Specializing support for a federation relationship

• US 7,562,382 B2
• Filed: 12/16/2004
• Issued: 07/14/2009
• Est. Priority Date: 12/16/2004
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Wardrop, Patrick Ryan, Milman, Ivan Matthew, Hinton, Heather Maria, Falola, Dolapo Martin, Moran, Anthony Scott
• Primary Examiner(s): Moazzami; Nasser G
• Assistant Examiner(s): Abedin; Shanto M
• Application Number:
  US11/014,553
• Publication Number:
  US 20060136990A1
• Time in Patent Office: 1,671 Days
• Field of Search: 726/2, 726/5, 726/8, 726/12, 726/26, 726/27, 713/168, 713/186, 709/223, 709/225, 709/229, 709/255
• US Class Current: 726/2
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 67/30 Profiles

Abstract

The invention provides federated functionality within a data processing system by means of a set of specialized runtimes. Each of the plurality of specialized runtimes provides requested federation services for selected ones of the requestors according to configuration data of respective federation relationships of the requestors with the identity provider. The configuration data is dynamically retrieved during initialization of the runtimes which allows the respective runtime to be specialized for a given federation relationship. Requests are routed to the appropriate specialized runtime using the first requestor identity and the given federation relationship. The data which describes each federation relationship between the identity provider and each of the plurality of requesters is configured prior to initialization of the runtimes. Configuration data is structured into global specified data, federation relationship data and requestor specific data to minimize data change, making the addition or deletion of requestors very scalable.

Claims

1. A method for providing federated functionality within a data processing system, the method comprising:

defining configuration data wherein the configuration data describes a federation relationship between an identity provider and a plurality of requestors;

configuring federation relationship data which is specific to a first specialized runtime, wherein identity provider configuration data is overridden by the configured federation relationship data;

receiving a first request having first runtime parameters at a first computing system for access to federation services from the identity provider, wherein the first request is made by a first requestor in the plurality of requestors;

examining the first request to determine the configuration data identified by the runtime parameters;

invoking an application using the configuration data identified by the runtime parameters, wherein the configuration data is dynamically retrieved during invocation of the application;

instantiating the first specialized runtime using the first runtime parameters at the first computing system for the first request, wherein the first specialized runtime provides requested federation services for the first requestor according to the configuration data, wherein the configuration data is dynamically retrieved during instantiating of the first specialized runtime; and

providing the requested federation services using the first specialized runtime.

2. The method of claim 1 wherein the first specialized runtime also provides federation services to a second requestor, in the plurality of requestors, wherein the second requestor is authenticated according to the configuration data of the federation relationship between the second requestor and the identity provider.

3. The method of claim 2 further comprising instantiating a second specialized runtime which provides federation services to a third requestor, in the plurality of requestors, wherein the third requestor is authenticated according to the configuration data of the federation relationship between the third requestor and the identity provider, and wherein the federation services provided by the first and second specialized runtimes are identical.

4. The method of claim 1 wherein the defining configuration data step further comprises the step of configuring global specified data which is common to all federation relationships with the identity provider.

5. The method of claim 1 wherein the defining configuration data step further comprises the step of configuring specific data for each requestor in the plurality of requestors.

6. The method of claim 5 wherein global identity provider default configuration data or federation relationship data is overridden by the configured specific data for each requestor in the plurality of requestors.

7. A computer program product comprising a computer readable storage medium storing executable instructions for:

defining configuration data wherein the configuration data describes a federation relationship between an identity provider and a plurality of requestors;

configuring federation relationship data which is specific to a first specialized runtime, wherein identity provider configuration data is overridden by the configured federation relationship data;

receiving a first request having first runtime parameters at a first computing system for access to federation services from the identity provider, wherein the first request is made by a first requestor in the plurality of requestors;

examining the first request to determine the configuration data identified by the runtime parameters;

invoking an application using the configuration data identified by the runtime parameters, wherein the configuration data is dynamically retrieved during invocation of the application;

instantiating the first specialized runtime using the first runtime parameters at the first computing system for the first request, wherein the first specialized runtime provides requested federation services for the first requestor according to the configuration data, wherein the configuration data is dynamically retrieved during instantiating of the first specialized runtime; and

providing the requested federation services using the first specialized runtime.

8. The computer program product of claim 7 wherein the first specialized runtime also provides federation services to a second requestor, in the plurality of requestors, wherein the second requestor is authenticated according to the configuration data of the federation relationship between the second requestor and the identity provider.

9. The computer program product of claim 8 further comprising instructions for instantiating a second specialized runtime which provides federation services to a third requestor, in the plurality of requestors, wherein the third requestor is authenticated according to the configuration data of the federation relationship between the third requestor and the identity provider, and wherein the federation services provided by the first and second specialized runtimes are identical.

10. The computer program product of claim 7 further comprising instructions for configuring global specified data which is common to all federation relationships with the identity provider.

11. The computer program product of claim 7 wherein the instructions for defining configuration data step further comprises instructions for configuring specific data for each requestor in the plurality of requestors.

12. A apparatus for providing federated functionality within a data processing system, the apparatus comprising:

a bus system;

a memory connected to the bus system, wherein the memory includes a set of instructions; and

a processing unit connected to the bus, wherein the processing unit executes the set of instructions to;

define configuration data wherein the configuration data describes a federation relationship between an identity provider and a plurality of requestors;

configure federation relationship data which is specific to a first specialized runtime, wherein identity provider configuration data is overridden by the configured federation relationship data;

receive a first request having first runtime parameters at a first computing system for access to federation services from the identity provider, wherein the first request is made by a first requestor in the plurality of requestors;

to examine the first request to determine the configuration data identified by the runtime parameters;

invoke an application using the configuration data identified by the runtime parameters, wherein the configuration data is dynamically retrieved during invocation of the application;

instantiate the first specialized runtime using the first runtime parameters at the first computing system for the first request, wherein the first specialized runtime provides requested federation services for the first requestor according to the configuration data, wherein the configuration data is dynamically retrieved during instantiating of the first specialized runtime; and

provide the requested federation services using the first specialized runtime.

13. The apparatus of claim 12 wherein the first specialized runtime also provides federation services to a second requestor, in the plurality of requestors, wherein the second requestor is authenticated according to the configuration data of the federation relationship between the second requestor and the identity provider.

14. The apparatus of claim 13 wherein the set of instructions executed by the processor further comprises instantiating a second specialized runtime which provides federation services to a third requestor, in the plurality of requestors, wherein the third requestor is authenticated according to the configuration data of the federation relationship between the third requestor and the identity provider, and wherein the federation services provided by the first and second specialized runtimes are identical.

15. The apparatus of claim 12 wherein the set of instructions executed by the processor further comprises configuring global specified data which is common to all federation relationships with the identity provider.

16. The apparatus of claim 12 wherein the instructions that define configuration data step further comprises instructions for configuring specific data for each requestor in the plurality of requestors.