Security architecture for integration of enterprise information system with J2EE platform

• US 7,089,584 B1
• Filed: 05/24/2000
• Issued: 08/08/2006
• Est. Priority Date: 05/24/2000
• Status: Expired due to Term

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Sharma, Rahul
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): NOBAHAR, ABDULHAKIM
• Application Number:
  US09/578,346
• Time in Patent Office: 2,267 Days
• Field of Search: 713/201, 713/155, 713/167
• US Class Current: 726/4
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

A standard for security management in a client server computer system is disclosed. In one aspect, the present invention specifies a security contract between an application server and a resource adapter, supporting access to an enterprise information system by passing a connection request from the resource adapter to the application server, propagating a a security context from the application server to the resource adapter. The security contract includes a subject class representing a grouping of related information for a single entity, and security-related attributes of the subject class.

Claims

1. A method of providing security in a computer system having a client, an application server, an application component, a resource adapter and a principal mapping module, and a subject instance having the method comprising the steps of:

invoking a connection request method by the application component on the resource adapter without passing in any security arguments;

the resource adapter passes the connection request to the application server via a connection factory;

the application server is configured to use the principal mapping module such that the principal mapping module takes the subject instance with a caller principal and returns the subject instance with a valid resource principal and password credential instance to the application server; and

an enterprise

establishing a managed connection between the application server and the enterprise information system using the valid resource principal and password credential instance generated by the principle mapping module.

2. The method of claim 1, wherein said security includes a security context that contains support for Java authentication and authorization service based pluggable authentication.

3. The method of claim 1, further comprising a generic credential interface.

4. The method of claim 1, further comprising a security principal interface.

5. The method of claim 1, wherein the managed connection includes a security contract data structure including:

a subject class;

a generic credential interface;

a password credential interface; and

a java security principal interface.

6. The method of claim 1, wherein the security is propagated from said application server to the resource adapter.