DYNAMIC IDENTITY SWITCHING

• US 20170041308A1
• Filed: 10/20/2016
• Published: 02/09/2017
• Est. Priority Date: 09/30/2011
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: KAVANTZAS, NICKOLAS, GUO, JIANDONG, GUPTA, PRATIBHA
• Granted Patent: US 10,135,803 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Techniques are disclosed for dynamically switching user identity when generating a web service request by receiving, at a client application, an invocation of a web service, the invocation associated with a first authenticated user identity of a first user, identifying a second user identity, verifying that a switch from the first user identity to the second user identity is permitted by switching rules, including the second user identity in a service request when the switch is permitted, and communicating the service request to the web service. The switching rules can include associations between initial user identities and permitted user identities. Verifying that a switch is permitted can include searching the associations for an entry having an initial user identity that matches the first authenticated user identity and a new user identity that matches the second user identity, wherein the switch is permitted when the entry is found.

Claims

1. A method comprising:

receiving, by a computer system, an invocation by a web application acting as a web service client of a web service, the invocation comprising a first property representing a first identity using the web application and a second property representing a second identity declared to be propagateable in web service invocations;

determining, by the computer, a set of one or more switching rules using the first identity and the second identity in the invocation of the web service,

verifying, by the computer system, during runtime that a switch from the first identity to the second identity is permitted by applying the set of one or more switching rules and determining that the web application is a permitted application in accordance with a permission object;

including, by the computer system, the second identity in the second property in a service request to the web service when the switch is permitted;

communicating, by the computer system, the service request to the web service; and

executing, by the web service, a task using the second identity.

2. The method of claim 1, wherein the permission object identifies a trusted application that can be accessed by the second identity.

3. The method of claim 1, wherein the one or more switching rules comprise associations between initial user identities and permitted user identities, and

verifying that a switch is permitted comprises searching, by the computer system, the associations for an entry having an initial user identity that matches the first identity and a new user identity that matches the second identity,

wherein the switch is permitted when the entry is found in the associations.

4. The method of claim 1, wherein including the second identity in the service request comprises storing the second identity in a security token included in the service request.

5. The method of claim 1, wherein invocation by the second identity is permitted when one or more attributes of at least one of the one or more switching rules match corresponding values determined at runtime.

6. The method of claim 1, wherein a first rule of the one or more switching rules comprises the permitted application, a permitted initial identity, and a permitted new identity, and the verifying that a switch is permitted comprises:

comparing the permitted application to a client application that invoked the web service,

comparing the permitted initial identity to the first identity, and

comparing the permitted new identity to the second identity,

wherein the invocation by the second identity is permitted when the permitted application matches the client application, the permitted initial identity matches the first identity, and the permitted new identity matches the second identity.

7. The method of claim 6, wherein the first rule of the one-on-one switching rules comprises a condition based on one or more attributes of the client application, and invocation by the second identity is permitted when the condition is satisfied.

8. The method of claim 7, wherein the condition is further based upon one or more values determined at runtime.

14. The method according to claim 1, wherein the set of one or more switching rules comprises a permitted identity identified in accordance with a permission map.

15. The method according to claim 1, wherein the permission object specifies one or more permitted applications corresponding to one or more permitted identities.

9. A non-transitory machine-readable medium storing a series of instructions executable by a processor of a computer system, the non-transitory computer-readable medium comprising:

instructions that cause the processor to receive an invocation by a web application acting as a web service client of a web service, the invocation comprising a first property representing a first identity of using the web application and a second property representing a second identity declared to be propagateable in web service invocations;

instructions that cause the processor to determine a set of one or more switching rules using the first identity and the second identity in the invocation of the web service;

instructions that cause the processor to verify during runtime that a switch from the first identity to the second identity is permitted by applying the set of one or more switching rules and determining that the web application is a permitted application in accordance with a permission object;

instructions that cause the processor to the second identity in the second property in a service request to the web service when the switch is permitted;

instructions that cause the processor to communicate the service request to the web service; and

instructions that cause the web service to execute a task using the second identity.

10. The machine-readable medium of claim 9, wherein the one or more switching rules comprise associations between initial identities and permitted identities, and

the instructions that cause the processor to verify that a switch is permitted comprise instructions that cause the processor to search the associations for an entry having an initial identity that matches the first identity and a new identity that matches the second identity,

wherein the switch is permitted when the entry is found in the associations.

11. The machine-readable medium of claim 9, wherein invocation by the second entity is permitted when one or more attributes of the rule match corresponding values determined at runtime.

12. The machine-readable medium of claim 9, wherein a first rule of the one or more switching rules comprises the permitted application, a permitted initial identity, and a permitted new identity, and the instructions that cause the processor to verify that a switch is permitted comprise:

instructions that cause the processor to compare the permitted application to the client application,

instructions that cause the processor to compare the permitted initial identity to the first identity, and

instructions that cause the processor to compare the permitted new identity to the second identity,

wherein the invocation by the second identity is permitted when the permitted application matches the client application, the permitted initial identity matches the identity of the first entity, and the permitted new identity matches the second identity.

13. A system for dynamically switching between identities of different entities to request web services, the system comprising:

a hardware processor; and

a non-transitory memory configured to store a set of instructions which when executed by the processor configured the processor to;

receive an invocation by a web application acting as a web service client of a web service, the invocation comprising a first property representing a first identity using the web application and a second property representing a second identity declared to be propagateable in web service invocations;

determine a set of one or more switching rules using the first identity and the second identity in the invocation of the web service;

verify during runtime that a switch from the first identity to the second identity is permitted by applying the set of one or more switching rules and determining that the web application is a permitted application in accordance with a permission object;

include the second identity in the second property in a service request to the web service when the switch is permitted; and

communicate the service request to the web service; and

execute, by the web service, a task using the second identity.