DYNAMIC IDENTITY SWITCHING

• US 20130086630A1
• Filed: 06/01/2012
• Published: 04/04/2013
• Est. Priority Date: 09/30/2011
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Kavantzas, Nickolas, Guo, Jiandong, Gupta, Pratibha
• Granted Patent: US 9,507,927 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Techniques are disclosed for dynamically switching user identity when generating a web service request by receiving, at a client application, an invocation of a web service, the invocation associated with a first authenticated user identity of a first user, identifying a second user identity, verifying that a switch from the first user identity to the second user identity is permitted by switching rules, including the second user identity in a service request when the switch is permitted, and communicating the service request to the web service. The switching rules can include associations between initial user identities and permitted user identities. Verifying that a switch is permitted can include searching the associations for an entry having an initial user identity that matches the first authenticated user identity and a new user identity that matches the second user identity, wherein the switch is permitted when the entry is found.

Claims

1. A method of dynamically switching between user identities, the method comprising:

receiving, by a computer system, at a client application, an invocation of a web service, the invocation associated with a first authenticated user identity of a first user;

identifying, by the computer system, a second user identity;

verifying, by the computer system, that a switch from the first authenticated user identity to the second user identity is permitted by one or more switching rules;

including, by the computer system, the second user identity in a service request when the switch is permitted; and

communicating, by the computer system, the service request to the web service.

2. The method of claim 1, wherein identifying the second user identity comprises dynamically determining the second user identity at runtime.

3. The method of claim 2, wherein the one or more switching rules comprise associations between initial user identities and permitted user identities, and

verifying that a switch is permitted comprises searching, by the computer system, the associations for an entry having an initial user identity that matches the first authenticated user identity and a new user identity that matches the second user identity,

wherein the switch is permitted when the entry is found in the associations.

4. The method of claim 1, wherein identifying the second user identity comprises determining, by the computer system, the second user identity based upon the one or more switching rules.

5. The method of claim 4, wherein the one or more switching rules comprise one or more associations between initial user identities and permitted user identities, and

verifying that a switch is permitted comprises searching, by the computer system, the associations for an entry having an initial user identity that matches the first authenticated user identity,

wherein the switch is permitted when the entry is found in the associations, and

the second user identity is based upon a new user identity associated with the entry having the initial user identity that matches the first user identity.

6. The method of claim 1, wherein including the second user identity in the service request includes storing the second user identity in a subject field of the service request.

7. The method of claim 1, wherein including the second user identity in the service request comprises storing the second user identity in a security token included in the service request.

8. The method of claim 1, wherein invocation by the second user is permitted when one or more attributes of the rule match corresponding values determined at runtime.

9. The method of claim 1, wherein a first rule of the one or more switching rules comprises a permitted application, a permitted initial identity, and a permitted new identity, and the verifying that a switch is permitted comprises:

comparing the permitted application to the client application,

comparing the permitted initial identity to the identity of the first user, and

comparing the permitted new identity to the identity of the second user,

wherein the invocation by the second user is permitted when the permitted application matches the client application, the permitted initial identity matches the identity of the first user, and the permitted new identity matches the identity of the second user.

10. The method of claim 9, wherein the first rule of the one-on-one switching rules comprises a condition based on one or more attributes of the client application, and invocation by the second user is permitted when the condition is satisfied.

11. The method of claim 10, wherein the condition is further based upon one or more values determined at runtime.

12. A non-transitory machine-readable medium for a computer system, the non-transitory machine-readable medium having stored thereon a series of instructions executable by a processor to dynamically switch between user identities, the series of instructions comprising:

instructions that cause the processor to receive, at a client application, an invocation of a web service, the invocation associated with a first authenticated user identity of a first user;

instructions that cause the processor to identify a second user identity;

instructions that cause the processor to verify that a switch from the first authenticated user identity to the second user identity is permitted by one or more switching rules;

instructions that cause the processor to include the second user identity in a service request when the switch is permitted; and

instructions that cause the processor to communicate the service request to the web service.

13. The machine-readable medium of claim 12, wherein the instructions that cause the processor to identify the second user identity comprises instructions that cause the processor to dynamically determine the second user identity at runtime.

14. The machine-readable medium of claim 13, wherein the one or more switching rules comprise associations between initial user identities and permitted user identities, and

the instructions that cause the processor to verify that a switch is permitted comprise instructions that cause the processor to search the associations for an entry having an initial user identity that matches the first authenticated user identity and a new user identity that matches the second user identity,

wherein the switch is permitted when the entry is found in the associations.

15. The machine-readable medium of claim 12, wherein the instructions that cause the processor to identify the second user identity comprise instructions that cause the processor to determine the second user identity based upon the one or more switching rules.

16. The machine-readable medium of claim 15, wherein the one or more switching rules comprise one or more associations between initial user identities and permitted user identities, and

the instructions that cause the processor to verify that a switch is permitted comprises the instructions that cause the processor to search the associations for an entry having an initial user identity that matches the first authenticated user identity,

wherein the switch is permitted when the entry is found in the associations, and

the second user identity is based upon a new user identity associated with the entry having the initial user identity that matches the first user identity.

17. The machine-readable medium of claim 12, wherein the instructions that cause the processor to include the second user identity in the service request include instructions that cause the processor to store the second user identity in a subject field of the service request.

18. The machine-readable medium of claim 12, wherein invocation by the second user is permitted when one or more attributes of the rule match corresponding values determined at runtime.

19. The machine-readable medium of claim 12, wherein a first rule of the one or more switching rules comprises a permitted application, a permitted initial identity, and a permitted new identity, and the instructions that cause the processor to verify that a switch is permitted comprise:

instructions that cause the processor to compare the permitted application to the client application,

instructions that cause the processor to compare the permitted initial identity to the identity of the first user, and

instructions that cause the processor to compare the permitted new identity to the identity of the second user,

wherein the invocation by the second user is permitted when the permitted application matches the client application, the permitted initial identity matches the identity of the first user, and the permitted new identity matches the identity of the second user.

20. A system for dynamically switching between user identities, the system comprising:

a processor configured to;

receive, at a client application, an invocation of a web service, the invocation associated with a first authenticated user identity of a first user;

identify a second user identity;

verify that a switch from the first authenticated user identity to the second user identity is permitted by one or more switching rules;

include the second user identity in a service request when the switch is permitted; and

communicate the service request to the web service.