System and/or method for role-based authorization

• US 20070079357A1
• Filed: 10/04/2005
• Published: 04/05/2007
• Est. Priority Date: 10/04/2005
• Status: Abandoned Application

• Current Assignee: Disney Enterprises Incorporated (The Walt Disney Company)
• Original Assignee: Disney Enterprises Incorporated (The Walt Disney Company)
• Inventors: Grinstein, Doron
• Application Number:
  US11/243,816
• Publication Number:
  US 20070079357A1
• Time in Patent Office: Days
• US Class Current: 726/2
• CPC Class Codes: G06F 21/629 to features or functions of an application

Abstract

The subject matter disclosed herein relates to authenticating an identity of users desiring access to an application program and determining whether an authenticated user is authorized to access one or more aspects of the application program.

Claims

1. A method comprising:

hosting instances of an agent to process security metadata requests from a plurality of applications;

querying one or more authentication sources to authenticate a user attempting to access a selected one of said plurality of applications and/or a portion thereof;

obtaining authorization metadata indicative of a role associated with said authenticated user from an application agnostic authorization metadata service based, at least in part, on said selected one of said plurality of applications and/or portion thereof; and

affecting runtime behavior of said selected one of said plurality of applications based, at least in part, on said metadata indicative of said role, wherein said application is constructed from role agnostic source code.

2. The method of claim 1, wherein said obtaining said authorization metadata indicative of said role further comprises querying an authorization database comprising authorization metadata associated with said plurality of applications.

3. The method of claim 1, wherein said obtaining authorization metadata further comprises:

receiving one or more attributes associated with said user in response to said query;

transmitting a request through Web service based, at least in part, on at least one of said one or more received attributes; and

receiving a response to said request comprising authorization metadata associated with said user.

4. The method of claim 1, wherein said authorization metadata is indicative of one or more functional abilities associated with said selected application.

5. The method of claim 4, wherein said selected application comprises one or more predefined secured entities, and wherein at least one of said functional abilities defines at least one permitted action associated with at least one of said predefined secured entities.

6. An apparatus comprising:

a security metadata service to process security metadata requests from a plurality of applications; and

middleware responsive to said security metadata requests from said plurality of applications to;

query one or more authentication sources to authenticate a user attempting to access a selected one of said plurality of applications and/or portions thereof; and

obtain authorization metadata indicative of a role associated with said authenticated user based, at least in part, on said selected one or more of said plurality of applications and/or portions thereof, said selected one or more said applications being constructed from role agnostic source code and being capable of affecting runtime behavior of said selected one or more of said applications based, at least in part, on said role indicated by said authorization metadata.

7. The apparatus of claim 6, wherein said middleware is further adapted to:

receive one or more attributes associated with said user in response to said query;

transmit a request through Web service based, at least in part, on at least one of said one or more received attributes; and

receive a response to said request comprising authorization metadata associated with said user.

8. The apparatus of claim 7, wherein said authorization metadata comprises an indication of said user as a member of a class of users.

9. The apparatus of claim 6, wherein said authorization metadata Is indicative of one or more functional abilities associated with said selected application.

10. The apparatus of claim 9, wherein said selected application comprises one or more predefined secured entities, and wherein at least one of said functional abilities defines at least one permitted action associated with at least one of said predefined secured entities.

11. The apparatus of claim 6, and further comprising a data storage system to store authorization metadata for said plurality of applications accessible by said middleware.

12. An apparatus comprising:

a computing platform, the computing platform being adapted to;

process security metadata requests from a plurality of applications and or portions thereof;

query one or more authentication sources to authenticate a user attempting to access a selected one of said plurality of applications and/or portions thereof; and

obtain authorization metadata indicative of a role associated with said authenticated user based, at least in part, on said selected one or more of said plurality of applications and/or portions thereof, said selected one or more said applications being constructed from role agnostic source code and being capable of affecting runtime behavior of said selected one or more of said applications based, at least in part, on said role indicated by said authorization metadata.

13. The apparatus of claim 12, wherein said computing platform is further adapted to:

receive one or more attributes associated with said user in response to said query;

transmit a request through Web service based, at least in part, on at least one of said one or more received attributes; and

receive a response to said request comprising authorization metadata associated with said user.

14. The apparatus of claim 12, wherein said authorization metadata is indicative of one or more functional abilities associated with said selected application.

15. The apparatus of claim 14, wherein said selected application comprises one or more predefined secured entities, and wherein at least one of said functional abilities defines at least one permitted action associated with at least one of said predefined secured entities.

