System and method for ensuring security with multiple authentication schemes

• US 8,001,611 B2
• Filed: 10/18/2007
• Issued: 08/16/2011
• Est. Priority Date: 04/23/2002
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Nelson, Kenneth Carlin, Noronha, Marilene Araujo
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): YALEW, FIKREMARIAM A
• Application Number:
  US11/975,579
• Publication Number:
  US 20080307520A1
• Time in Patent Office: 1,398 Days
• Field of Search: None
• US Class Current: 726/27
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

System for authenticating a user for logon to a content manager running on top of a database manager. A connect procedure connects the user to a database manager; and then a logon procedure logs on the user to the content manager selectively responsive to the user connecting to the database manager; the user being authenticated by a third party by way of a user exit or a trusted logon environment and privilege; or the user being authenticated by the content manager.

Claims

1. A method for authenticating a user for access to controlled entities maintained at a server, said server including a content management system having a content manager, a database manager, an user application, and user exits, comprising:

maintaining said controlled entities within said content manager, said controlled entities including an access control list table bound to user data items, said access control list table including, in rows, for each user and user group;

user kind, user identifier, access control list code, and privilege set code, each privilege set code corresponding to a privilege set;

said maintaining, responsive to modification of a given privilege set, including incrementally refreshing said access control list table to refresh only those rows having a privilege set code corresponding to said given privilege set;

connecting said user to said database manager; and

logging on said user to said content manager running on top of said database manager to enable access by said user to said user data items, selectively responsive to at least one of;

said user connecting to said database manager;

said user being authenticated by at least one of;

(i) said content manager and (ii) a third party;

a user exit authenticating content manager (CM) indicia of said user; and

database (DB) indicia of said user matching content manager (CM) indicia of said user.

2. The method of claim 1, said user being logged on to said content manager by content manager authentication responsive to said content manager receiving database (DB) user indicia for a DB user having connect privilege and a correct logon password.

3. The method of claim 1, said user being logged on to said content manager by third party authentication responsive to said user exit authenticating said content manager (CM) indicia of said user.

4. The method of claim 1, said user being logged on to said content manager by third party authentication responsive to said content manager receiving database (DB) user indicia for a DB user having connect and trusted logon privileges in a trusted logon system environment.

5. A system for authenticating a user for access to controlled entities maintained at a server, said server including a content management system having a content manager, a database manager, an user application, and user exits, comprising:

one or more computer processors; and

a memory containing a program which, when executed by the one or more computer processors, is configured to perform an operation comprising;

a maintenance procedure for maintaining said controlled entities within said content manager, said controlled entities including an access control list table bound to user data items, said access control list table including, in rows, for each user and user group;

user kind, user identifier, access control list code, and privilege set code, each privilege set code corresponding to a privilege set;

said maintenance procedure, responsive to modification of a given privilege set, for incrementally refreshing said access control list table to refresh only those rows having a privilege set code corresponding to said given privilege set;

a connect procedure for connecting said user to said database manager; and

a logon procedure for logging on said user to said content manager selectively responsive to at least one of;

said user connecting to said database manager;

said user being authenticated by at least one of;

(i) a third party and (ii) said content manager;

a user exit authenticating content manager (CM) indicia of said user; and

database (DB) indicia of said user matching content manager (CM) indicia of said user.

6. The system of claim 5, said user being logged on to said content manager by content manager authentication responsive to said content manager receiving database (DB) user indicia for a DB user having connect privilege and a correct logon password.

7. The system of claim 5, said user being logged on to said content manager by third party authentication responsive to said user exit authenticating said content manager (CM) indicia of said user.

8. The system of claim 5, said user being logged on to said content manager by third party authentication responsive to said content manager receiving database (DB) user indicia for a DB user having connect and trusted logon privileges in a trusted logon system environment.

9. A non-transitory computer readable storage medium containing a program of instructions which, when executed, performs an operation for authorizing access by a user for access to controlled entities maintained at a server, said server including a content management system having a content manager, a database manager, an user application, and user exits, said operation comprising:

maintaining said controlled entities within said content manager, said controlled entities including an access control list table bound to user data items, said access control list table including, in rows, for each user and user group;

user kind, user identifier, access control list code, and privilege set code, each privilege set code corresponding to a privilege set;

said maintaining, responsive to modification of a given privilege set, including incrementally refreshing said access control list table to refresh only those rows having a privilege set code corresponding to said given privilege set;

connecting said user to said database manager; and

logging on said user to said content manager running on top of said database manager to enable access by said user to said user data items, selectively responsive to at least one of;

said user connecting to said database manager;

said user being authenticated by at least one of;

(i) said content manager and (ii) a third party;

a user exit authenticating content manager (CM) indicia of said user; and

database (DB) indicia of said user matching content manager (CM) indicia of said user.

10. The computer readable storage medium of claim 9, said user being logged on to said content manager by content manager authentication responsive to said content manager receiving database (DB) user indicia for a DB user having connect privilege and a correct logon password.

11. The computer readable storage medium of claim 9, said user being logged on to said content manager by third party authentication responsive to said user exit authenticating said content manager (CM) indicia of said user.

12. The computer readable storage medium of claim 9, said user being logged on to said content manager by third party authentication responsive to said content manager receiving database (DB) user indicia for a DB user having connect and trusted logon privileges in a trusted logon system environment.