System and method for delegated administration

• US 20030115292A1
• Filed: 10/24/2002
• Published: 06/19/2003
• Est. Priority Date: 10/24/2001
• Status: Abandoned Application

• Current Assignee: BEA Systems Incorporated (Oracle Corporation)
• Original Assignee: BEA Systems Incorporated (Oracle Corporation)
• Inventors: Griffin, Philip B., Bales, Christopher E., Devgan, Manish, Dimov, Dmitry, Fregly, Chris
• Application Number:
  US10/279,543
• Publication Number:
  US 20030115292A1
• Time in Patent Office: Days
• US Class Current: 709/219
• CPC Class Codes: G06F 16/275 Synchronous replication
• CPC Class Codes: G06F 16/80 of semi-structured data, e.g. markup language structured data such as SGML, XML or HTML content-based retrieval of web data G06F16/95
• CPC Class Codes: G06F 16/954 Navigation, e.g. using categorised browsing
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: G06F 16/986 Document structures and storage, e.g. HTML extensions
• CPC Class Codes: G06F 21/1012 to domains
• CPC Class Codes: G06F 21/1015 to users
• CPC Class Codes: G06F 21/1064 Restricting content processing at operating system level
• CPC Class Codes: G06F 21/1073 Conversion
• CPC Class Codes: G06F 21/1076 Revocation
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 41/18 : Delegation of network management function, e.g. customer network management [CNM]
• CPC Class Codes: H04L 41/22 : comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/0815 : providing single-sign-on or federations
• CPC Class Codes: H04L 63/0884 : by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/025 : for remote control or remote monitoring of applications
• CPC Class Codes: H04L 67/06 : specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/14 : Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/142 : Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms
• CPC Class Codes: H04L 67/2871 : Implementation details of single intermediate entities
• CPC Class Codes: H04L 67/306 : User profiles
• CPC Class Codes: H04L 67/34 : involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/564 : Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 67/567 : Integrating service provisioning from a plurality of service providers
• CPC Class Codes: H04L 67/568 : Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 67/75 : Indicating network or usage conditions on the user display
• CPC Class Codes: H04L 69/22 : Parsing or analysis of headers
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 : Network security protocols
• CPC Class Codes: Y10S 707/99931 : Database or file accessing
• CPC Class Codes: Y10S 707/99933 : Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99953 : Recoverability
• CPC Class Codes: Y10S 707/99954 : Version management

Abstract

A system and method for delegating administration tasks comprising determining at least one capability for a first user based on evaluation of at least one role rule and delegating the at least one capability to a second user.

Claims

1. A method for delegating portal administrative authority, comprising:

determining at least one capability for a first user based on evaluation of at least one role rule; and

delegating the at least one capability to a second user; and

wherein the delegation establishes whether or not the second user can delegate the capability.

2. The method of claim 1 wherein:

the delegated at least one capability is a subset of the at least one capability for the first user.

3. The method of claim 1 wherein:

the at least one capability is one of;

user management, page management, portlet management, portal entitlement management, portlet entitlement management, and visual appearance management.

4. The method of claim 1 wherein:

the first user and the second user have a hierarchical relationship and the second user is hierarchically equal or subordinate to the first user.

5. The method of claim 1 wherein:

the second user is promoted by the first user.

6. The method of claim 1 wherein:

the at least one role rule defaults to everyone.

7. The method of claim 1 wherein:

the at least one role rule is associated with an entitlement.

8. The method of claim 7 wherein:

the entitlement includes a resource name and a permission.

9. The method of claim 8 wherein:

the resource name is part of a taxonomy.

10. The method of claim 8 wherein:

the resource name identifies the first user.

11. The method of claim 1 wherein:

the at least one role rule includes at least one predicate.

12. The method of claim 1 wherein:

the at least one role rule is specified in plain language.

13. The method of claim 1 wherein:

the at least one role rule associates the first user with a role.

14. The method of claim 13 wherein:

the role is one of System Administrator, Portal Administrator, and Group Administrator.

