Policies for modifying group membership

• US 20020156879A1
• Filed: 11/30/2001
• Published: 10/24/2002
• Est. Priority Date: 12/22/2000
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Ahmed, Sajeed, Delany, Shawn P., Ganitsky, Vivian M.
• Granted Patent: US 7,475,151 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 67/5682 Policies or rules for updating, deleting or replacing the stored data
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A policy, associated with a group, controls user subscription to and unsubscription from that group. In one embodiment, there are at least four policies for subscribing/unsubscribing: open, open with filter, control through workflow and closed. An open policy does not restrict subscription or unsubscription. The open with filter policy requires that a user satisfy a rule to subscribe, but does not require that the rule be satisfied to unsubscribe. The control through workflow policy requires a user to subscribe or unsubscribe through a workflow process. A close policy prohibits the subscription to or unsubscription from the group.

Claims

1. A method for modifying group membership, comprising the steps of:

receiving a request to add a first entity to a first group;

accessing an indication of a first policy from a set of policies for changing static membership of said first group; and

adding said first entity to said first group as a static member based on said first policy.

2. A method according to claim 1, wherein:

said request is for said first entity.

3. A method according to claim 1, wherein:

said indication is stored in an attribute of an identity profile for said first group.

4. A method according to claim 1, wherein:

said set of policies includes an open policy, an open with filter policy, a controlled through workflow policy, and a closed policy.

5. A method according to claim 4, wherein:

said identity profile for said first group includes a filter attribute, said filter attribute stores a filter that is used with said open with filter policy to determine whether said first entity may be added to said first group.

6. A method according to claim 4, wherein:

said request is from said first entity.

7. A method according to claim 4, wherein:

said controlled through workflow policy requires that workflows be used to add entities to said first group and remove entities from said first group.

8. A method according to claim 4, wherein:

if said first policy is said controlled through workflow policy, then said first entity will be not be added to said first group if said first entity is not a participant in a first step of a workflow associated with said controlled through workflow policy.

9. A method according to claim 4, wherein:

said closed policy prevents entities from subscribing to and unsubscribing from said first group.

10. A method according to claim 4, further comprising the steps of:

receiving a request from said first entity to unsubscribe from said first group;

accessing said indication of said first policy; and

unsubscribing said first entity from said first, based on said first policy.

11. A method according to claim 1, wherein:

said indication is stored in an attribute of an identity profile for said first group;

said identity profile for said first group includes an attribute that stores an indication of whether to send a message upon adding said first entity to said first group; and

said identity profile for said first group includes an attribute that stores said message.

12. A method according to claim 1, wherein:

said first group is a member of a second group;

said first policy may not be less restrictive than a policy for changing static membership of said second group; and

said step of adding said first entity to said first group provides said first entity with membership privileges in said second group.

13. A method according to claim 1, wherein:

said steps of receiving, accessing and adding are performed by an integrated identity and access system.

14. A method according to claim 13, wherein:

said integrated identity and access system is capable of authorizing said first entity to access a resource based on membership in said first group.

15. A method according to claim 1, wherein:

said request is for said first entity; and

said indication is stored in an attribute of an identity profile for said first group.

16. A method according to claim 1, wherein:

said request is from said first entity;

said indication is stored in an attribute of an identity profile for said first group; and

said set of policies includes an open policy, an open with filter policy, a controlled through workflow policy, and a closed policy.

17. A method according to claim 1, wherein:

said step of adding includes determining whether to add said first entity to said first group based on said first policy.

19. A method according to claim 18, wherein:

said request is from said first entity.

20. A method according to claim 18, wherein:

said indication is stored in an attribute of an identity profile for said first group.

21. A method according to claim 18, wherein:

said set of policies includes an open policy, an open with filter policy, a controlled through workflow policy, and a closed policy.

22. A method according to claim 18, wherein:

said request is from said first entity;

said indication is stored in an attribute of an identity profile for said first group; and

said set of policies includes an open policy, an open with filter policy, a controlled through workflow policy, and a closed policy.

23. A method according to claim 18, wherein:

said first group is a member of a second group;

said first policy may not be less restrictive than a policy for changing static membership of said second group; and

said step of removing said first entity has an effect of removing said first entity from said second group.

