System and method for enforcing role membership removal requirements
AssigneeOracle International Corporation
InventorDuane Fredrick Buss
Life of this patent
Estimating the term…
Abstract
System and method for enforcing role membership removal requirements are described. In one embodiment, the method includes, responsive to receipt of a removal request, performing a role evaluation of the removal request to generate a policy request; performing a policy evaluation of the policy request; generating a policy response in accordance with the policy evaluation; and enforcing the policy response.
Claims7
A computer-implemented method for enforcing role membership removal requirements in a role-based system, the method comprising:
- responsive to receipt of a removal request, performing a role evaluation of the removal request to generate a policy request, wherein the performing a role evaluation is executed by a computer-implemented role manager, and the policy request is associated with the removal request;
- performing a policy evaluation of the policy request;
- generating a policy response in accordance with the policy evaluation;
- and
- enforcing the policy response, wherein the policy response is responsive to the removal request and includes doing nothing or doing at least one action;
- wherein the performing a role evaluation, performing a policy evaluation, generating, and enforcing are all performed by a computer and further comprises checking for applicable conditions based on a role relationship, wherein the relationship is defined by at least one of a nested group and an aggregation.
A system for enforcing role membership removal requirements in a role-based system, the system comprising:
- means for managing role information,
- means for associating at least one policy with the role information,
- means for receiving a removal request related to the role information, the policy is associated with the removal request;
- means for enforcing at least one policy in response to the removal request, including doing nothing or doing at least one action;
- means for evaluating a removal request by checking for applicable conditions based on a role relationship, wherein the relationship is defined by at least one of a nested group and an aggregation;
- means for generating a policy request;
- and
- means for evaluating at least one policy in response to the policy request.
Dependencies are inferred from the claim text.