Distributed capability-based authorization architecture using roles

A computer readable storage device storing instructions that, when executed by a computer, cause the computer to perform a method of managing authorizations in a Java programming environment, the method comprising:

• defining a set of first roles for grouping subjects having similar needs to access objects in the Java programming environment, wherein the objects comprise computing resources, wherein each subject holds a custom combination of second roles created by a user, wherein membership in the second roles is not inherited from each other;
• and wherein the second roles are associated with one or more privileges;
• for each of said first roles, granting one or more privileges to access one or more of the objects by granting each of said roles an object permission for the one or more objects;
• assigning each subject authorized to access the Java programming environment to one or more of said first roles, thereby enabling implementation of role-based access control;
• assigning a subset of said set of first roles and a subset of said subjects to a realm, wherein the realm specifies a separate namespace;
• and
• when a first subject is authenticated in the Java programming environment, constructing a first access control context comprising:
• identities of a first subset of said first roles to which the first subject is assigned;
• and
• identities of a second subset of said first roles indirectly assigned to the first subject by virtue of the first subject's assignment to a role in said first subset of said roles.

A role-based authorization architecture implemented on a computer system, comprising:

• a set of computing resources within an object-oriented computing environment;
• a set of first roles for grouping users having similar access needs to the resources, thereby enabling implementation of role-based access control, wherein each subject holds a custom combination of second roles created by a user, wherein membership of the second roles is not inherited from each other;
• and wherein the second roles are associated with one or more privileges;
• a set of object permissions for the resources for granting privileges to the set of first roles;
• a realm, wherein the realm specifies a separate namespace;
• and
• for each of said first roles:
• one or more users explicitly assigned to said first role;
• and
• a set of permissions assigned to said first role, wherein the set of permissions include permissions indirectly assigned to the set of permissions, and wherein each of the permissions allows users assigned to said first role to access a subset of the resources.