25. One or more processor readable storage devices according to claim 24, wherein:

said request is from said first entity.

26. One or more processor readable storage devices according to claim 24, wherein:

said indication is stored in an attribute of an identity profile for said first group.

27. One or more processor readable storage devices according to claim 24, wherein:

said set of policies includes an open policy, an open with filter policy, a controlled through workflow policy, and a closed policy.

28. One or more processor readable storage devices according to claim 24, wherein:

said request is from said first entity;

said indication is stored in an attribute of an identity profile for said first group; and

said set of policies includes an open policy, an open with filter policy, a controlled through workflow policy, and a closed policy.

29. One or more processor readable storage devices according to claim 24, wherein:

said first group is a member of a second group;

said first policy may not be less restrictive than a policy for changing static membership of said second group; and

said step of adding said first entity to said first group provides said first entity with membership privileges in said second group.

30. One or more processor readable storage devices according to claim 24, wherein:

said steps of receiving, accessing and adding are performed by an integrated identity and access system.

18. A method for modifying group membership, comprising the steps of:

receiving a request to remove a first static member from a first group;

accessing an indication of a first policy from a set of policies for changing static membership of said first group; and

removing said first static member from said first group based on said first policy.

24. One or more processor readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors to perform a method comprising the steps of:

receiving a request to add a first entity to a first group;

accessing an indication of a first policy from a set of policies for changing static membership of said first group; and

adding said first entity to said first group as a static member based on said first policy.

31. One or more processor readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors to perform a method comprising the steps of:

receiving a request to remove a first static member from a first group;

accessing an indication of a first policy from a set of policies for changing static membership of said first group; and

removing said first static member from said first group based on said first policy.

32. One or more processor readable storage devices according to claim 31, wherein:

said request is from said first entity.

33. One or more processor readable storage devices according to claim 31, wherein:

said indication is stored in an attribute of an identity profile for said first group.

34. One or more processor readable storage devices according to claim 31, wherein:

said set of policies includes an open policy, an open with filter policy, a controlled through workflow policy, and a closed policy.

35. One or more processor readable storage devices according to claim 31, wherein:

said request is for said first entity;

said indication is stored in an attribute of an identity profile for said first group; and

said set of policies includes an open policy, an open with filter policy, a controlled through workflow policy, and a closed policy.

36. One or more processor readable storage devices according to claim 31, wherein:

said first group is a member of a second group;

said first policy may not be less restrictive than a policy for changing static membership of said second group; and

said step of removing said first entity has an effect of removing said first entity from said second group.

38. An apparatus according to claim 37, wherein:

said request is from said first entity;

said indication is stored in an attribute of an identity profile for said first group; and

said set of policies includes an open policy, an open with filter policy, a controlled through workflow policy, and a closed policy.

39. An apparatus according to claim 37, wherein:

said first group is a member of a second group;

said first policy may not be less restrictive than a policy for changing static membership of said second group; and

said step of adding said first entity to said first group provides said first entity with membership privileges in said second group.

37. An apparatus that can modify group membership, comprising:

a communication interface; and

one or more processors in communication with said communication interface, said one or more processors perform a method comprising the steps of;

receiving a request to add a first entity to a first group,

accessing an indication of a first policy from a set of policies for changing static membership of said first group, and

adding said first entity to said first group as a static member based on said first policy.

40. An apparatus that can modify group membership, comprising:

a communication interface; and

one or more processors in communication with said communication interface, said one or more processors perform a method comprising the steps of;

receiving a request to remove a first static member from a first group,

accessing an indication of a first policy from a set of policies for changing static membership of said first group, and

removing said first static member from said first group based on said first policy.

41. An apparatus according to claim 40, wherein:

said request is from said first entity;

said indication is stored in an attribute of an identity profile for said first group; and

said set of policies includes an open policy, an open with filter policy, a controlled through workflow policy, and a closed policy.

42. An apparatus according to claim 40, wherein:

said first group is a member of a second group;

said first policy may not be less restrictive than a policy for changing static membership of said second group; and

said step of removing said first entity has an effect of removing said first entity from said second group.