Provisioning aggregated services in a distributed computing environment

• US 20030135628A1
• Filed: 01/15/2002
• Published: 07/17/2003
• Est. Priority Date: 01/15/2002
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Fletcher, James C., Lindquist, David B., Wanderski, Michael C., Wesley, Ajamu A.
• Granted Patent: US 7,603,469 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Methods, systems, and computer program products are disclosed for provisioning software resources used with aggregated web services. The disclosed techniques enable heterogeneous identity systems to be joined in the dynamic, run-time web services integration environment. Authentication and authorization may now be performed for the aggregated service, as well as for its sub-services. SOAP (“Simple Object Access Protocol”) messages, as an example, may be used to relay identity information among distributed services, whereby credentials may be specified in the SOAP message header to accompany a service request specified in the SOAP message body.

Claims

1. A method of provisioning one or more software resources of an aggregated service in a computing network, comprising steps of:

defining a provisioning interface of the aggregated service;

specifying the provisioning interface in a service description document;

obtaining credentials of a user of the aggregated service, according to the service description document;

analyzing the obtained credentials; and

allowing the user to perform the aggregated service if indicated by the analyzing step.

2. The method according to claim 1, further comprises the step of:

registering the service description document in a registry.

3. The method according to claim 2, further comprising the steps of:

defining a provisioning interface of at least one of the one or more software resources of the aggregated service; and

for each of the at least one software resource, specifying the provisioning interface of a service performed by the software resource in the service description document or in one or more other service description documents.

4. The method according to claim 3, wherein the step of obtaining credentials of the user of the aggregated service also obtains credentials for the at least one software resource, according to the service description document or the one or more other service description documents;

and

further comprising the step of allowing the user to perform selected services represented by the provisioning interfaces of the at least one software resource, if indicated by the analyzing step.

5. The method according to claim 4, further comprising the step of obtaining operation-specific credentials of the user, and wherein the step of allowing the user to perform selected services depends on the operation-specific credentials of the selected service.

6. The method according to claim 4, wherein the analyzing step comprises at least one of (1) authentication and (2) authorization of the credentials.

7. The method according to claim 1, wherein identity information is programmatically relayed among distributed services performed by the software resources of the aggregated service.

8. The method according to claim 7, wherein the programmatic relaying comprises sending a message which specifies the credentials in a header of the message and a service request in a body of the message.

9. The method according to claim 8, wherein the message is a SOAP (“

Simple Object Access Protocol”

) message.

10. The method according to claim 1, wherein the service description document is specified in a markup language.

11. The method according to claim 10, wherein the markup language is Web Services Description Language (“

WSDL”

).

12. The method according to claim 2, wherein the registry is a network-accessible registry accessed using standardized messages.

13. A system for provisioning one or more software resources of an aggregated service in a computing network, comprising:

means for defining a provisioning interface of the aggregated service;

means for specifying the provisioning interface in a service description document;

means for obtaining credentials of a user of the aggregated service, according to the service description document;

means for analyzing the obtained credentials; and

means for allowing the user to perform the aggregated service if indicated by the means for analyzing.

14. A computer program product for provisioning one or more software resources of an aggregated service in a computing network, the computer program product embodied on one or more computer-readable media and comprising:

computer-readable program code means for defining a provisioning interface of the aggregated service;

computer-readable program code means for specifying the provisioning interface in a service description document;

computer-readable program code means for obtaining credentials of a user of the aggregated service, according to the service description document;

computer-readable program code means for analyzing the obtained credentials; and

computer-readable program code means for allowing the user to perform the aggregated service if indicated by the computer-readable program code means for analyzing.