to receive requests to authenticate users and supply information that indicates access rights of users;
• the first server receiving data, transmitted by the second server in response to receiving the transmission, that indicates a first set of authorizations specified by the second server for the user;
• the first server translating data that indicates the first set of access rights specified by the second server to one or more records that indicates a second set of access rights recognized by the first server;
• and
• establishing a third set of access rights based on the one or more records.

A method of providing a security mechanism for one or more computer systems, the method comprising the steps:

• causing start up of a plurality of proxy servers that provide to a first server data that indicates access rights specified for users by a respective server from a second set of servers that are each configured to receive requests to authenticate users and supply information that indicates access rights of users;
• the first server transmitting, to each proxy server of the plurality of proxy servers, a request for data indicating the access rights specified by the respective server from the second set of servers for a particular user by invoking a function of an application programmer interface that includes a common set of functions that:
• is associated with the plurality of proxy servers, and provides an interface between the first server and the second set of servers;
• and
• in response to each proxy server of the plurality of proxy servers receiving the request for data indicating access rights of the particular user:
• the each proxy server obtaining information about access rights of the particular user from a server of the set of servers, and
• the each proxy server supplying information about access rights of the particular user to the first server.

An access security system, comprising

• a first server configured to receive requests to authenticate users and supply information that indicates access rights of users;
• a set of one or more servers that are each configured to receive requests to authenticate users and supply information that indicates access rights for users;
• a plurality of proxy servers configured to provide to the first server data that indicates the access rights specified for users by a respective server from the set of one or more servers;
• the plurality of proxy servers each configured as instantiations of a subclass belonging to a base class that defines an application program interface through which the plurality of proxy servers and the first server interact to provide the first server with information that indicates access rights for users;
• a topology mechanism configured to transmit to the first server information specifying which proxy server of the plurality of proxy servers are running;
• and
• an access server configured to collect authentication input from a user attempting to log into the access security system and to transmit data representing the collected authentication input to the first server.

A computer-readable medium carrying one or more sequences of instructions which, when executed by one or more processors, cause the one or more processors to selectively authenticate and authorize a client seeking access to one or more protected computer systems over a network, by:

• receiving a request of a client to access one of the computer systems;
• requesting a proxy security server to authenticate the client using information identifying the client;
• receiving an authorization of the client from the proxy security server based on authentication results received from a remote security server that is coupled to the proxy security server;
• establishing access rights of the client based on one or more access information records received from the remote security server through the proxy security server.

An apparatus for selectively authenticating and authorizing a client seeking access to one or more protected computer systems over a network, comprising:

• a processor;
• and
• a memory having one or more sequences of instructions stored therein which, when executed by the processor, cause the processor to carry out the computer-implemented steps of:
• receiving a request of a client to access one of the computer systems;
• requesting a proxy security server to authenticate the client using information identifying the client;
• receiving an authorization of the client from the proxy security server based on authentication results received from a remote security server that is coupled to the proxy security server;
• establishing access rights of the client based on one or more access information records received from the remote security server through the proxy security server.