Method and system for establishing federation relationships through imported configuration files

• US 20060021017A1
• Filed: 07/21/2004
• Published: 01/26/2006
• Est. Priority Date: 07/21/2004
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hinton, Heather Maria, Falola, Dolapo Martin, Moran, Anthony Scott
• Application Number:
  US10/896,285
• Publication Number:
  US 20060021017A1
• Time in Patent Office: Days
• US Class Current: 726/10
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

A method is presented in which federated domains interact to complete transactions within a federated environment. A point-of-contact server within a domain relies upon a trust service to manage trust relationships. An administrative user can build a federation relationship between a first service provider and a second service provider, which includes a trust relationship between the first service provider and the second service provider and a selection of federation-related operations, i.e. federation functionality. During configuration of the federation relationship, a file is dynamically generated based on the selection of federation functionality for the federation relationship. The file is exported to the second service provider, which provides additional configuration information by inserting it into the file. The modified file is imported at the first service provider from the second service provider, and the additional configuration information are extracted for subsequent use in federated transactions.

Claims

1. A method for providing federated functionality within a data processing system, the method comprising:

generating a first file at a first computing system for a first service provider, wherein contents of the first file are generated in accordance with configuration parameters at the first computing system for a federation relationship between the first service provider and a second service provider; and

exporting the first file from the first computing system provider to a second computing system for the second service provider.

2. The method of claim 1 further comprising:

building a trust relationship between the first service provider and the second service provider using the configuration parameters.

3. The method of claim 1 further comprising:

building the federation relationship between the first service provider and the second service provider using the configuration parameters.

4. The method of claim 1 further comprising:

importing a second file at the first computing system from the second computing system, wherein the second file is a modified version of the first file.

5. The method of claim 4 further comprising:

extracting information from the second file; and

storing the extracted information at the first computing system as configuration parameters for the federation relationship between the first service provider and the second service provider.

6. The method of claim 5 wherein the extracted information is partner-specific data for the second service provider.

7. The method of claim 5 wherein the partner-specific data for the second service provider comprises trust-related information for the second service provider.

8. The method of claim 5 wherein the partner-specific data for the second service provider comprises a public key or a digital certificate for the second service provider.

9. The method of claim 5 wherein the partner-specific data for the second service provider comprises URI'"'"'s (Uniform Resource Identifiers) associated with the second service provider.

10. The method of claim 5 further comprising:

executing a transaction between the first computing system and the second computing system in accordance with the federation relationship including the partner-specific data for the second service provider.

11. The method of claim 1 further comprising:

executing a transaction between the first computing system and the second computing system in accordance with the federation relationship.

12. The method of claim 1 further comprising:

including partner-specific data for the first service provider in the first file prior to exporting the first file, wherein the partner-specific data for the first service provider enables the second service provider to execute a transaction between the first computing system and the second computing system in accordance with the federation relationship.

13. The method of claim 12 wherein the partner-specific data for the first service provider comprises trust-related information for the first service provider.

14. The method of claim 12 wherein the partner-specific data for the first service provider comprises a public key or a digital certificate for the first service provider.

15. The method of claim 12 wherein the partner-specific data for the first service provider comprises URI'"'"'s (Uniform Resource Identifiers) associated with the first service provider.

16. The method of claim 1 further comprising:

including partner-specific data for the first service provider in a third file, wherein the partner-specific data for the first service provider enables the second service provider to execute a transaction between the first computing system and the second computing system in accordance with the federation relationship; and

exporting the third file from the first computing system provider to the second service provider.

17. The method of claim 1 further comprising:

providing at the first computing system for user selection or user entry of configuration parameters for the federation relationship.

18. The method of claim 1 further comprising:

initiating creation of a trust relationship between the first service provider and the second service provider;

selecting a set of federation-related operations;

creating an association between the selected set of federation-related operations and the trust relationship; and

storing the association as a configuration parameter for the federation relationship at the first computing system.

19. The method of claim 1 wherein the step of generating the first file further comprises:

obtaining metadata parameters associated with the federation-related operations, wherein the metadata parameters indicate configuration parameters that are used to implement the federation-related operations; and

inserting a data item in the first file for each additional configuration parameter.

