Role-based authorization management framework

• US 7,546,633 B2
• Filed: 10/25/2002
• Issued: 06/09/2009
• Est. Priority Date: 10/25/2002
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Van Dyke, Cliff, McKay, Everett, McPherson, Dave, Garg, Praerit
• Primary Examiner(s): Moise; Emmanuel L
• Assistant Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US10/281,083
• Publication Number:
  US 20040083367A1
• Time in Patent Office: 2,419 Days
• Field of Search: 726/4, 726/1, 713/170
• US Class Current: 726/4
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A role-based authorization management system maintains an authorization policy store that represents user authorizations to perform operations associated with an application. When a user attempts to perform a function associated with an application, the authorization management system verifies that the user is authorized to perform the requested function. The authorization management system also provides an interface for an application administrator to update role-based user authorization policies associated with one or more applications.

Claims

1. A method implemented by an authorization management system to determine, based on data stored in a role-based authorization policy store, whether a user is authorized to perform a requested operation of an application, the method comprising:

receiving an authorization request comprising;

an operation identifier that indicates the requested operation; and

a scope identifier that indicates a scope of the application, wherein;

the scope of the application represents a collection of operations associated with the application;

the collection includes less than all of the operations associated with the application; and

the requested operation is associated with the indicated scope of the application;

identifying in the authorization policy store, an application object that represents the application, wherein the authorization policy store comprises an object-based hierarchical data structure, comprising;

an application object that represents the application;

an application group object that represents a group of users;

a scope object that represents a collection of objects that together represent a portion, less than the whole, of the application;

an operation object that represents a particular operation available in the application;

a task object that represents a collection of operations available in the application; and

a role object that represents a relationship between users and operations;

wherein;

an application group object is not a parent object to any other objects;

a task object is not a parent object to any other objects; and

a role object is not a parent object to any other objects;

identifying, in the authorization policy store, a scope object that, according to the object-based hierarchical data structure, is a child object of the application object and that represents the scope of the application indicated by the scope identifier;

identifying a role object that, according to the object-based hierarchical data structure, is a child object of the scope object, wherein the role object comprises a members attribute that identifies one or more entities that are members of the role;

determining whether the user is represented by any one of the one or more entities that are members of the role;

in an event that the user is represented by at least one of the one or more entities that are members of the role, determining that the user is authorized to perform the requested operation of the application; and

in an event that the user is not represented by at least one of the one or more entities that are members of the role, determining that the user is not authorized to perform the requested operation of the application.

2. The method as recited in claim 1, further comprising returning a user authorization notification in response to the authorization request, wherein the user authorization notification comprises a list of authorized application operations.

3. The method as recited in claim 1, further comprising returning a user authorization notification in response to the authorization request, wherein the user authorization notification comprises one or more authorization pairs, each authorization pair comprising an indicator of an operation and an indicator of whether or not the user is authorized to have access to the operation.

4. A method as recited in claim 1 wherein the authorization request further comprises an operations array that includes one or more operation identifiers, each of the one or more operation identifiers indicating a particular application operation for which authorization is being requested, wherein the operation identifier that indicates the requested operation is one of the one or more operations identifiers included in the operations array.

5. A method as recited in claim 4, wherein the authorization request further comprises a scope array that includes one or more scope identifiers, each of the one or more scope identifiers indicating a particular application scope with which at least one of the particular application operations for which authorization is being requested is associated, wherein the scope identifier that indicates the scope of the application is one of the one or more scope identifiers included in the scope array.

6. A method as recited in claim 1, wherein:

the members attribute of the role object identifies an application group object; and

determining whether the user is represented by any one of the one or more entities that are members of the role comprises determining whether the user is represented by the application group object.

7. The method as recited in claim 6, wherein determining whether the user is represented by the application group object comprises evaluating a statically defined members attribute associated with the application group object, wherein the members attribute indicates one or more users that are members of the application group.

8. The method as recited in claim 6, wherein determining whether the user is represented by the application group object comprises evaluating a statically defined non-members attribute associated with the application group object, wherein the non-members attribute indicates one or more users that are to be excluded from the application group.

9. The method as recited in claim 6, wherein determining whether the user is represented by the application group object comprises evaluating a lightweight directory access protocol (LDAP) query of user attributes.

