Method and apparatus for handling custom token propagation without Java serialization

• US 20060005234A1
• Filed: 06/30/2004
• Published: 01/05/2006
• Est. Priority Date: 06/30/2004
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Chao, Ching-Yun, Birk, Peter Daniel, Chung, Hyen Vui
• Application Number:
  US10/882,118
• Publication Number:
  US 20060005234A1
• Time in Patent Office: Days
• US Class Current: 726/9
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A method, apparatus and computer instructions for handling propagation of custom tokens without using Java™ serialization. A service provider may plug in a first login module to add a marker token to a subject for later use by an application at run time. The marker token is then serialized by the mechanism of the present invention by invoking a get bytes method on the token. The present invention then propagates the token downstream if the token is marked forwardable. At a target server, a second login module may be plugged in to deserialize a byte array from a list of tokens and perform custom operation on the byte array retrieved from a token holder.

Claims

1. A computer implemented method for handling propagation of tokens, the method comprising:

invoking a first login module at a first resource to propagate a token;

assigning identifying information to the token using the first login module; and

performing a customized operation on the token based on the identifying information.

2. The method of claim 1, wherein performing a customized operation includes:

retrieving a byte array from the token;

performing a custom operation on the byte array to form a customized byte array; and

serializing the customized byte array into an opaque token.

3. The method of claim 1, wherein the token is retrieved from a subject stored in a cache of the first resource.

4. The method of claim 1, wherein the token includes a byte array, and wherein the byte array includes security attributes of the token before customization.

5. The method of claim 1, wherein the first login module includes at least one of a default login module and a custom login module.

6. The method of claim 1, wherein the token is a forwardable token.

7. The method of claim 6, wherein invoking a first login module at a first server to propagate a token includes:

invoking a get forwardable method on the token; and

determining if the token is forwardable using the get forwardable method.

8. The method of claim 1, wherein the identifying information includes a name and a version.

9. The method of claim 8, wherein assigning identifying information to the token includes:

associating the name with an owner of the token; and

associating the version with a version of the token.

10. The method of claim 9, wherein associating the name with an owner of the token includes invoking a get name method and wherein associating the version with a version of the custom token includes invoking a get version method.

11. The method of claim 10, wherein the token implements at least one of a set of marker token interfaces.

12. The method of claim 11, wherein the set of marker token interfaces includes at least one of an authorization marker token interface, an authentication marker token interface, a single sign-on marker token interface and a propagation marker token interface.

13. The method of claim 9, wherein serializing the customized byte array into an opaque token includes:

adding the customized byte array into the opaque token;

adding the name associated into the opaque token;

adding the version associated into the opaque token; and

converting the opaque token into a sequence of bytes.

14. The method of claim 2, wherein retrieving a byte array from the token includes:

invoking a get bytes method of the token, wherein the get bytes method is a method defined in a token interface implemented by the token.

15. The method of claim 14, wherein the get bytes method retrieves a byte array based on a name and a version.

16. The method of claim 2, wherein the custom operation includes encryption.

17. The method of claim 2, further comprising:

invoking a second login module at a second resource to retrieve a propagated token;

deserializing the propagated token into a byte array; and

performing a custom operation on the byte array.

18. The method of claim 17, wherein the propagated token is retrieved from a list of tokens based on a name and a version.

19. The method of claim 17, wherein deserializing the propagated token into a byte array includes:

invoking a get bytes method to retrieve the byte array from the propagated token.

20. The method of claim 17, wherein the custom operation includes decryption.

21. The method of claim 17, wherein the second login module includes at least one of a default login module and a custom login module.

22. A data processing system for handling propagation of tokens, the data processing system comprising:

invoking means for invoking a first login module at a first resource to propagate a token;

assigning means for assigning identifying information to the token using the first login module; and

performing means for performing a customized operation on the token based on the identifying information.

23. The data processing system of claim 22, wherein the performing means for performing a customized operation includes:

retrieving means for retrieving a byte array from the token;

performing means for performing a custom operation on the byte array to form a customized byte array; and

serializing means for serializing the customized byte array into an opaque token.

24. The data processing system of claim 22, wherein the assigning means for assigning identifying information to the token comprises:

associating means for associating a name with an owner of the token; and

associating means for associating a version with a version of the token.

25. The data processing system of claim 24, wherein the serializing means for serializing the customized byte array into an opaque token includes:

adding means for adding the customized byte array into the opaque token;

adding means for adding the name associated into the opaque token;

adding means for adding the version associated into the opaque token; and

converting means for converting the opaque token into a sequence of bytes.

26. The data processing system of claim 22, further comprising:

invoking means for invoking a second login module at a second resource to retrieve a propagated token;

deserializing means for deserializing the propagated token into a byte array; and

performing means for performing a custom operation on the byte array.

27. A computer program product in a computer readable medium for handling propagation of tokens, the computer program product comprising:

first instructions for invoking a first login module at a first resource to propagate a token; and

second instructions for assigning identifying information to the token using the first login module;

third instructions for performing a customized operation on the token based on the identifying information.

28. The computer program product of claim 27, wherein the third instructions includes:

first sub-instructions for retrieving a byte array from the token;

second sub-instructions for performing a custom operation on the byte array to form a customized byte array; and

third sub-instructions for serializing the customized byte array into an opaque token.

29. The computer program product of claim 27, wherein the second instructions comprises:

first sub-instructions for associating a name with an owner of the token; and

second sub-instructions for associating a version with a version of the token.

30. The computer program product of claim 27, further comprising:

fourth instructions for invoking a second login module at a second server to retrieve a propagated token;

fifth instructions for deserializing the propagated token into a byte array; and

sixth instructions for performing a custom operation on the byte array.