15. The method of claim 1 wherein:

the second user belongs to a group whose members can be promoted.

16. A method for delegating portal administrative authority, comprising:

determining at least one capability for a first user based on evaluation of at least one role rule; and

delegating the at least one capability to a second user; and

wherein the delegated at least one capability is a subset of the at least one capability of the first user.

17. The method of claim 16 wherein:

the first user controls whether the second user can delegate the at least one capability to a third user.

18. The method of claim 16 wherein:

the at least one capability is one of;

user management, page management, portlet management, portal entitlement management, portlet entitlement management, and visual appearance management.

19. The method of claim 16 wherein:

the first user and the second user have a hierarchical relationship and the second user is hierarchically equal or subordinate to the first user.

20. The method of claim 16 wherein:

the second user is promoted by the first user.

21. The method of claim 16 wherein:

the at least one role rule defaults to everyone.

22. The method of claim 16 wherein:

the at least one role rule is associated with an entitlement.

23. The method of claim 22 wherein:

the entitlement includes a resource name and a permission.

24. The method of claim 23 wherein:

the resource name is part of a taxonomy.

25. The method of claim 23 wherein:

the resource name identifies the first user.

26. The method of claim 16 wherein:

the at least one role rule includes at least one predicate.

27. The method of claim 16 wherein:

the at least one role rule is specified in plain language.

28. The method of claim 16 wherein:

the at least one role rule associates the first user with a role.

29. The method of claim 28 wherein:

the role is one of System Administrator, Portal Administrator, and Group Administrator.

30. The method of claim 16 wherein:

the second user belongs to a group whose members can be promoted.

31. A method for delegating portal administrative authority, comprising:

determining for a first user at least one task having at least one capability; and

delegating the at least one capability from the first user to at least one other user; and

wherein the delegated at least one capability is a subset of the at least one capability of the first user.

32. The method of claim 31 wherein:

determining for a first user at least one task having at least one capability includes evaluting at least one role rule.

33. The method of claim 31 wherein:

the at least one capability is one of;

user management, page management, portlet management, portal entitlement management, portlet entitlement management, and visual appearance management.

34. The method of claim 31 wherein:

the first user and the at least one other user have a hierarchical relationship and the at least one other user is hierarchically equal or subordinate to the first user.

35. The method of claim 31 wherein:

the at least one other user is promoted by the first user.

36. The method of claim 32 wherein:

the at least one role rule defaults to everyone.

37. The method of claim 32 wherein:

the at least one role rule is associated with an entitlement.

38. The method of claim 37 wherein:

the entitlement includes a resource name and a permission.

39. The method of claim 38 wherein:

the resource name is part of a taxonomy.

40. The method of claim 38 wherein:

the resource name identifies the first user.

41. The method of claim 32 wherein:

the at least one role rule includes at least one predicate.

42. The method of claim 32 wherein:

the at least one role rule is specified in plain language.

43. The method of claim 32 wherein:

the at least one role rule associates the first user with a role.

44. The method of claim 43 wherein:

the role is one of System Administrator, Portal Administrator, and Group Administrator.

45. The method of claim 31 wherein:

the at least one other user belongs to a group whose members can be promoted.

46. A method for delegating authority, comprising:

determining for a first user at least one task having at least one capability based on at least one entitlement; and

delegating the at least one capability from the first user to at least one other user; and

wherein the delegated at least one capability is a subset of the first user'"'"'s capabilities.

47. The method of claim 46 wherein:

determining for a first user at least one task having at least one capability includes evaluating at least one role rule.

48. The method of claim 46 wherein:

the delegated at least one capability is a subset of the at least one capability for the first user.

49. The method of claim 46 wherein:

the at least one capability is one of;

user management, page management, portlet management, portal entitlement management, portlet entitlement management, and visual appearance management.

50. The method of claim 46 wherein:

the first user and the at least one other user have a hierarchical relationship and the at least one other user is hierarchically equal or subordinate to the first user.

