Delegated administration of a hosted resource

• US 7,827,595 B2
• Filed: 08/28/2003
• Issued: 11/02/2010
• Est. Priority Date: 08/28/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Gociman, Ciprian
• Primary Examiner(s): Abrishamkar, Kaveh
• Application Number:
  US10/650,891
• Publication Number:
  US 20050050354A1
• Time in Patent Office: 2,623 Days
• Field of Search: None
• US Class Current: 726/4
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

Systems and methods for delegating access to resources hosted in a distributed computing environment are described. In one aspect, a server hosts a set of resources. The server receives a request from a user to perform an operation with respect to one of the hosted resources. Responsive to receiving the request, the server determines whether the user has already been delegated authority to perform the operation. The delegated authority is independent of whether the user is a member of an administrators group associated with any resource of the server.

Claims

1. A method for use by a server coupled to one or more client devices in a distributed computing environment, the method comprising:

hosting a set of resources;

receiving a request for a client user to perform an operation on a resource of the resources, the request being received by an application hosted by the server and the operation being associated with modification of content or functionality of the resource;

determining whether to authorize the operation as a function of whether the client user has been delegated administrative authority by a server administrator to perform the operation with respect to the resource, the administrative authority being independent of whether the client user is a member of an administrators group associated with any resource of the server, and the determining including searching for an entry in a registry that provides a path to a configuration file, the configuration file specifying possible methods that can be performed by a plurality of client users and where the server administrator can add an entry for each of the plurality of client users; and

building an output array and logging the output array to a log file when the request is authorized.

2. A method as recited in claim 1, wherein the determining whether to authorize the operation is performed by a secure delegation administration framework.

3. A method as recited in claim 1, wherein the resource is represented as an Internet Information Service (IIS) metabase node.

4. A method as recited in claim 1, wherein the request comprises a scope associated with the client user, and a name of a method associated with the operation.

5. A method as recited in claim 1, wherein the resource is a Web site hosted by an Internet Service Provider (ISP), and wherein the client user is not authorized to perform administrative activities on any resources associated with the ISP except by sending the request to the ISP for permission evaluation by the secure delegation administration framework.

6. A method as recited in claim 1, wherein the request further comprises an indication of whether the client user desires to execute the operation via a dynamically built command line or via an executable object already associated with the operation.

7. A method as recited in claim 1, wherein the request further comprises an indication of whether the client user desires to log a result of the operation.

8. A method as recited in claim 1, wherein the secure delegation administration framework is secure at least because it does not allow the client user access to a mapping of user role-based permission to perform the operation directed to the resource.

9. A method as recited in claim 1, wherein the method further comprises:

installing the application on the server;

identifying a set of operations that the application can perform;

mapping the operations to a set of security permissions based on authorization specific role(s) of a set of users comprising the client user; and

wherein determining further comprises the application utilizing the mapping to identify whether the client user has permission to perform the operation.

10. A method as recited in claim 1, wherein the method further comprises:

specifying role-based user access permissions to nodes of an Internet Information Services (IIS) metabase identifying the resources;

indicating an interface to a task, the interface comprising a set of parameters and a name, the task comprising the operation; and

wherein determining further comprises;

locating the interface in the configuration file;

responsive to locating the interface, presenting an identity of the client user to the resource to evaluate a scope in view of the parameters and the name and the resource; and

responsive to the presenting, identifying whether the client user has been delegated a role-based access permission to perform the operation with respect to the resource.

11. A method as recited in claim 1, wherein responsive to determining that the client user has been delegated authority to perform the operation with respect to the resource, the method further comprises:

setting parameters associated with the operation; and

executing the operation within a scope associated with the client user.

12. A computer-readable medium for use in a distributed computing environment including a server and one or more client computing devices coupled to the server, the computer-readable medium comprising computer-executable instructions that, when executed, cause one or more processors to perform acts including:

hosting a set of resources, a particular resource of the resources allowing a client user to determine whether the client user has delegated authority to access a resource of the resources;

receiving a request from the client user to perform an operation on the resource, the operation being associated with modification of content or functionality of the resource;

determining whether to authorize the operation as a function of whether the client user has been delegated a role-based scope of authority by a server administrator to perform the operation, the role-based scope of authority not requiring the client user to be a member of an administrators group associated with any resources of the server, and the determining including searching for an entry in a registry that provides a path to a configuration file, the configuration file specifying possible methods that can be performed by a plurality of client users and where the server administrator can add an entry for each of the plurality of client users; and

building an output array and logging the output array to a log file when the request is authorized.

13. A computer-readable medium as recited in claim 12, wherein the resource is represented as an Internet Information Service (IIS) metabase node.

14. A computer-readable medium as recited in claim 12, wherein the request comprises a scope associated with the client user, and a name of a method associated with the operation.

15. A computer-readable medium as recited in claim 12, wherein the resource is a Web site hosted by an Internet Service Provider (ISP), and wherein the client user is not a member of the administrators group.

16. A computer-readable medium as recited in claim 12, wherein the request further comprises an indication of whether the operation is to be executed via a dynamically built command line or via an executable object already associated with the operation.

17. A computer-readable medium as recited in claim 12, wherein operations associated with determining whether to authorize the operations are secure at least because the client user does not have access to user role-based permission(s) to perform the operation.

