System and method for integrated security roles

• US 20040193909A1
• Filed: 03/27/2003
• Published: 09/30/2004
• Est. Priority Date: 03/27/2003
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Chang, David Yu, Chao, Ching-Yun
• Granted Patent: US 7,454,786 B2
• Time in Patent Office: Days
• US Class Current: 726/14
• CPC Class Codes: G06F 21/6236 between heterogeneous systems
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A system and method for integrated security roles is presented. An upstream application includes one or more role-mapping requirements that correspond to an upstream security role and a downstream security role. The upstream security role is expanded by adding an upstream security role identifier in a downstream application'"'"'s role-mapping table or by adding upstream user-to-role mappings to a downstream application'"'"'s role-mapping table. When an upstream security role is expanded, a user assigned to the upstream security role automatically has access to role-mapped downstream applications.

Claims

1. A method of authorizing a client'"'"'s request at a first downstream application, said method comprising:

receiving, at the first downstream application, a first application request from an upstream application, wherein the first application request is derived from the client'"'"'s request and includes an upstream security role identifier that was determined by the upstream application;

reading authorization table entries stored in a downstream authorization table accessible from the downstream application;

matching the upstream security role identifier included in the request with at least one of the authorization table entries included in the downstream authorization table; and

authorizing the client'"'"'s request in response to the matching.

2. The method as described in claim 1 further comprising:

identifying one or more required downstream security roles wherein each authorization table entry corresponds to at least one of the required downstream security roles.

3. The method as described in claim 2 further comprising:

selecting the required downstream security role that corresponds to the matched authorization table entry;

including the selected required downstream security role in a second application request; and

sending the second application request to a second downstream application.

4. The method as described in claim 1 wherein the matched authorization table entry was generated prior to receiving the first application request, the generating further comprising:

receiving a role-mapping requirement wherein the role-mapping requirement includes an upstream security role and a downstream security role, the upstream security role corresponding to the upstream security role identifier;

including the upstream security role identifier in the matched authorization table entry, the matched authorization table entry corresponding to the downstream security role.

5. The method as described in claim 4 further comprising:

determining whether the upstream security role and the downstream security role are equivalent; and

configuring the upstream security role and the downstream security role such that they are equivalent.

6. The method as described in claim 1 wherein the first application request is received over a computer network.

7. A method of expanding an upstream security role to include a downstream application, said method comprising:

receiving a security role-mapping request that corresponds to an upstream application and the upstream security role;

selecting a downstream security role corresponding to the security role-mapping request and the downstream application; and

adding one or more downstream authorization table entries to the downstream security role, wherein the authorization table entries correspond to the upstream security role.

8. The method as described in claim 7 wherein at least one of the authorization table entries is selected from the group consisting of a user identifier, a group identifier, and an upstream security role identifier.

9. The method as described in claim 7 further comprising:

determining whether the upstream security role and the downstream security role are equivalent; and

configuring the downstream authorization table entries and one or more upstream authorization table entries such that they are equivalent, the upstream authorization table entries corresponding to the upstream security role.

10. The method as described in claim 7 further comprising:

receiving an application request from the upstream application, wherein the request includes a user identifier;

matching the user identifier with one or more of the downstream authorization table entries; and

authorizing the application request in response to the matching.

11. An information handling system comprising:

one or more processors;

a memory accessible by the processors;

one or more nonvolatile storage devices accessible by the processors; and

a client authorization tool to authorize a client'"'"'s request at a first downstream application, the client authorization tool including;

means for receiving, at the first downstream application, a first application request from an upstream application, wherein the first application request is derived from the client'"'"'s request and includes an upstream security role identifier that was determined by the upstream application;

means for reading authorization table entries stored in a downstream authorization table accessible from the downstream application, the downstream authorization table located in one of the nonvolatile storage devices;

means for matching the upstream security role identifier included in the request with at least one of the authorization table entries included in the downstream authorization table; and

means for authorizing the client'"'"'s request in response to the matching.

12. The information handling system as described in claim 11 further comprising:

means for identifying one or more required downstream security roles located in one of the nonvolatile storage devices wherein each authorization table entry corresponds to at least one of the required downstream security roles.

13. The information handling system as described in claim 12 further comprising:

means for selecting the required downstream security role that corresponds to the matched authorization table entry;

means for including the selected required downstream security role in a second application request; and

means for sending the second application request to a second downstream application.

14. The information handling system as described in claim 11 wherein the matched authorization table entry was generated prior to receiving the first application request, the generating further comprising:

means for receiving a role-mapping requirement wherein the role-mapping requirement includes an upstream security role and a downstream security role, the upstream security role corresponding to the upstream security role identifier;

means for including the upstream security role identifier in the matched authorization table entry, the matched authorization table entry corresponding to the downstream security role.

15. The information handling system as described in claim 14 further comprising:

means for determining whether the upstream security role and the downstream security role are equivalent; and

means for configuring the upstream security role and the downstream security role such that they are equivalent.

16. The information handling system as described in claim 11 wherein the first application request is received over a computer network.

17. A computer program product stored on a computer operable media for authorizing a client'"'"'s request at a first downstream application, said computer program product comprising:

means for receiving, at the first downstream application, a first application request from an upstream application, wherein the first application request is derived from the client'"'"'s request and includes an upstream security role identifier that was determined by the upstream application;

means for reading authorization table entries stored in a downstream authorization table accessible from the downstream application;

means for matching the upstream security role identifier included in the request with at least one of the authorization table entries included in the downstream authorization table; and

means for authorizing the client'"'"'s request in response to the matching.

18. The computer program product as described in claim 17 further comprising:

means for identifying one or more required downstream security roles wherein each authorization table entry corresponds to at least one of the required downstream security roles.

19. The computer program product as described in claim 18 further comprising:

means for selecting the required downstream security role that corresponds to the matched authorization table entry;

means for including the selected required downstream security role in a second application request; and

means for sending the second application request to a second downstream application.

20. The computer program product as described in claim 18 wherein the matched authorization table entry was generated prior to receiving the first application request, the generating further comprising:

means for receiving a role-mapping requirement wherein the role-mapping requirement includes an upstream security role and a downstream security role, the upstream security role corresponding to the upstream security role identifier;

means for including the upstream security role identifier in the matched authorization table entry, the matched authorization table entry corresponding to the downstream security role.

21. The computer program product as described in claim 20 further comprising:

means for determining whether the upstream security role and the downstream security role are equivalent; and

means for configuring the upstream security role and the downstream security role such that they are equivalent.

22. The computer program product as described in claim 17 wherein the first application request is received over a computer network.