51. The method of claim 46 wherein:

the at least one other user is promoted by the first user.

52. The method of claim 47 wherein:

the at least one role rule defaults to everyone.

53. The method of claim 46 wherein:

the entitlement includes a resource name and a permission.

54. The method of claim 53 wherein:

the resource name is part of a taxonomy.

55. The method of claim 53 wherein:

the resource name identifies the first user.

56. The method of claim 47 wherein:

the at least one role rule includes at least one predicate.

57. The method of claim 47 wherein:

the at least one role rule is specified in plain language.

58. The method of claim 47 wherein:

the at least one role rule associates the first user with a role.

59. The method of claim 58 wherein:

the role is one of System Administrator, Portal Administrator, and Group Administrator.

60. The method of claim 46 wherein:

the at least one other user belongs to a group whose members can be promoted.

61. A system for delegating authority, comprising:

an authorization module to determine at least one capability associated with a first user based on evaluation of at least one role rule; and

an administration tool coupled to the authorization module, the administration tool to delegate the at least one capability from the first user to a second user.

62. The system of claim 61 wherein:

the first user controls whether the second user can delegate the at least one capability to a third user.

63. The system of claim 61 wherein:

the delegated at least one capability is a subset of the at least one capability for the first user.

64. The system of claim 61 wherein:

the at least one capability is one of;

user management, page management, portlet management, portal entitlement management, portlet entitlement management, and visual appearance management.

65. The system of claim 61 wherein:

the first user and the second user have a hierarchical relationship and the second user is hierarchically equal or subordinate to the first user.

66. The system of claim 61 wherein:

the second user is promoted by the first user.

67. The system of claim 61 wherein:

the at least one role rule defaults to everyone.

68. The system of claim 61 wherein:

the at least one role rule is associated with an entitlement.

69. The system of claim 68 wherein:

the entitlement includes a resource name and a permission.

70. The system of claim 69 wherein:

the resource name is part of a taxonomy.

71. The system of claim 68 wherein:

the resource name identifies the first user.

72. The system of claim 61 wherein:

the at least one role rule includes at least one predicate.

73. The system of claim 61 wherein:

the at least one role rule is specified in plain language.

74. The system of claim 61 wherein:

the at least one role rule associates the first user with a role.

75. The system of claim 74 wherein:

the role is one of System Administrator, Portal Administrator, and Group Administrator.

76. The system of claim 61 wherein:

the second user belongs to a group whose members can be promoted.

77. A machine readable medium having instructions stored thereon that when executed by a processor cause a system to:

determine at least one capability for a first user based on evaluation of at least one role rule; and

delegate the at least one capability to a second user.

78. The machine readable medium of claim 77 wherein:

the first user controls whether the second user can delegate the at least one capability to a third user.

79. The machine readable medium of claim 77 wherein:

the delegated at least one capability is a subset of the at least one capability for the first user.

80. The machine readable medium of claim 77 wherein:

the at least one capability is one of;

user management, page management, portlet management, portal entitlement management, portlet entitlement management, and visual appearance management.

81. The machine readable medium of claim 77 wherein:

the first user and the second user have a hierarchical relationship and the second user is hierarchically equal or subordinate to the first user.

82. The machine readable medium of claim 77 wherein:

the second user is promoted by the first user.

83. The machine readable medium of claim 77 wherein:

the at least one role rule defaults to everyone.

84. The machine readable medium of claim 77 wherein:

the at least one role rule is associated with an entitlement.

85. The machine readable medium of claim 84 wherein:

the entitlement includes a resource name and a permission.

86. The machine readable medium of claim 85 wherein:

the resource name is part of a taxonomy.

87. The machine readable medium of claim 85 wherein:

the resource name identifies the first user.

88. The machine readable medium of claim 77 wherein:

the at least one role rule includes at least one predicate.

89. The machine readable medium of claim 77 wherein:

the at least one role rule is specified in plain language.

90. The machine readable medium of claim 77 wherein:

the at least one role rule associates the first user with a role.

