Enterprise Application Session Control and Monitoring in a Large Distributed Environment

• US 20140137186A1
• Filed: 11/12/2012
• Published: 05/15/2014
• Est. Priority Date: 11/12/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Greenlee, Gordan G., McCarty, Richard J.
• Granted Patent: US 8,990,893 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Mechanisms are provided for performing centralized control of application sessions across a distributed computing environment comprising a plurality of application servers. A request to perform an application session control operation to control the application sessions associated with a specified user account identifier across the plurality of application servers in the distributed computing environment is received. A plurality of application instances upon which to perform the requested application session control operation are identified. An application session control request is transmitted to a plurality of session control clients associated with the application instances on the plurality of application servers of the distributed computing environment. The application session control request causes each session control client to control a user'"'"'s ability to use the application sessions of application instances, associated with the session control client, that are associated with the specified user account identifier, to access the associated application instances.

Claims

1. A method, in a data processing system, for performing centralized control of application sessions across a distributed computing environment comprising a plurality of application servers, comprising:

receiving, in the data processing system, a request to perform an application session control operation to control the application sessions associated with a specified user account identifier across the plurality of application servers in the distributed computing environment, wherein the application session control operation is an operation to control a user'"'"'s ability to use the application sessions to access associated application instances;

identifying, by the data processing system, a plurality of application instances upon which to perform the requested application session control operation; and

transmitting, by the data processing system, an application session control request to a plurality of session control clients associated with the application instances, on the plurality of application servers of the distributed computing environment, wherein the application session control request causes each session control client, in the plurality of session control clients, to control a user'"'"'s ability to use the application sessions of application instances, associated with the session control client, that are associated with the specified user account identifier, to access the associated application instances.

2. The method of claim 1, wherein the application session control operation is an application session de-provisioning operation, and wherein the session control clients terminate application sessions associated with the specified user account identifier in response to receiving the application session control request.

3. The method of claim 1, wherein the application session control operation is an application session dynamic modification operation for dynamically modifying end-user application requests and/or responses transmitted across application sessions associated with the specified user account identifier.

4. The method of claim 3, wherein the application session dynamic modification operation is one of a redirect operation for redirecting a user submitted request to an alternative website or web page instead of servicing a user submitted request, a blocking operation to block a client computing device address or individual user identifier from utilizing the application sessions, or a customized response operation for sending a customized response to a user submitted request on the application sessions.

5. The method of claim 1, wherein identifying the plurality of application instances upon which to perform the requested application session control operation comprises performing a lookup operation in an application registry of the data processing system to identify entries corresponding to application instances upon which the application session control operation is to be performed.

6. The method of claim 5, wherein entries in the application registry provide an address for a corresponding application instance and associated capabilities data specifying the types of application session control operations that may be performed on application sessions associated with the corresponding application instance.

7. The method of claim 6, wherein the plurality of application instances are identified as application instances having entries in the application registry with capabilities data specifying a type of application session control operation that may be performed that matches the requested application session control operation.

8. The method of claim 1, wherein each session control client of the session control clients of the application servers control agents associated with application instances on the application server associated with the session control client to perform the requested application session control operation.

9. The method of claim 8, wherein the agents are plugin modules to the application instances on the application server associated with the session control client.

10. The method of claim 1, further comprising:

receiving results notifications from the session control clients; and

generating an output to a system administrator computing device based on the results notifications received from the session control clients.

11. The method of claim 1, wherein the data processing system is a centralized enterprise session services computing device that performs centralized control of application sessions across the plurality of application servers in the distributed computing environment.

12. The method of claim 1, wherein the method is implemented in response to a revocation of access rights of the specified user account identifier in an enterprise user account registry.

13. A computer program product comprising a computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a computing device, causes the computing device to:

receive a request to perform an application session control operation to control application sessions associated with a specified user account identifier across a plurality of application servers in a distributed computing environment, wherein the application session control operation is an operation to control a user'"'"'s ability to use the application sessions to access associated application instances;

identify a plurality of application instances upon which to perform the requested application session control operation; and

transmit an application session control request to a plurality of session control clients associated with the application instances, on the plurality of application servers of the distributed computing environment, wherein the application session control request causes each session control client, in the plurality of session control clients, to control a user'"'"'s ability to use the application sessions of application instances, associated with the session control client, that are associated with the specified user account identifier, to access the associated application instances.

14. The computer program product of claim 13, wherein the application session control operation is an application session de-provisioning operation, and wherein the session control clients terminate application sessions associated with the specified user account identifier in response to receiving the application session control request.

15. The computer program product of claim 13, wherein the application session control operation is an application session dynamic modification operation for dynamically modifying end-user application requests and/or responses transmitted across application sessions associated with the specified user account identifier.

16. The computer program product of claim 15, wherein the application session dynamic modification operation is one of a redirect operation for redirecting a user submitted request to an alternative website or web page instead of servicing a user submitted request, a blocking operation to block a client computing device address or individual user identifier from utilizing the application sessions, or a customized response operation for sending a customized response to a user submitted request on the application sessions.

17. The computer program product of claim 13, wherein identifying the plurality of application instances upon which to perform the requested application session control operation comprises performing a lookup operation in an application registry of the data processing system to identify entries corresponding to application instances upon which the application session control operation is to be performed.

18. The computer program product of claim 17, wherein entries in the application registry provide an address for a corresponding application instance and associated capabilities data specifying the types of application session control operations that may be performed on application sessions associated with the corresponding application instance.

19. The computer program product of claim 18, wherein the plurality of application instances are identified as application instances having entries in the application registry with capabilities data specifying a type of application session control operation that may be performed that matches the requested application session control operation.

20. The computer program product of claim 13, wherein each session control client of the session control clients of the application servers control agents associated with application instances on the application server associated with the session control client to perform the requested application session control operation.

21. The computer program product of claim 20, wherein the agents are plugin modules to the application instances on the application server associated with the session control client.

22. The computer program product of claim 13, wherein the computer readable program further causes the computing device to:

receive results notifications from the session control clients; and

generate an output to a system administrator computing device based on the results notifications received from the session control clients.

23. The computer program product of claim 13, wherein the computing device is a centralized enterprise session services computing device that performs centralized control of application sessions across the plurality of application servers in the distributed computing environment.

24. The computer program product of claim 13, wherein the computer readable program is executed by the computing device in response to a revocation of access rights of the specified user account identifier in an enterprise user account registry.

25. An apparatus, comprising:

a processor; and

a memory coupled to the processor, wherein the memory comprises instructions which, when executed by the processor, cause the processor to;

receive a request to perform an application session control operation to control application sessions associated with a specified user account identifier across a plurality of application servers in a distributed computing environment, wherein the application session control operation is an operation to control a user'"'"'s ability to use the application sessions to access associated application instances;

identify a plurality of application instances upon which to perform the requested application session control operation; and

transmit an application session control request to a plurality of session control clients associated with the application instances, on the plurality of application servers of the distributed computing environment, wherein the application session control request causes each session control client, in the plurality of session control clients, to control a user'"'"'s ability to use the application sessions of application instances, associated with the session control client, that are associated with the specified user account identifier, to access the associated application instances.