Using identity/resource profile and directory enablers to support identity management

• US 20070162581A1
• Filed: 01/11/2006
• Published: 07/12/2007
• Est. Priority Date: 01/11/2006
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Maes, Stephane
• Granted Patent: US 8,688,813 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 61/45 Network directories; Name-to-address mapping
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 67/53 using third party service providers

Abstract

Embodiments of the present invention provide methods, system and machine-readable media for dynamically providing identity management or other services. According to one embodiment, dynamically providing services can comprise receiving a request related to an unknown principal. A service to which the principal is known can be selected. Once a service to which the principal is known has been located, an identity management result can be obtained from the selected service. The method can further comprise determining based on the identity management result whether the principal is authorized to access a requested resource. In response to determining the principal is authorized, the requested resource can be accessed.

Claims

1. A method of providing a service related to an unknown principal, the method comprising:

receiving a request related to the unknown principal;

locating a service to which the principal is known; and

requesting an identity management result related to the principal from the service to which the principal is known.

2. The method of claim 1, wherein receiving the request related to the unknown principal comprises receiving the request from the unknown principal.

3. The method of claim 1, wherein receiving the request related to the unknown principal comprises receiving the request from a requesting service.

4. The method of claim 1, wherein locating the service to which the principal is known is based on one or more identity attributes related to the principal.

5. The method of claim 4, wherein locating the service to which the principal is known comprises selecting the service from a list of services based on the identity attributes related to the principal.

6. The method of claim 1, wherein locating the service to which the principal is known is based on an Universal Resource Identifier (URI) provided by the principal.

7. The method of claim 4, wherein the identity attributes related to the principal are provided by the principal.

8. The method of claim 2, wherein locating the service to which the principal is known comprises:

querying a plurality of services;

receiving a response from at least some of the plurality of services indicating whether the principal is known; and

selecting a service from the plurality of services based on the response from that service.

9. The method of claim 1, further comprising obtaining an identity management result related to the principal from the service to which the principal is known.

10. The method of claim 9, wherein obtaining the identity management result related to the principal from the service to which the principal is known comprises obtaining a security token related to the principal.

11. The method of claim 10, further comprising determining based on the security token whether the principal is authorized to access a requested resource and, in response to determining the principal is authorized, accessing the requested resource.

12. The method of claim 9, wherein obtaining the identity management result related to the principal from the service to which the principal is known comprises obtaining an identity attribute related to the principal.

13. The method of claim 9, wherein obtaining the identity management result related to the principal from the service to which the principal is known comprises changing an identity attribute related to the principal.

14. The method of claim 9, wherein obtaining the identity management result related to the principal from the service to which the principal is known comprises obtaining an indication of the principal being authenticated.

15. The method of claim 9, wherein obtaining the identity management result related to the principal from the service to which the principal is known comprises affecting the principal.

16. The method of claim 1, wherein obtaining the identity management result related to the principal from the service to which the principal is known comprises redirecting the principal to the identity management service.

17. The method of claim 16, further comprising receiving the security token from the principal, determining based on the security token whether the principal is authorized to access the requested resource, and in response to determining the principal is authorized, accessing the requested resource.

18. The method of claim 9, further comprising, prior to obtaining the identity management result related to the principal from the service to which the principal is known, requesting permission from the principal to affect the identity management result and wherein obtaining the identity management result further comprises obtaining the identity management result only if the principal grants permission.

19. A system comprising:

a plurality of services adapted to affect an identity management result; and

a directory enabler communicatively coupled with one or more of the services and adapted to receive a request related to a principal from a requestor to which the principal is unknown, select a service to which the principal is known from the plurality of services based on one or more identity attributes related to the principal, and send information identifying the selected service to the requester.

20. The system of claim 19, wherein the directory enabler further comprises a data store including a list of services and the directory enabler is further adapted to select the service to which the principal is known from the list of services based on identity attributes provided by the principal.

21. The system of claim 19, wherein the directory enabler is further adapted to locate the service to which the principal is known by:

querying the plurality of services; and

receiving a response from at least some of the plurality of services indicating whether the principal is known.

22. The system of claim 21, wherein selecting the service from the plurality of services is based on the response from that system.

23. A system comprising:

a plurality of services adapted to affect an identity management result;

a profile enabler communicatively coupled with one or more of the services and adapted to receive a request related to a principal; and

a directory enabler communicatively coupled with the profile enabler and adapted to select a service to which the principal is known from the plurality of services based on one or more identity attributes related to the principal.

24. The system of claim 23, wherein the profile enabler receives the request related to the principal from the principal.

25. The system of claim 23, wherein the profile enabler receives the request related to the principal from a requesting service.

26. The system of claim 23, wherein the directory enabler selects the service to which the principal is known based on one or more identity attributes related to the principal.

27. The system of claim 26, wherein the directory enabler selects the service to which the principal is known by selecting the service from a list of services based on the identity attributes related to the principal.

28. The system of claim 26, wherein the identity attributes related to the principal are provided by the principal.

29. The system of claim 24, wherein the directory enabler selects the service to which the principal is known by:

querying the plurality of services;

receiving a response from at least some of the plurality of services indicating whether the principal is known; and

selecting a service from the plurality of services based on the response from that service.

30. The system of claim 23, wherein the profile enabler obtains an identity management result related to the principal from the service to which the principal is known.

31. The system of claim 30, wherein the profile enabler obtains the identity management result related to the principal from the service to which the principal is known by obtaining a security token related to the principal.

32. The system of claim 31, wherein the profile enabler further determines based on the security token whether the principal is authorized to access a requested resource.

33. The system of claim 30, wherein the profile enabler obtains the identity management result related to the principal from the service to which the principal is known by obtaining an identity attribute related to the principal.

34. The system of claim 30, wherein the profile enabler obtains the identity management result related to the principal from the service to which the principal is known by changing an identity attribute related to the principal.

35. The system of claim 30, wherein the profile enabler obtains the identity management result related to the principal from the service to which the principal is known by affecting the principal.

36. The system of claim 23, wherein the profile enabler obtains the identity management result related to the principal from the service to which the principal is known by redirecting the principal to the identity management service.

37. The system of claim 36, wherein the profile enabler is further adapted to receive the security token from the principal and determine based on the security token whether the principal is authorized to access a requested resource.

38. A system comprising:

a plurality of services adapted to affect an identity management result; and

a profile enabler communicatively coupled with one or more of the services and adapted to receive a request related to a principal from a requestor to which the principal is unknown, select a service to which the principal is known from the plurality of services based on one or more identity attributes related to the principal, and request an identity management result from the selected service.

39. The system of claim 38, wherein the profile enabler receives the request related to the principal from another principal.

40. The system of claim 38, wherein the profile enabler receives the request related to the principal from a requesting service.

41. The system of claim 38, wherein the profile enabler selects the service to which the principal is known based on one or more identity attributes related to the principal.

42. The system of claim 38, wherein the profile enabler selects the service to which the principal is known based on a Universal Resource Identifier (URI) provided by the requestor.