Business process enablement for identity management

• US 9,027,093 B2
• Filed: 12/30/2009
• Issued: 05/05/2015
• Est. Priority Date: 12/30/2009
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hinton, Heather Maria, Raghavan, Venkat, Muppidi, Sridhar R., Plunkett, Casey M.
• Primary Examiner(s): HOLDER, BRADLEY W
• Application Number:
  US12/649,496
• Publication Number:
  US 20110162055A1
• Time in Patent Office: 1,952 Days
• Field of Search: 713/164, 726/5
• US Class Current: 726/5
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: G06F 9/541 via adapters, e.g. between incompatible applications

Abstract

A method, system and computer program for business process automation facilitates transforming a user'"'"'s identity/credentials as part of the enablement of transaction fulfillment, e.g., within a SOA environment. In one embodiment, identity and attribute information is added to one or more business process models that each represents a sub-transaction within an overall transaction fulfillment business process flow. As the business model is mapped to an execution environment, the identity and attribute information in the model is used to configure appropriate tooling to define the identity/attribute transformation required to complete the particular portion of the transaction represented by the model. In a representative implementation, the business process models conform to BPEL4WS, and one or more of these models are extended with identity mapping information such that, during transaction fulfillment, local identity mapping transformations provide the identity/credential propagation required to support the business process.

Claims

1. A method for business process automation, comprising:

providing a business process model that includes credential information, wherein the business process model represents a sub-transaction in a transaction and the credential information is specified within the business process model explicitly and without reference to an application framework in which the sub-transaction is to be carried out, the credential information being an identity having at least one attribute associated therewith;

during the transaction as implemented within the application framework, and as the business process model is mapped to a given local execution environment, refining, in a machine having a hardware element, the credential information into a format that can be acted upon by an application in the application framework to be invoked to perform the sub-transaction; and

using the refined credential information in the application framework to perform the sub-transaction.

2. The method as described in claim 1 wherein the business process model is a Business Process Execution Language (BPEL) model.

3. The method as described in claim 2 wherein the business process model is specified by Business Process Execution Language for Web Services (BPEL4WS).

4. The method as described in claim 1 wherein the application framework is a Service Oriented Architecture (SOA) framework.

5. The method as described in claim 1 wherein the application is invoked as a Web service.

6. The method as described in claim 1 wherein the step of refining the credential information retrieves credential requirements for the sub-transaction and binds the credential requirements to an object associated with the sub-transaction.

7. An apparatus, comprising:

a hardware processor;

computer memory holding computer program instructions executed by the hardware processor, the computer program instructions comprising;

program code for providing a business process model that includes credential information, wherein the business process model represents a sub-transaction in a transaction and the credential information is specified within the business process model explicitly and without reference to an application framework in which the sub-transaction is to be carried out, the credential information being an identity having at least one attribute associated therewith;

program code executable during the transaction as implemented within the application framework, and as the business process model is mapped to a given local execution environment, for refining the credential information into a format that can be acted upon by an application in the application framework to be invoked to perform the sub-transaction; and

program code for using the refined credential information in the application framework to perform the sub-transaction.

8. The apparatus as described in claim 7 wherein the business process model is a Business Process Execution Language (BPEL) model.

9. The apparatus as described in claim 8 wherein the business process model is specified by Business Process Execution Language for Web Services (BPEL4WS).

10. The apparatus as described claim 7 wherein the application framework is a Service Oriented Architecture (SOA) framework.

11. The apparatus as described in claim 7 wherein the application is invoked as a Web service.

12. The apparatus as described in claim 7 wherein the program code executable for refining the credential information retrieves credential requirements for the sub-transaction and binds the credential requirements to an object associated with the sub-transaction.

13. A computer program product in a non-transitory computer readable medium for use in a data processing system for business process automation, the computer program product holding computer program instructions executed by the data processing system, the computer program instructions comprising:

program code providing a business process model that includes credential information, wherein the business process model represents a sub-transaction in a transaction and the credential information is specified within the business process model explicitly and without reference to an application framework in which the sub-transaction is to be carried out, the credential information being an identity having at least one attribute associated therewith;

program code executable during the transaction as implemented within the application framework, and as the business process model is mapped to a given local execution environment, for refining the credential information into a format that can be acted upon by an application in the application framework to be invoked to perform the sub-transaction; and

program code using the refined credential information in the application framework to perform the sub-transaction.

14. The computer program product as described in claim 13 wherein the business process model is a Business Process Execution Language (BPEL) model.

15. The computer program product as described in claim 14 wherein the business process model is specified by Business Process Execution Language for Web Services (BPEL4WS).

16. The computer program product as described in claim 13 wherein the application framework is a Service Oriented Architecture (SOA) framework.

17. The computer program product as described in claim 13 wherein the application is invoked as a Web service.

18. The computer program product as described in claim 13 wherein the program code refining the credential information retrieves credential requirements for the sub-transaction and binds the credential requirements to an object associated with the sub-transaction.