Method and system for server support for pluggable authorization systems
First Claim
Patent Images
1. A method for authorizing access to a protected resource within a data processing system, the method comprising:
- intercepting a remote procedure call for a remote routine of a Distributed Computing Environment (DCE) authorization service by an authorization plug-in associated with a second authorization service, wherein the authorization plug-in exports remote procedure call endpoints for the remote routines of the DCE authorization service, and wherein the second authorization service supports a standard-compliant authorization application programming interface;
processing the authorization request in the authorization plug-in by calling application programming interfaces of the second authorization service;
recompiling or relinking a target application representing one or more protected resources to include program instructions from the authorization plug-in;
directing calls within the target application to application programming interfaces of the DCE authorization service to be executed by the program instructions from the authorization plug-in;
accepting a call in the authorization plug-in to a “
dce_acl_is_client_authorized”
application programming interface;
authenticating the authorization credentials passed by the initiator to the target application;
retrieving the privilege attribute certificate from the DCE EPAC structure;
mapping a DCE Access Control List (ACL) manager Universally Unique Identifier (UUID) from the DCE EPAC structure to a resource manager in the second authorization service;
mapping DCE ACL UUID from the DCE EPAC structure to a resource managed by the second authorization service;
mapping the DCE permission set from the DCE EPAC structure to a permission set of the second authorization service;
calling an application programming interface of the second authorization service to make an authorization decision based on the permission set of the second authorization service, the privilege attribute certificate, the resource, and the resource manager; and
returning an indication of the authorization decision to the target application.
3 Assignments
0 Petitions
Accused Products
Abstract
A method, system, apparatus, and computer program product is presented for plugging in a standard authorization system in a manner such that legacy applications can use the authorization APIs and backend remote interfaces of a legacy authorization system. When a legacy application makes a call intended for a routine within the legacy authorization system, the call is redirected to make the appropriate calls to the APIs of the standard authorization system.
-
Citations
8 Claims
-
1. A method for authorizing access to a protected resource within a data processing system, the method comprising:
-
intercepting a remote procedure call for a remote routine of a Distributed Computing Environment (DCE) authorization service by an authorization plug-in associated with a second authorization service, wherein the authorization plug-in exports remote procedure call endpoints for the remote routines of the DCE authorization service, and wherein the second authorization service supports a standard-compliant authorization application programming interface; processing the authorization request in the authorization plug-in by calling application programming interfaces of the second authorization service; recompiling or relinking a target application representing one or more protected resources to include program instructions from the authorization plug-in; directing calls within the target application to application programming interfaces of the DCE authorization service to be executed by the program instructions from the authorization plug-in; accepting a call in the authorization plug-in to a “
dce_acl_is_client_authorized”
application programming interface;authenticating the authorization credentials passed by the initiator to the target application; retrieving the privilege attribute certificate from the DCE EPAC structure; mapping a DCE Access Control List (ACL) manager Universally Unique Identifier (UUID) from the DCE EPAC structure to a resource manager in the second authorization service; mapping DCE ACL UUID from the DCE EPAC structure to a resource managed by the second authorization service; mapping the DCE permission set from the DCE EPAC structure to a permission set of the second authorization service; calling an application programming interface of the second authorization service to make an authorization decision based on the permission set of the second authorization service, the privilege attribute certificate, the resource, and the resource manager; and
returning an indication of the authorization decision to the target application. - View Dependent Claims (2, 3, 4)
-
-
5. An apparatus for authorizing access to a protected resource within a data processing system, the apparatus comprising:
-
first intercepting means for intercepting a remote procedure call for a remote routine of a Distributed Computing Environment (DCE) authorization service by an authorization plug-in associated with a second authorization service, wherein the authorization plug-in exports remote procedure call endpoints for the remote routines of the DCE authorization service, and wherein the second authorization service supports a standard-compliant authorization application programming interface; processing means for processing the authorization request in the authorization plug-in by calling application programming interfaces of the second authorization service; modifying means for recompiling or reliniking a target application representing one or more protected resources to include program instructions from the authorization plug-in; and directing means for directing calls within the target application to application programming interfaces of the DCE authorization service to be executed by the program instructions from the authorization plug-in; accepting means for accepting a call in the authorization plug-in to a “
dce_acl_is_client_authorized”
application programming interface; andauthenticating means for authenticating the authorization credentials passed by the initiator to the target application; second retrieving means for retrieving the privilege attribute certificate from the DCE EPAC structure; first mapping means for mapping a DCE Access Control List (ACL) manager Universally Unique Identifier (UUID) from the DCE EPAC structure to a resource manager in the second authorization service; second mapping means for mapping DCE ACL UUID from the DCE EPAC structure to a resource managed by the second authorization service; third mapping means for mapping the DCE permission set from the DCE EPAC structure to a permission set of the second authorization service; calling means for calling an application programming interface of the second authorization service to make an authorization decision based on the permission set of the second authorization service, the privilege attribute certificate, the resource, and the resource manager; and third returning means for returning an indication of the authorization decision to the target application. - View Dependent Claims (6, 7, 8)
-
Specification