18. A computer-readable medium as recited in claim 12, wherein the computer-executable instructions comprise instructions that cause the one or more processors to perform acts further including:

identifying a set of operations associated with the resource;

mapping the operations to a set of security permissions, the security permissions being based on authorization specific role(s) of a set of users comprising the client user; and

wherein the instructions for determining further comprise instructions for utilizing the mapping to identify whether the client user has permission to perform the operation.

19. A computer-readable medium as recited in claim 12, wherein the computer-executable instructions comprise instructions that cause the one or more processors to perform acts further including:

securely specifying role-based user access permissions to nodes of an Internet Information Services (IIS) metabase identifying the resources;

indicating an interface to a task, the interface comprising a set of parameters and a name, the task comprising the operation; and

wherein the computer-executable instructions for determining further comprise instructions for;

locating the interface in the configuration file;

responsive to locating the interface, presenting an identity of the client user to the resource to evaluate a scope in view of the parameters and the name and the resource; and

responsive to the presenting, identifying whether the client user has been delegated a role-based access permission to perform the operation with respect to the resource.

20. A computer-readable medium as recited in claim 12, wherein the computer-executable instructions, responsive to determining that the client user has been delegated authority to perform the operation with respect to the resource, comprise instructions that cause the one or more processors to perform acts further including:

setting parameters associated with the operation; and

executing the operation within a scope associated with the client user.

21. A server for use in a distributed computing environment including the server and one or more client computing devices coupled to the server, the server comprising:

one or more processors; and

a memory coupled to the one or more processors, the memory comprising computer-executable instructions that cause the one or more processors to perform acts including;

hosting a set of resources;

receiving a request from a client user to perform an operation on a resource of the resources, the resource of the resources being associated with modification of content or functionality of the resource of the resources;

determining whether to authorize the operation as a function of whether the client user has been delegated a role-based scope of authority by a server administrator to perform the operation, the role-based scope of authority not requiring the client user to be a member of an administrators group associated with resources of the server, and the determining including searching for an entry in a registry that provides a path to a configuration file, the configuration file specifying possible methods that can be performed by a plurality of client users and where the server administrator can add an entry for each of the plurality of client users; and

building an output array and logging the output array to a log file when the request is authorized.

22. A server as recited in claim 21, wherein the request is generated by at least one resource of the resources.

23. A server as recited in claim 21, wherein the resource is represented as an Internet Information Service (IIS) metabase node.

24. A server as recited in claim 21, wherein the request comprises a scope associated with the client user, a name of a method associated with the operation.

25. A server as recited in claim 21, wherein the resource is a Web site hosted by an Internet Service Provider (ISP), and wherein the client user is not a member of the administrators group.

26. A server as recited in claim 21, wherein the request further comprises an indication of whether the operation is to be executed via a dynamically built command line or via an executable object already associated with the operation.

27. A server as recited in claim 21, wherein the secure delegation administration framework is secure at least because it does not allow the client user access to a mapping of user role-based permission to perform the operation directed to the resource.

28. A server as recited in claim 21, wherein the computer-executable instructions comprise instructions that cause the one or more processors to perform acts further including:

identifying a set of operations associated with the resource;

mapping the operations to a set of security permissions based on authorization specific role(s) of a set of users comprising the client user; and

wherein the instructions for determining further comprise instructions for utilizing the mapping to identify whether the client user has permission to perform the operation.

29. A server as recited in claim 21, wherein the computer-executable instructions comprise instructions that cause the one or more processors to perform acts further including:

securely specifying role-based user access permissions to nodes of an Internet Information Services (IIS) metabase, the nodes identifying the resources;

indicating an interface to a task, the interface comprising a set of parameters and a name, the task comprising the operation; and

wherein the computer-executable instructions for determining further comprise instructions for;

locating the interface in the configuration file;

responsive to locating the interface, presenting an identity of the client user to the resource to evaluate a scope in view of the parameters and the name and the resource; and

responsive to the presenting, identifying whether the client user has been delegated a role-based access permission to perform the operation with respect to the resource.

30. A server as recited in claim 21, wherein the computer-executable instructions, responsive to determining that the client user has been delegated authority to perform the operation with respect to the resource, comprise instructions that cause the one or more processors to perform acts further including:

setting parameters associated with the operation; and

executing the operation within a scope associated with the client user.

31. A server, comprising:

means for hosting a set of resources;

means for receiving a request from a client user to perform an operation on a resource of the resources, the operation being associated with modification of content or functionality of the resource;

means for determining whether to authorize the operation as a function of whether the client user has been delegated a role-based scope of authority by a server administrator to perform the operation, the role-based scope of authority not requiring the client user to be a member of an administrators group associated with the server, and the means for determining including searching for an entry in a registry that provides a path to a configuration file, the configuration file specifying possible methods that can be performed by a plurality of client users and where the server administrator can add an entry for each of the plurality of client users; and

means for building an output array and logging the output array to a log file when the request is authorized.

32. A server as recited in claim 31, wherein the resource is an Internet Information Service (IIS) metabase node.

33. A server as recited in claim 31, wherein the resource is a Web site hosted by an Internet Service Provider (ISP), and wherein the client user is not a member of the administrators group.

34. A server as recited in claim 31, wherein responsive to determining that the client user has been delegated authority to perform the operation with respect to the resource, the server further comprises:

means for setting parameters associated with the operation; and

means for executing the operation within a scope associated with the client user.