Propagating user identities in a secure federated search system

• US 8,595,255 B2
• Filed: 05/30/2012
• Issued: 11/26/2013
• Est. Priority Date: 03/01/2006
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Krishnaprasad, Muralidhar, Bhatkar, Sachin, Nimani, Visar, Chang, Thomas, Bhavsar, Meeten
• Primary Examiner(s): PENG, HUAWEN A
• Application Number:
  US13/483,958
• Publication Number:
  US 20120278303A1
• Time in Patent Office: 545 Days
• Field of Search: 707/781
• US Class Current: 707/781
• CPC Class Codes: G06F 16/2452 Query translation
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A flexible and extensible architecture allows for secure searching across an enterprise. Such an architecture can provide a simple Internet-like search experience to users searching secure content inside (and outside) the enterprise. The architecture allows for the crawling and searching of a variety or sources across an enterprise, regardless of whether any of these sources conform to a conventional user role model. The architecture further allows for security attributes to be submitted at query time, for example, in order to provide real-time secure access to enterprise resources. The user query also can be transformed to provide for dynamic querying that provides for a more current result list than can be obtained for static queries.

Claims

1. A method comprising:

receiving a log on request from an end user to a broker search engine instance and issuing a query;

collecting, by the broker search engine instance, the end user'"'"'s security information from an identity management system registered on the broker server engine instance;

collecting, by the broker server engine instance, security attribute values from data sources separately for the logged on end user;

creating, by the broker server engine instance, a security filter based on the information collected from the identity management system and the data sources;

filtering, using the security filter, the end user'"'"'s security information from the identity management system registered on the broker server engine instance with the security attribute values from each of the data sources to create sets of security values corresponding to the security attribute values for the identity management system;

appending, by the broker server engine instance, the sets of security values to the security filter to the end user'"'"'s query to perform a search on local data sources and receive results with a local relevancy algorithm; and

automatically launching a crawl of the data sources using the appended end user'"'"'s query which includes the sets of security values corresponding to the security attribute values for the identity management system to provide access to the data sources, wherein only the data sources which the security attribute values provide access to are returned to the end user as results of the crawl.

2. The method of claim 1, further comprising collecting, by an endpoint instance, the end user'"'"'s security information from the identity management system registered on the endpoint.

3. The method of claim 2, further comprising collecting, by an endpoint instance, the security attribute values from the data sources on the endpoint separately for the end user.

4. The method of claim 3, further comprising creating, by an endpoint instance, a second security filter based on the information collection from the identity management system and the data sources.

5. The method of claim 4, further comprising appending, by an endpoint instance, the second security filter to the end user'"'"'s query to perform a search on the local data sources and get the results with the local relevancy algorithm.

6. The method of claim 2, wherein the endpoint instance sends the results back to the broker search engine instance.

7. The method of claim 6, wherein the broker search engine instance merges its results with the results sent by the endpoints with a weighted formula, sorts the results, performs de-duplication, and sends a final list to the end user.

8. The method of claim 1, wherein the identity management system and authorization servers are separate servers.

9. The method of claim 2, wherein the endpoint instance federate the query to other search engine instances having multiple levels of federation.

10. The method of claim 1, wherein the security information includes username, email, or groups.

11. The method of claim 1, wherein the security attribute values include authorization servers for the data sources.

12. The method of claim 1, wherein the security filter comprises an authorization query.

13. The method of claim 1, further comprising:

mapping, by the broker search engine instance, end user'"'"'s credentials;

sending a federate end user'"'"'s query to a remote search engine instance along with the end user'"'"'s credentials.

14. The method of claim 13, further comprising receiving, at an endpoint instance, the end user'"'"'s query and the end user'"'"'s credentials from the broker server engine instance and map the end user'"'"'s credentials.

15. A non-transitory computer-readable medium having sets of instructions stored thereon which, when executed by a computer, cause the computer to:

receive a log on request from an end user to a broker search engine instance and issuing a query;

collect, by a broker search engine instance, the end user'"'"'s security information from an identity management system registered on the broker server engine instance;

collect, by the broker server engine instance, security attribute values from data sources separately for the logged on end user;

create, by the broker server engine instance, a security filter based on the information collected from the identity management system and the data sources;

filter, using the security filter, the end user'"'"'s security information from the identity management system registered on the broker server engine instance with the security attribute values from each of the data sources to create sets of security values corresponding to the security attribute values for the identity management system;

append, by the broker server engine instance, the sets of security values to the security filter to the end user'"'"'s query to perform a search on local data sources and receive results with a local relevancy algorithm; and

automatically launch a crawl of the data sources using the appended end user'"'"'s query which includes the sets of security values corresponding to the security attribute values for the identity management system to provide access to the data sources, wherein only the data sources which the security attribute values provide access to are returned to the end user as results of the crawl.

16. The non-transitory computer-readable medium of claim 15, wherein the identity management system and authorization servers are separate servers.

17. The non-transitory computer-readable medium of claim 15, wherein the security attribute values include authorization servers for the data sources.

18. A system comprising:

a storage device having sets of instructions stored thereon; and

a computer processor in communication with the storage device, wherein when the sets of instructions are executed by the computer processor, the computer processor is configured to;

receive a log on request from an end user to a broker search engine instance and issuing a query;

collect, by the broker search engine instance, the end user'"'"'s security information from an identity management system registered on the broker server engine instance;

collect, by the broker server engine instance, security attribute values from each data sources separately for the logged on end user;

create, by the broker server engine instance, a security filter based on the information collected from the identity management system and the data sources;

filter, using the security filter, the end user'"'"'s security information from the identity management system registered on the broker server engine instance with the security attribute values from each of the data sources to create sets of security values corresponding to the security attribute values for the identity management system;

append, by the broker server engine instance, the sets of security values to the security filter to the end user'"'"'s query to perform a search on local data sources and receive results with a local relevancy algorithm; and

automatically launch a crawl of the data sources using the appended end user'"'"'s query which includes the sets of security values corresponding to the security attribute values for the identity management system to provide access to the data sources, wherein only the data sources which the security attribute values provide access to are returned to the end user as results of the crawl.

19. The system of claim 18, wherein the identity management system and authorization servers are separate servers.

20. The system of claim 18, wherein the security attribute values include authorization servers for the data sources.