Uniform access to entities in registered data store services

• US 20060294051A1
• Filed: 07/28/2005
• Published: 12/28/2006
• Est. Priority Date: 06/23/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Burke, Jonah S., Crow, Howard M., Kapadia, Arshish C.
• Granted Patent: US 7,810,106 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/954 Navigation, e.g. using categorised browsing

Abstract

An enterprise system may separate the executable functionality existing in backend applications, and the separation may be at differing levels of granularity. The separated functions of the application may be registered in a catalog in the form of metadata objects. Once the executable functionality has been registered, the authorization information for each granular functional object may be associated with authorization information. In this manner, the authorization of a service of an application may be made on a feature by feature (or object by object) basis in a unified manner.

Claims

1. A method for authorizing a user comprising:

a) receiving from a user device a first request for a service of an application;

b) determining a user identifier associated with the user device;

c) determining an access right required to access the service without accessing the application;

d) determining if the user identifier is associated with the access right;

e) in response to a determination of the user identifier being associated with the access right, generating a second request for the service of the application, the second request being different from the first request;

f) sending the second request to the application;

g) accessing the application using one or more user credentials different from one or more credentials of the user device.

2. The method of claim 1, wherein determining if the user identifier is associated with the access right includes accessing an object associated with the service, the object being stored in a data store.

3. The method of claim 2, wherein accessing an object includes accessing an access control list associated with the object.

4. The method of claim 3, wherein the access control list is owned by the object.

5. The method of claim 3, wherein accessing an access control list includes accessing an access control list of another object.

6. The method of claim 5, further comprising determining the another object by determining a nearest ancestor of the object owning an access control list.

7. The method of claim 6, wherein the object is selected from a group comprising a system object, a system instance object, an entity object, a method object, a parameter object, and a parameter type object.

8. The method of claim 7, further comprising organizing the group of a system object, a system instance object, an entity object, a method object, a parameter object, and a parameter type object as a hierarchy, and wherein determining a nearest ancestor of the object includes based on the hierarchy, determining a higher level object associated with the object and owning an access control list.

9. The method of claim 3, wherein accessing an object includes accessing an access control entry associated with the access control list, the access control entry including at least one authorized user identifier associated with at least one authorized right of access.

10. The method of claim 9, wherein the at least one authorized right of access is selected from a group comprising a right to edit, a right to view, and a right to execute.

11. One or more computer readable media having stored thereon a data structure comprising:

a) a first data field containing data representing an object identifier, the object identifier indicating an available service of an application;

b) a second data field, associated with the first data field, containing data representing an access control list identifier;

c) a third data field, associated with the second data field, containing data representing an access control entry identifier;

d) a fourth data field, associated with the third data field, containing data representing a user identifier associated with an authorized user of the application; and

e) a fifth data field, associated with the third data field, containing data representing a right identifier indicating an authorized right of the authorized user to access the available service.

12. The one or more computer readable media of claim 11, wherein the access control list identifier references an access control list application program interface for checking access rights of a user to the application.

13. The one or more computer readable media of claim 11, wherein the access control entry identifier references an access control entry application program interface for verifying access rights based on the fourth and fifth data fields.

14. The one or more computer readable media of claim 11, wherein the object identifier identifies an object having a type selected from a group comprising a system object, a system instance object, an entity object, a method object, a parameter object, and a parameter type object.

15. One or more computer readable media containing computer readable instructions that, when implemented, perform a method comprising:

a) associating a service identifier with connection information, an authorized user identifier, and an access right indicator of the authorized user identifier, wherein the service identifier is associated with a service of at least one of a plurality of available applications providing services;

b) receiving a request for the service from a user device;

c) verifying that a user identifier associated with the user device matches the authorized user identifier without accessing the at least one of the plurality of available applications;

d) based on the access right indicator, verifying that the request for the service is allowed by the authorized right indicator without accessing the at least one of the plurality of available applications;

e) if the user identifier and the request are verified, accessing the at least one of the plurality of available applications using credentials different from user credentials of the user device; and

f) requesting the service from the at least one of the plurality of available applications.

16. The one or more computer readable media of claim 15, wherein associating a service identifier with an authorized user identifier and an access right indicator of the authorized user identifier includes associating the service identifier with an access control list and associating the access control list with an access control entry, the access control entry associating the authorized user identifier and the access right indicator.

17. The one or more computer readable media of claim 16, wherein associating the service identifier with an access control list includes creating a service object containing the access control list.

18. The one or more computer readable media of claim 16, wherein associating the service identifier with an access control list includes associating the service identifier with an application program interface for discovering a nearest ancestor object of the service identifier that contains the access control list.

19. The one or more computer readable media of claim 18, wherein discovering a nearest ancestor object includes walking up a predetermined object hierarchy associated with the service identifier and determining a nearest higher level object containing an access control list.

20. The one or more computer readable media of claim 15, further comprising associating the authorized user identifier and access right indicator with a child service indicator associated to the service indicator in accordance with a service hierarchy.