16. An article comprising:

a storage medium comprising machine-readable instructions stored thereon to;

process security metadata requests from a plurality of applications and or portions thereof;

query one or more authentication sources to authenticate a user attempting to access a selected one of said plurality of applications and/or portions thereof; and

obtain authorization metadata indicative of a role associated with said authenticated user based, at least in part, on said selected one or more of said plurality of applications and/or portions thereof, said selected one or more said applications being constructed from role agnostic source code and being capable of affecting runtime behavior of said selected one or more of said applications based, at least in part, on said role indicated by said authorization metadata.

17. The article of claim 16, wherein said storage medium further comprises machine-readable instructions stored thereon to:

receive one or more attributes associated with said user in response to said query;

transmit a request through Web service based, at least in part, on at least one of said one or more received attributes; and

receive a response to said request comprising authorization metadata associated with said user.

18. The article of claim 16, wherein said authorization metadata is indicative of one or more functional abilities associated with said selected application.

19. The article of claim 18, wherein said selected application comprises one or more predefined secured entities, and wherein at least one of said functional abilities defines at least one permitted action associated with at least one of said predefined secured entities.

20. An apparatus comprising:

means for hosting instances of an agent to process security metadata requests from a plurality of applications;

means for querying one or more authentication sources to authenticate a user attempting to access a selected one of said plurality of applications and/or a portion thereof;

means for obtaining authorization metadata indicative of a role associated with said authenticated user from an application agnostic authorization metadata service based, at least in part, on said selected one of said plurality of applications and/or portion thereof; and

means for affecting runtime behavior of said selected one of said plurality of applications based, at least in part, on said metadata indicative of said role, wherein said application is constructed from role agnostic source code.

21. The apparatus of claim 20, wherein said means for obtaining said authorization metadata indicative of said role further comprises means for querying an authorization database comprising authorization metadata associated with said plurality of applications.

22. The apparatus of claim 20, wherein said means for obtaining authorization metadata further comprises:

means for receiving one or more attributes associated with said user in response to said query;

means for transmitting a request through Web service based, at least in part, on at least one of said one or more received attributes; and

means for receiving a response to said request comprising authorization metadata associated with said user.

23. A method comprising:

hosting a plurality of applications and/or portions thereof requiring authentication and/or authorization for access by one or more users;

maintaining a database of authorization metadata indicative of roles associated with said one or more users and said plurality of applications and/or portions thereof;

querying said database for authorization metadata associated with a particular one of said applications and/or portions thereof in response to an attempt to access said particular one of said applications and/or portions thereof by a user; and

selectively affecting runtime execution of said application based, at least in part on a role associated with said user indicated by said authorization metadata, said application being constructed from role agnostic source code.

24. The method of claim 23, and further comprising:

modifying and/or updating said authorization metadata in said database for one or more of said hosted plurality of applications without modifying said one or more of said hosted applications; and

providing responses to queries to said database for authorization metadata according to said updated authorization metadata in response to attempts to access said one or more of said unmodified hosted applications.

25. The method of claim 23, wherein said hosting said plurality of applications further comprises:

providing a source code image of one or more of said plurality of applications;

generating an executable image based, at least in part, on said source code image; and

installing said executable image on a computing platform.

26. The method of claim 25, and further comprising:

modifying and/or updating said authorization metadata In said database for one or more of said hosted plurality of applications corresponding with said installed executable image; and

providing responses to queries to said database for authorization metadata according to said updated authorization metadata in response to attempts to access said one or more of said hosted plurality of applications without reinstalling said executable image.

27. The method of claim 26, wherein said authorization metadata defines functional abilities associated with said hosted applications, and said modifying and/or updating said authorization metadata further comprising defining an additional functional ability and/or modifying an existing functional ability defined for said one or more of said hosted plurality of applications.

28. The method of claim 27, wherein said authorization metadata represents one or more predefined secured entities defined for said one or more of said hosted plurality of applications, and wherein at least one of said functional abilities defines at least one permitted action associated with at least one of said predefined secured entities.

29. The method of claim 23, and further comprising:

detecting said attempt to access said particular one of said applications at an instance of an agent; and

transmitting a query to said database via a Web service in response to said detected attempt.

30. The method of claim 23, and further comprising:

including an additional application to be hosted among said plurality of applications; and

combining authorization metadata of said additional application with authorization metadata in said database.