91. The machine readable medium of claim 90 wherein:

the role is one of System Administrator, Portal Administrator, and Group Administrator.

92. The machine readable medium of claim 77 wherein:

the second user belongs to a group whose members can be promoted.

93. The method of claims 77 wherein:

the step of delegating can limit the scope of the capability delegated.

94. The method of claims 77 wherein:

the delegating step can limit the capability delegated to one or more of a manage capability, a delegate capability and a set entitlements capability.

95. A system for delegating authority, comprising:

an authorization module to determine at least one capability associated with a first user based on evaluation of at least one role rule; and

an administration tool coupled to the authorization module, the administration tool to delegate the at least one capability from the first user to a second user; and

wherein the first user controls whether the second user can delegate the at least one capability to a third user; and

wherein the at least one role rule is associated with an entitlement.

96. The system of claim 95 wherein:

the delegated at least one capability is a subset of the at least one capability for the first user.

97. The system of claim 95 wherein:

the at least one capability is one of;

user management, page management, portlet management, portal entitlement management, portlet entitlement management, and visual appearance management.

98. The system of claim 95 wherein:

the first user and the second user have a hierarchical relationship and the second user is hierarchically equal or subordinate to the first user.

99. The system of claim 95 wherein:

the second user is promoted by the first user.

100. The system of claim 95 wherein:

the at least one role rule defaults to everyone.

101. The system of claim 95 wherein:

the entitlement includes a resource name and a permission.

102. The system of claim 101 wherein:

the resource name is part of a taxonomy.

103. The system of claim 101 wherein:

the resource name identifies the first user.

104. The system of claim 95 wherein:

the at least one role rule includes at least one predicate.

105. The system of claim 95 wherein:

the at least one role rule is specified in plain language.

106. The system of claim 95 wherein:

the at least one role rule associates the first user with a role.

107. The system of claim 106 wherein:

the role is one of System Administrator, Portal Administrator, and Group Administrator.

108. The system of claim 95 wherein:

the second user belongs to a group whose members can be promoted.

109. A machine readable medium having instructions stored thereon that when executed by a processor cause a system to:

determine for a first user at least one task having at least one capability based on at least one entitlement; and

delegate the at least one capability from the first user to at least one other user; and

wherein the delegated at least one capability is a subset of the first user'"'"'s capabilities.

110. The machine readable medium of claim 109 wherein:

the first user controls whether the at least one other user can delegate the at least one capability to a third user.

111. The machine readable medium of claim 109 wherein:

the at least one capability is one of;

user management, page management, portlet management, portal entitlement management, portlet entitlement management, and visual appearance management.

112. The machine readable medium of claim 109 wherein:

the first user and the at least one other user have a hierarchical relationship and the at least one other user is hierarchically equal or subordinate to the first user.

113. The machine readable medium of claim 109 wherein:

the at least one other user is promoted by the first user.

114. The machine readable medium of claim 109 wherein:

the at least one entitlement includes a resource name and a permission.

115. The machine readable medium of claim 114 wherein:

the resource name is part of a taxonomy.

116. The machine readable medium of claim 114 wherein:

the resource name identifies the first user.

117. The machine readable medium of claim 109 wherein:

the at least one entitlement includes at least one role rule.

118. The machine readable medium of claim 117 wherein:

the at least one role rule includes at least one predicate.

119. The machine readable medium of claim 117 wherein:

the at least one role rule is specified in plain language.

120. The machine readable medium of claim 117 wherein:

the at least one role rule associates the first user with a role.

121. The machine readable medium of claim 120 wherein:

the role is one of System Administrator, Portal Administrator, and Group Administrator.

122. The machine readable medium of claim 109 wherein:

the at least one other user belongs to a group whose members can be promoted.

123. The method of claims 109 wherein:

the step of delegating can limit the scope of the capability delegated.

124. The method of claims 109 wherein:

the delegating step can limit the capability delegated to one or more of a manage capability, a delegate capability and a set entitlements capability.