20. The method of claim 1 further comprising:

selecting a previously configured trust relationship between the first service provider and the second service provider;

selecting a set of federation-related operations;

creating an association between the selected set of federation-related operations and the selected trust relationship; and

storing the association as a configuration parameter for the federation relationship at the first computing system.

21. The method of claim 1 wherein the step of generating the first file further comprises:

formatting the first file as an XML (extensible Markup Language) file.

22. An apparatus for providing federated functionality in a data processing system, the apparatus comprising:

means for generating a first file at a first computing system for a first service provider, wherein contents of the first file are generated in accordance with configuration parameters at the first computing system for a federation relationship between the first service provider and a second service provider; and

means for exporting the first file from the first computing system provider to a second computing system for the second service provider.

23. The apparatus of claim 22 further comprising:

means for building a trust relationship between the first service provider and the second service provider using the configuration parameters.

24. The apparatus of claim 22 further comprising:

means for building the federation relationship between the first service provider and the second service provider using the configuration parameters.

25. The apparatus of claim 22 further comprising:

means for importing a second file at the first computing system from the second computing system, wherein the second file is a modified version of the first file.

26. The apparatus of claim 25 further comprising:

means for extracting information from the second file; and

means for storing the extracted information at the first computing system as configuration parameters for the federation relationship between the first service provider and the second service provider.

27. The apparatus of claim 26 wherein the extracted information is partner-specific data for the second service provider.

28. The apparatus of claim 26 wherein the partner-specific data for the second service provider comprises trust-related information for the second service provider.

29. The apparatus of claim 26 wherein the partner-specific data for the second service provider comprises a public key or a digital certificate for the second service provider.

31. The apparatus of claim 26 further comprising:

means for executing a transaction between the first computing system and the second computing system in accordance with the federation relationship including the partner-specific data for the second service provider.

32. The apparatus of claim 22 further comprising:

means for executing a transaction between the first computing system and the second computing system in accordance with the federation relationship.

33. The apparatus of claim 22 further comprising:

means for including partner-specific data for the first service provider in the first file prior to exporting the first file, wherein the partner-specific data for the first service provider enables the second service provider to execute a transaction between the first computing system and the second computing system in accordance with the federation relationship.

34. The apparatus of claim 33 wherein the partner-specific data for the first service provider comprises trust-related information for the first service provider.

35. The apparatus of claim 33 wherein the partner-specific data for the first service provider comprises a public key or a digital certificate for the first service provider.

36. The apparatus of claim 33 wherein the partner-specific data for the first service provider comprises URI'"'"'s (Uniform Resource Identifiers) associated with the first service provider.

37. The apparatus of claim 22 further comprising:

means for including partner-specific data for the first service provider in a third file, wherein the partner-specific data for the first service provider enables the second service provider to execute a transaction between the first computing system and the second computing system in accordance with the federation relationship; and

means for exporting the third file from the first computing system provider to the second service provider.

38. The apparatus of claim 22 further comprising:

means for providing at the first computing system for user selection or user entry of configuration parameters for the federation relationship.

39. The apparatus of claim 22 further comprising:

means for initiating creation of a trust relationship between the first service provider and the second service provider;

means for selecting a set of federation-related operations;

means for creating an association between the selected set of federation-related operations and the trust relationship; and

means for storing the association as a configuration parameter for the federation relationship at the first computing system.

40. The apparatus of claim 22 wherein the means for generating the first file further comprises:

means for obtaining metadata parameters associated with the federation-related operations, wherein the metadata parameters indicate configuration parameters that are used to implement the federation-related operations; and

means for inserting a data item in the first file for each additional configuration parameter.

41. The apparatus of claim 22 further comprising:

means for selecting a previously configured trust relationship between the first service provider and the second service provider;

means for selecting a set of federation-related operations;

means for creating an association between the selected set of federation-related operations and the selected trust relationship; and

means for storing the association as a configuration parameter for the federation relationship at the first computing system.

