CONFLICT RESOLUTION WHEN IDENTICAL POLICIES ARE ATTACHED TO A SINGLE POLICY SUBJECT

• US 20130086627A1
• Filed: 03/31/2012
• Published: 04/04/2013
• Est. Priority Date: 09/30/2011
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Bryan, Jeffrey Jason, Kavantzas, Nickolas
• Granted Patent: US 8,914,843 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 41/0246 Exchanging or transporting network management information using the Internet; Embedding network management web servers in network elements; Web-services-based protocols
• CPC Class Codes: H04L 41/0873 Checking configuration conflicts between network elements
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Techniques for resolving conflicts between web service policies that are attached (via LPA and/or GPA metadata) to a single policy subject (e.g., a WS client/service endpoint). In one set of embodiments, a determination can be made whether two conflicting policies that are attached to a single policy subject are identical. This determination can be based on, e.g., a Uniform Resource Identifier (URI) that is used to identify the policies in their respective policy attachment metadata files, as well as any policy configuration properties. If the two conflicting policies are determined to be identical, the policy attachment metadata for one of the policies can be considered valid, while the policy attachment metadata for the other, duplicate policy can be ignored. In this manner, validation errors arising from duplicate policy attachments can be avoided.

Claims

1. A method comprising:

determining, by a computer system, whether a first web service policy attached to a policy subject via a first policy attachment metadata file is identical to a second web service policy attached to the policy subject via a second policy attachment metadata file, wherein attachment of the first web service policy to the policy subject conflicts with attachment of the second web service policy to the policy subject according to one or more predefined rules; and

if the first web service policy and the second web service policy are determined to be identical, causing, by the computer system, the first web service policy or the second web service policy to be enforced at the policy subject.

2. The method of claim 1 wherein if the first web service policy and the second web service policy are not determined to be identical, causing neither the first web service policy nor the second web service policy to be enforced at the policy subject.

3. The method of claim 1 wherein the first web service policy is of a first policy type, and wherein the second web service policy is of a second policy type that conflicts with the first policy type.

4. The method of claim 1 wherein the first web service policy and the second web service policy are both authentication policies.

5. The method of claim 1 wherein the policy subject is a web service endpoint of a Service-Oriented Architecture (SOA) application.

6. The method of claim 5 wherein the first web service policy and the second web service policy each define one or more security or management-related assertions, and wherein enforcing the first web service policy or the second web service policy at the web service endpoint comprises enforcing the one or more security or management-related assertions.

7. The method of claim 1 wherein the first policy attachment metadata file includes a first policy reference identifying the first web service policy, and wherein the second policy attachment metadata includes a second policy reference identifying the second web service policy.

8. The method of claim 7 wherein the first and second policy references are Uniform Resource Identifiers (URIs).

9. The method of claim 8 wherein determining whether the first web service policy is identical to the second web service policy comprises comparing their respective URIs.

10. The method of claim 9 wherein the first policy attachment metadata file further includes first configuration override information usable when enforcing the first web service policy and the second policy attachment metadata file further includes second configuration override information usable when enforcing the second web service policy.

11. The method of claim 10 wherein the first configuration override information and the second configuration override information each comprise a plurality of name-value pairs.

12. The method of claim 10 wherein determining whether the first web service policy is identical to the second web service policy further comprises comparing the first configuration override information to the second configuration override information.

13. A non-transitory computer-readable medium having stored thereon program code executable by a computer system, the program code comprising:

program code that causes the computer system to determine whether a first web service policy attached to a policy subject via a first policy attachment metadata file is identical to a second web service policy attached to the policy subject via a second policy attachment metadata file, wherein attachment of the first web service policy to the policy subject conflicts with attachment of the second web service policy to the policy subject according to one or more predefined rules; and

if the first web service policy and the second web service policy are determined to be identical, code that causes the computer system to enforce the first web service policy or the second web service policy at the policy subject.

14. The non-transitory computer-readable medium of claim 13 wherein the first policy attachment metadata file includes a first URI identifying the first web service policy, wherein the second policy attachment metadata includes a second URI identifying the second web service policy, and wherein determining whether the first web service policy is identical to the second web service policy comprises comparing the first URI to the second URI.

15. The non-transitory computer-readable medium of claim 14 wherein the first policy attachment metadata file further includes first configuration override information usable when enforcing the first web service policy, wherein the second policy attachment metadata file further includes second configuration override information usable when enforcing the second web service policy, and wherein determining whether the first web service policy is identical to the second web service policy further comprises comparing the first configuration override information to the second configuration override information.

16. A system comprising:

a processor configured to;

determine whether a first web service policy attached to a policy subject via a first policy attachment metadata file is identical to a second web service policy attached to the policy subject via a second policy attachment metadata file, wherein attachment of the first web service policy to the policy subject conflicts with attachment of the second web service policy to the policy subject according to one or more predefined rules; and

if the first web service policy and the second web service policy are determined to be identical, cause the first web service policy or the second web service policy to be enforced at the policy subject.

17. The system of claim 16 wherein the first policy attachment metadata file includes a first URI identifying the first web service policy, wherein the second policy attachment metadata includes a second URI identifying the second web service policy, and wherein determining whether the first web service policy is identical to the second web service policy comprises comparing the first URI to the second URI.

18. The system of claim 17 wherein the first policy attachment metadata file further includes first configuration override information usable when enforcing the first web service policy, wherein the second policy attachment metadata file further includes second configuration override information usable when enforcing the second web service policy, and wherein determining whether the first web service policy is identical to the second web service policy further comprises comparing the first configuration override information to the second configuration override information.