Method for delegated administration

• US 20040162733A1
• Filed: 02/14/2003
• Published: 08/19/2004
• Est. Priority Date: 02/14/2003
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Griffin, Philip B., McCauley, Rod, Toussaint, Alex, Devgan, Manish
• Granted Patent: US 8,831,966 B2
• Time in Patent Office: Days
• US Class Current: 705/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06Q 10/10 Office automation; Time management

Abstract

A method for adaptively delegating a capability, comprising the steps of providing for the delegation of the capability to a first role; allowing the step of providing for the delegation to be initiated by a principal in a second role; and hierarchically relating the capability, the first role and the second role.

Claims

1. A method for adaptively delegating a capability, comprising the steps of:

providing for the delegation of the capability to a first role;

allowing the step of providing for the delegation to be initiated by a principal in a second role; and

hierarchically relating the capability, the first role and the second role.

2. The method of claim 1 including the step of:

allowing the principal to be one of an authenticated user, group or process.

3. The method of claim 1 including the step of:

evaluating the second role to true or false for the principal in a context.

4. The method of claim 1 wherein:

a role is a Boolean expression that can include at least one of (1) another Boolean expression and (2) a predicate.

5. The method of claim 4 wherein:

the predicate is one of user, group, time and segment.

6. The method of claim 4 including the step of:

evaluating the predicate against the principal and a context.

7. The method of claim 4 wherein:

the predicate can be a segment specified in plain language.

8. The method of claim 1 wherein:

the capability can be a resource.

9. The method of claim 1 including the step of:

relating the first role and the second role in a delegated administration hierarchy.

10. The method of claim 9 wherein:

the first role is hierarchically equal to or inferior to the second role.

11. The method of claim 1 wherein:

the step of providing for the delegation results in the association of a security policy with the capability.

12. The method of claim 1 including the step of:

granting access to the capability for a principal in the first role.

13. The method of claim 1 wherein:

the first role, the second role and the capability are part of an enterprise application.

14. A method for adaptively delegating a capability, comprising the steps of:

providing for the delegation of the capability to a first role;

allowing the step of providing for the delegation to be initiated by a principal in a second role;

hierarchically relating the capability, the first role and the second role; and

wherein the capability has not already been delegated to a role superior to the second role.

15. The method of claim 14 including the step of:

allowing the principal to be one of an authenticated user, group or process.

16. The method of claim 14 including the step of:

evaluating the second role to true or false for the principal in a context.

17. The method of claim 14 wherein:

a role is a Boolean expression that can include at least one of (1) another Boolean expression and (2) a predicate.

18. The method of claim 17 wherein:

the predicate is one of user, group, time and segment.

19. The method of claim 17 including the step of:

evaluating the predicate against the principal and a context.

20. The method of claim 17 wherein:

the predicate can be a segment specified in plain language.

21. The method of claim 14 wherein:

the capability can be a resource.

22. The method of claim 14 including the step of:

relating the first role and the second role in a delegated administration hierarchy.

23. The method of claim 22 wherein:

the first role is hierarchically equal to or inferior to the second role.

24. The method of claim 14 wherein:

the step of providing for the delegation results in the association of a security policy with the capability.

25. The method of claim 14 including the step of:

granting access to the capability for a principal in the first role.

26. The method of claim 14 wherein:

the first role, the second role and the capability are part of an enterprise application.

27. A method for adaptively delegating a capability, comprising the steps of:

providing for the delegation of the capability to a first role;

the step of providing for the delegation results in the association of a security policy with the capability; and

wherein the capability is part of a hierarchy of resources.

28. The method of claim 27 including the steps of:

allowing the delegation to be initiated by a principal in a second role; and

allowing the principal to be one of an authenticated user, group or process.

29. The method of claim 28 including the step of:

evaluating the second role to true or false for the principal in a context.

30. The method of claim 27 wherein:

a role is a Boolean expression that can include at least one of (1) another Boolean expression and (2) a predicate.

31. The method of claim 30 wherein:

the predicate is one of user, group, time and segment.

32. The method of claim 30 including the step of:

evaluating the predicate against a principal and a context.

33. The method of claim 30 wherein:

the predicate can be a segment specified in plain language.

34. The method of claim 27 wherein:

the capability can be a resource.

35. The method of claim 27 including the steps of:

allowing the delegation to be initiated by a principal in a second role; and

relating the first role and the second role in a delegated administration hierarchy.

36. The method of claim 35 wherein:

the first role is hierarchically equal to or inferior to the second role.

37. The method of claim 27 including the step of:

granting access to the capability for a principal in the first role.

38. The method of claim 27 wherein:

the first role and capability are part of an enterprise application.

39. A method for adaptively delegating a capability, comprising:

providing for the delegation of the capability to a first role;

allowing the step of providing the delegation to be initiated by a principal in a second role; and

wherein the delegation establishes whether or not the first role can delegate the resource capability.

40. The method of claim 39 including the step of:

allowing the principal to be one of an authenticated user, group or process.

41. The method of claim 39 including the step of:

evaluating the second role to true or false for the principal in a context.

42. The method of claim 39 wherein:

a role is a Boolean expression that can include at least one of (1) another Boolean expression and (2) a predicate.

43. The method of claim 42 wherein:

the predicate is one of user, group, time and segment.

44. The method of claim 42 including the step of:

evaluating the predicate against the principal and a context.

45. The method of claim 42 wherein:

the predicate can be a segment specified in plain language.

46. The method of claim 39 wherein:

the capability can be a resource.

47. The method of claim 39 including the step of:

relating the first role and the second role in a delegated administration hierarchy.

48. The method of claim 47 wherein:

the first role is hierarchically equal to or inferior to the second role.

49. The method of claim 39 wherein:

the step of providing for the delegation results in the association of a security policy with the capability.

50. The method of claim 39 including the step of:

granting access to the capability for a principal in the first role.

51. The method of claim 39 wherein:

the first role, the second role and the capability are part of an enterprise application.

52. A machine readable medium having instructions stored thereon that when executed by a processor cause a system to:

provide for the delegation of the capability to a first role;

allow the step of providing for the delegation to be initiated by a principal in a second role; and

hierarchically relate the capability, the first role and the second role.

53. The machine readable medium of claim 52 further comprising instructions which when executed cause a system to:

allow the principal to be one of an authenticated user, group or process.

54. The machine readable medium of claim 52 further comprising instructions which when executed cause a system to:

evaluate the second role to true or false for the principal in a context.

55. The machine readable medium of claim 52 wherein:

a role is a Boolean expression that can include at least one of (1) another Boolean expression and (2) a predicate.

56. The machine readable medium of claim 55 wherein:

the predicate is one of user, group, time and segment.

57. The machine readable medium of claim 55 further comprising instructions which when executed cause a system to:

evaluate the predicate against the principal and a context.

58. The machine readable medium of claim 55 wherein:

the predicate can be a segment specified in plain language.

59. The machine readable medium of claim 52 wherein:

the capability can be a resource.

60. The machine readable medium of claim 52 further comprising instructions which when executed cause a system to:

relate the first role and the second role in a delegated administration hierarchy.