42. The apparatus of claim 22 wherein the means for generating the first file further comprises:

means for formatting the first file as an XML (extensible Markup Language) file.

30. The apparatus of claim A5 wherein the partner-specific data for the second service provider comprises URI'"'"'s (Uniform Resource Identifiers) associated with the second service provider.

43. A computer program product on a computer readable medium for use in a data processing system for providing federated functionality, the computer program product comprising:

means for generating a first file at a first computing system for a first service provider, wherein contents of the first file are generated in accordance with configuration parameters at the first computing system for a federation relationship between the first service provider and a second service provider; and

means for exporting the first file from the first computing system provider to a second computing system for the second service provider.

44. The computer program product of claim 43 further comprising:

means for building a trust relationship between the first service provider and the second service provider using the configuration parameters.

45. The computer program product of claim 43 further comprising:

means for building the federation relationship between the first service provider and the second service provider using the configuration parameters.

46. The computer program product of claim 43 further comprising:

means for importing a second file at the first computing system from the second computing system, wherein the second file is a modified version of the first file.

47. The computer program product of claim 46 further comprising:

means for extracting information from the second file; and

means for storing the extracted information at the first computing system as configuration parameters for the federation relationship between the first service provider and the second service provider.

48. The computer program product of claim 47 wherein the extracted information is partner-specific data for the second service provider.

49. The computer program product of claim 47 wherein the partner-specific data for the second service provider comprises trust-related information for the second service provider.

50. The computer program product of claim 47 wherein the partner-specific data for the second service provider comprises a public key or a digital certificate for the second service provider.

51. The computer program product of claim 47 wherein the partner-specific data for the second service provider comprises URI'"'"'s (Uniform Resource Identifiers) associated with the second service provider.

52. The computer program product of claim 47 further comprising:

means for executing a transaction between the first computing system and the second computing system in accordance with the federation relationship including the partner-specific data for the second service provider.

53. The computer program product of claim 43 further comprising:

means for executing a transaction between the first computing system and the second computing system in accordance with the federation relationship.

54. The computer program product of claim 43 further comprising:

means for including partner-specific data for the first service provider in the first file prior to exporting the first file, wherein the partner-specific data for the first service provider enables the second service provider to execute a transaction between the first computing system and the second computing system in accordance with the federation relationship.

55. The computer program product of claim 54 wherein the partner-specific data for the first service provider comprises trust-related information for the first service provider.

56. The computer program product of claim 54 wherein the partner-specific data for the first service provider comprises a public key or a digital certificate for the first service provider.

57. The computer program product of claim 54 wherein the partner-specific data for the first service provider comprises URI'"'"'s (Uniform Resource Identifiers) associated with the first service provider.

58. The computer program product of claim 43 further comprising:

means for including partner-specific data for the first service provider in a third file, wherein the partner-specific data for the first service provider enables the second service provider to execute a transaction between the first computing system and the second computing system in accordance with the federation relationship; and

means for exporting the third file from the first computing system provider to the second service provider.

59. The computer program product of claim 43 further comprising:

means for providing at the first computing system for user selection or user entry of configuration parameters for the federation relationship.

60. The computer program product of claim 43 further comprising:

means for initiating creation of a trust relationship between the first service provider and the second service provider;

means for selecting a set of federation-related operations;

means for creating an association between the selected set of federation-related operations and the trust relationship; and

means for storing the association as a configuration parameter for the federation relationship at the first computing system.

61. The computer program product of claim 43 wherein the means for generating the first file further comprises:

means for obtaining metadata parameters associated with the federation-related operations, wherein the metadata parameters indicate configuration parameters that are used to implement the federation-related operations; and

means for inserting a data item in the first file for each additional configuration parameter.

62. The computer program product of claim 43 further comprising:

means for selecting a previously configured trust relationship between the first service provider and the second service provider;

means for selecting a set of federation-related operations;

means for creating an association between the selected set of federation-related operations and the selected trust relationship; and

means for storing the association as a configuration parameter for the federation relationship at the first computing system.

63. The computer program product of claim 43 wherein the means for generating the first file further comprises:

means for formatting the first file as an XML (extensible Markup Language) file.