Flexible authentication framework

• US 9,467,437 B2
• Filed: 10/29/2015
• Issued: 10/11/2016
• Est. Priority Date: 03/01/2006
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Krishnaprasad, Muralidhar, Davis, Mark, Ture, Mark, Hsin, Cindy, Bhavsar, Meeten, Koide, Hiroshi, Delgado, Joaquin, Yang, Chi-Ming, Nimani, Visar, Ouyang, Hui, Bhatkar, Sachin, Chang, Thomas
• Primary Examiner(s): HOLDER, BRADLEY W
• Application Number:
  US14/926,521
• Publication Number:
  US 20160119321A1
• Time in Patent Office: 348 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/2228 Indexing structures
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 16/9538 Presentation of query results
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A flexible and extensible architecture allows for secure searching across an enterprise. Such an architecture can provide a simple Internet-like search experience to users searching secure content inside (and outside) the enterprise. The architecture allows for the crawling and searching of a variety of sources across an enterprise, regardless of whether any of these sources conform to a conventional user role model. The architecture further allows for security attributes to be received at query time, for example, in order to provide real-time secure access to enterprise resources. The user query also can be transformed to provide for dynamic querying that provides for a more current result list than can be obtained for static queries.

Claims

1. A method for authenticating users in a secure search system for searching a plurality of secure data sources, the method comprising:

receiving, using one or more processors, user identification information from a user in a secure enterprise system (SES);

providing, using the one or more processors, the user identification information to a plurality of identity management systems in the SES, wherein each of the plurality of identity management systems receives the user identification information through a respective Application Program Interface (API);

validating, using the one or more processors, the user against at least one identity management system in the plurality of identity management systems;

crawling, using the one or more processors, at least one secure data source in the plurality of secure data sources residing on a plurality of different computer systems that is associated with the at least one identity management system;

building, using the one or more processors, an index of documents from the at least one secure data source based on the crawling;

receiving, using the one or more processors, a query from the user;

calling back, using the one or more processors, at query time into the at least one identity management system to obtain security attribute values for the user;

appending, using the one or more processors, the security attribute values for the user to the query and using the appended query to query the index of documents; and

determining, using the one or more processors, one or more documents from the index of documents in the plurality of secure data sources, that are responsive to the query and accessible to the user based on the security attribute values for the user and respective security attributes of the one or more documents.

2. The method according to claim 1, wherein a number or type of objects required from the user identification information by a first identity management system in the plurality of identity management systems is different from a number or type of objects required from the user identification information by a second identity management system in the plurality of identity management systems.

3. The method according to claim 1, wherein the security attribute values for the user comprises information selected from a group consisting of:

role information, group information, and project information.

4. The method according to claim 1, further comprising:

receiving, using the one or more processors, user identification information from an additional user in the SES;

determining that the additional user cannot be validated against the at least one identity management system; and

denying the additional user access to the at least one secure data source.

5. The method according to claim 1, wherein the security attribute values for the user change between receiving the user identification information and receiving the query from the user.

6. The method according to claim 1, wherein the one or more security attributes for the user comprises at least one grant attribute or at least one deny attribute.

7. The method according to claim 1, wherein each of the plurality of identity management systems is associated with a respective secure data source.

8. A non-transitory, computer-readable storage medium comprising instructions that, when executed by one or more processors, cause the one or more processors to authenticate users in a secure search system for searching a plurality of secure data sources by performing operations comprising:

receiving user identification information from a user in a secure enterprise system (SES);

providing the user identification information to a plurality of identity management systems in the SES, wherein each of the plurality of identity management systems receives the user identification information through a respective Application Program Interface (API);

validating the user against at least one identity management system in the plurality of identity management systems;

crawling at least one secure data source in the plurality of secure data sources residing on a plurality of different computer systems that is associated with the at least one identity management system;

building an index of documents from the at least one secure data source based on the crawling;

receiving a query from the user;

calling back at query time into the at least one identity management system to obtain security attribute values for the user;

appending the security attribute values for the user to the query and using the appended query to query the index of documents; and

determining one or more documents from the index of documents in the plurality of secure data sources, that are responsive to the query and accessible to the user based on the security attribute values for the user and respective security attributes of the one or more documents.

9. The non-transitory, computer-readable storage medium of claim 8, wherein a number or type of objects required from the user identification information by a first identity management system in the plurality of identity management systems is different from a number or type of objects required from the user identification information by a second identity management system in the plurality of identity management systems.

10. The non-transitory, computer-readable storage medium of claim 8, wherein the security attribute values for the user comprises information selected from a group consisting of:

role information, group information, and project information.

11. The non-transitory, computer-readable storage medium of claim 8, comprising additional instructions that cause the one or more processors to perform additional operations comprising:

receiving, using the one or more processors, user identification information from an additional user in the SES;

determining that the additional user cannot be validated against the at least one identity management system; and

denying the additional user access to the at least one secure data source.

12. The non-transitory, computer-readable storage medium of claim 8, wherein the security attribute values for the user change between receiving the user identification information and receiving the query from the user.

13. The non-transitory, computer-readable storage medium of claim 8, wherein the one or more security attributes for the user comprises at least one grant attribute or at least one deny attribute.

14. The non-transitory, computer-readable storage medium of claim 8, wherein each of the plurality of identity management systems is associated with a respective secure data source.

15. A system comprising:

one or more hardware processors; and

one or more memory devices comprising instructions that, when executed by the one or more processors, cause the one or more processors to authenticate users in a secure search system for searching a plurality of secure data sources by configuring the one or more processors to;

receive user identification information from a user in a secure enterprise system (SES);

provide the user identification information to a plurality of identity management systems in the SES, wherein each of the plurality of identity management systems receives the user identification information through a respective Application Program Interface (API);

validate the user against at least one identity management system in the plurality of identity management systems;

crawl at least one secure data source in the plurality of secure data sources residing on a plurality of different computer systems that is associated with the at least one identity management system;

build an index of documents from the at least one secure data source based on the crawling;

receive a query from the user;

call back at query time into the at least one identity management system to obtain security attribute values for the user;

append the security attribute values for the user to the query and using the appended query to query the index of documents; and

determine one or more documents from the index of documents in the plurality of secure data sources, that are responsive to the query and accessible to the user based on the security attribute values for the user and respective security attributes of the one or more documents.

16. The system of claim 15, wherein a number or type of objects required from the user identification information by a first identity management system in the plurality of identity management systems is different from a number or type of objects required from the user identification information by a second identity management system in the plurality of identity management systems.

17. The system of claim 15, wherein the security attribute values for the user comprises information selected from a group consisting of:

role information, group information, and project information.

18. The system of claim 15, comprising additional instructions that configure the one or more processors to:

receive, using the one or more processors, user identification information from an additional user in the SES;

determine that the additional user cannot be validated against the at least one identity management system; and

deny the additional user access to the at least one secure data source.

19. The system of claim 15, wherein the security attribute values for the user change between receiving the user identification information and receiving the query from the user.

20. The system of claim 15, wherein each of the plurality of identity management systems is associated with a respective secure data source.