Resource management with policies

• US 20050138412A1
• Filed: 02/07/2005
• Published: 06/23/2005
• Est. Priority Date: 02/14/2003
• Status: Abandoned Application

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Griffin, Philip B., McCauley, Rod, Toussaint, Alex, Devgan, Manish
• Application Number:
  US11/052,356
• Publication Number:
  US 20050138412A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 9/50 Allocation of resources, e.g. of the central processing unit [CPU]
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

A system, method and media for controlling access to a resource in a distributed computing environment, comprising: receiving a request for a principal to access the resource; determining a policy that is appropriate for the principal given the resource; determining whether access to the resource is allowed given the policy.

Claims

1. A method for controlling access to a resource in a distributed computing environment, comprising:

receiving a request for a principal to access the resource;

determining a policy that is appropriate for the principal given the resource;

determining whether access to the resource is allowed given the policy;

wherein the policy is associated with a first resource in a hierarchy of resources; and

wherein the policy can supersede a second policy associated with a parent of the resource in the hierarchy of resources.

2. The method of claim 1 wherein:

a policy includes one or more expressions.

3. The method of claim 1 wherein the step of determining whether to allow access to the resource includes:

evaluating the policy.

4. The method of claim 1 wherein:

a resource is part of an enterprise application.

5. The method of claim 1 wherein:

a resource can inherit a policy.

6. The method of claim 1 wherein:

the policy evaluates to true or false for the principal.

7. The method of claim 1 wherein:

a policy includes one or more predicates.

8. The method of claim 1, further comprising:

responding to the request.

9. A machine readable medium having instructions stored thereon to cause a system to:

receive a request for a principal to access a resource;

determine a policy that is appropriate for the principal given the resource;

determine whether access to the resource is allowed given the policy;

wherein the policy is associated with a first resource in a hierarchy of resources; and

wherein the policy can supersede a second policy associated with a parent of the resource in the hierarchy of resources.

10. A system for controlling access to a resource in a distributed computing environment, comprising:

a security framework capable of receiving a request for a principal to access the resource;

a component coupled to the security framework and capable of determining whether access to the resource is allowed given the policy;

wherein the policy is associated with a first resource in a hierarchy of resources; and

wherein the policy can supersede a second policy associated with a parent of the resource in the hierarchy of resources.

11. The system of claim 10 wherein:

a policy includes one or more expressions.

12. The system of claim 10 wherein:

determining whether to allow access to the resource includes evaluating the policy.

13. The system of claim 10 wherein:

a resource is part of an enterprise application.

14. The system of claim 10 wherein:

a resource can inherit a policy.

15. The system of claim 10 wherein:

the policy evaluates to true or false for the principal.

16. The system of claim 10 wherein:

a policy includes one or more predicates.

17. The system of claim 10 wherein:

the security framework is capable of responding to the request.