10. An authorization management system comprising:

an authorization policy store comprising a hierarchical structure of authorization objects, wherein;

the hierarchical structure of authorization objects represents role-based user permissions associated with one or more applications; and

each of the authorization objects is selected from a group of authorization objects comprising;

an authorization store object that is a root object of the hierarchical structure and represents the authorization policy store;

an application object that is a child object of the authorization store object and represents a particular application;

an application group object that represents a group of users;

a scope object that represents a collection of authorization objects that together represent a portion, less than the whole, of a particular application;

an operation object that represents a particular operation available in a particular application;

a task object that represents a collection of operations available in a particular application; and

a role object that represents a relationship between users and operations, wherein the role object comprises;

a members attribute that identifies one or more users;

an operations attribute that references one or more operation objects; and

a task attribute that references one or more task objects;

wherein the role object indicates that users identified in the members attribute are;

 

authorized to access operations represented by operation objects identified in the operations attribute and

 

authorized to access operations represented by task objects identified in the tasks attribute;

wherein;

an application group object is a child object of an authorization store object, an application object, or a scope object;

an application group object is not a parent object to any other objects;

a scope object is a child object of an application object or another scope object;

an operation object is a child object of an application object;

a task object is a child of an application object or a scope object;

a task object is not a parent object to any other objects;

a role object is a child object of an application object, or a scope object;

a role object is not a parent object to any other objects; and

an authorization interface that provides a mechanism for a particular one of the one or more applications to access the authorization management system to verify the role-based user permissions.

11. The authorization management system as recited in claim 10, further comprising:

an authorization manager that provides a mechanism for creating, modifying, or deleting the role-based user permissions.

12. The system as recited in claim 10 wherein the authorization interface comprises:

an authorization store class that is defined in terms of methods that enable initialization of an authorization store represented by a particular authorization store object; and

at least one application class that is defined in terms of methods that enable access to authorization objects that are associated with the particular application via a particular application object.

13. The system as recited in claim 12 wherein the authorization interface further comprises:

at least one class selected from a group of classes comprising;

an operation class that is defined in terms of methods that enable access to operation objects;

a task class that is defined in terms of methods that enable access to task objects;

a scope class that is defined in terms of methods that enable access to scope objects;

an application group class that is defined in terms of methods that enable access to application group objects;

a role class that is defined in terms of methods that enable access to role objects; and

a client context class that is defined in terms of methods that enable maintenance of a representation of a particular user.

14. The authorization management system as recited in claim 10, wherein the task object comprises one or more attributes selected from a group of attributes comprising:

an operations attribute that specifies a list of one or more operations that a user is granted access to perform when the user is granted access to perform the task;

a tasks attribute that specifies a list of one or more other tasks that a user is granted access to perform when the user is granted access to perform the task; and

a business rule attribute that stores text of a script to implement a business rule, thereby enabling a dynamic condition to be associated with the task.

15. The authorization management system as recited in claim 10, wherein the application group object comprises one or more attributes selected from a group of attributes comprising:

a members attribute that specifies a static list of users and/or groups that are members of the application group represented by the application group object;

a non-members attribute that specifies a static list of users and/or groups that are not members of the application group represented by the application group object; and

an LDAP query attribute that stores a Lightweight Directory Access Protocol (LDAP) query used to determine whether or not a particular user is a member of the application group represented by the application group object.

16. A system comprising:

means for storing hierarchically related data objects that represent a role based user authorization policy, the hierarchically related data objects comprising;

an application object that represents an application;

an application group object that represents a group of users;

a scope object that represents a collection of objects that together represent a portion, less than the whole, of the application;

an operation object that represents a particular operation available in the application;

a task object that represents a collection of operations available in the application; and

a role object that represents a relationship between users and operations;

wherein;

an application group object is not a parent object to any other objects;

a task object is not a parent object to any other objects; and

a role object is not a parent object to any other objects;

means for receiving from an application, an indication of a client request to perform an application operation; and

means for verifying that the client is authorized to perform the application operation based on the authorization policy by;

determining an application scope associated with the client request, wherein the application scope comprises a portion, less than the whole, of the application;

subsequent to determining the application scope, determining a role associated with the application scope that was determined; and

subsequent to determining the role associated with the application scope that was determined, determining whether the client is identified as a member of the role.

17. The system as recited in claim 16, further comprising:

means for modifying the related data objects to represent changes in the authorization policy.

18. One or more computer storage media encoded with instructions that, when executed, direct a computing system to perform a method, the method comprising:

receiving an indication of a user request to perform an operation associated with an application, wherein the user request is from a user of the application; and

accessing a role-based authorization policy to;

determine an application scope associated with the user request, wherein the application scope comprises a portion, less than the whole, of the application;

subsequent to determining the application scope, determine a role associated with the application scope that was determined; and

subsequent to determining the role associated with the application scope that was determined, determine whether the user is identified as a member of the role;

wherein the role-based authorization policy comprises a hierarchical data structure comprising;

an application object that represents the application;

an application group object that represents a group of users;

a scope object that represents a collection of objects that together represent a portion, less than the whole, of the application;

a task object that represents a collection of operations available in the application; and

a role object that represents a relationship between users and operations;

wherein;

an application group object is not a parent object to any other objects;

a task object is not a parent object to any other objects; and

a role object is not a parent object to any other objects.