31. An apparatus comprising:

one or more computing platforms to host a plurality of applications and/or portions thereof requiring authentication and/or authorization for access by a user;

a database to store authorization metadata associated with said plurality of applications; and

a security metadata service to query said database for authorization metadata associated with individual ones of said applications and/or portions thereof,

wherein said one or more computing platforms are capable of selectively affecting runtime execution of said application based, at least in part, on a role associated with said user indicated by said authorization metadata, said application being constructed from role agnostic source code.

32. The apparatus of claim 31, wherein said queries are generated in response to attempts to access said individual ones of said applications and/or portions thereof.

33. An apparatus comprising:

a computing platform, the computing platform being adapted to;

maintain a database of authorization metadata associated with a plurality of applications and/or portions thereof hosted in an enterprise; and

process queries of said database for authorization metadata associated with individual ones of said applications and/or portions thereof, said authorization metadata being indicative of a role associated with a user,

wherein runtime execution of said individual ones of said applications and/or portions thereof is capable of being affected based, at least in part on a role associated with said user indicated by said authorization metadata, said individual ones of said applications and/or portions thereof being constructed from role agnostic source code.

34. The apparatus of claim 33, wherein said queries are generated in response to attempts to access said individual ones of said applications.

35. An article comprising:

a storage medium comprising machine-readable instructions stored thereon to;

maintain a database of authorization metadata associated with a plurality of applications hosted in an enterprise; and

process queries of said database for authorization metadata associated with individual ones of said applications and/or portions thereof, said authorization metadata being indicative of a role associated with a user,

wherein runtime execution of said individual ones of said applications and/or portions thereof is capable of being affected based, at least in part on a role associated with said user indicated by said authorization metadata, said individual ones of said applications and/or portions thereof being constructed from role agnostic source code.

36. The article of claim 36, wherein said queries are generated in response to attempts to access said individual ones of said applications.

37. A method comprising:

hosting one or more applications accessible by one or more users, at least one of said one or more users being associated with a role; and

affecting runtime behavior of at least one of said applications based, at least in part, on said role, wherein said at least one of said applications is constructed from role agnostic source code.

38. The method of claim 37, wherein said at least one of said applications comprises one or more secured entities and said role is associated with one or more functional abilities associated with said one or more secured entities.

39. The method of claim 37, wherein said role agnostic source code comprises a call portion and wherein said affecting runtime behavior of said at least one of said applications further comprises executing said call portion to determine whether said user is authorized to access a secured entity of said at least one of said applications in response to an attempt to access said secured entity.

40. The method of claim 37, wherein said affecting runtime behavior of said at least one of said applications further comprises:

requesting authorization metadata from a Web service in response to executing said call portion; and

selectively enabling access to said secured entity based, at least in part, on said authorization metadata.

41. An apparatus comprising:

means for hosting one or more applications accessible by one or more users, at least one of said one or more users being associated with a role; and

means for affecting runtime behavior of at least one of said applications based, at least in part, on said role, wherein said at least one of said applications is constructed from role agnostic source code.

42. The apparatus of claim 41, wherein said at least one of said applications comprises one or more secured entities and said role is associated with one or more functional abilities associated with said one or more secured entities.

43. The apparatus of claim 41, wherein said role agnostic source code comprises a call portion and wherein said means for affecting runtime behavior of said at least one of said applications further comprises means for executing said call portion to determine whether said user is authorized to access a secured entity of said at least one of said applications in response to an attempt to access said secured entity.

44. The apparatus of claim 43, wherein said means for affecting runtime behavior of said at least one of said applications further comprises:

means for requesting authorization metadata from a Web service in response to executing said call portion; and

means for selectively enabling access to said secured entity based, at least in part, on said authorization metadata.

45. An apparatus comprising:

a computing platform, said computing platform being adapted to;

host one or more applications accessible by one or more users, at least

one of said one or more users being associated with a role; and

affect runtime behavior of at least one of said applications based, at least in part, on said role, wherein said at least one of said applications is constructed from role agnostic source code.

46. The apparatus of claim 45, wherein said at least one of said applications comprises one or more secured entities and said role is associated with one or more functional abilities associated with said one or more secured entities.

47. The apparatus of claim 45, wherein said role agnostic source code comprises a call portion and wherein said computing platform is further adapted to execute said call portion to determine whether said user is authorized to access a secured entity of said at least one of said applications in response to an attempt to access said secured entity.

48. The apparatus of claim 47, wherein said computing platform is further adapted to:

request authorization metadata from a Web service in response to executing said call portion; and

selectively enable access to said secured entity based, at least in part, on said authorization metadata.

49. An article comprising:

a storage medium comprising machine-readable instructions stored thereon to;

communicate with one or more applications hosted on a computing platform and accessible by one or more users, at least one of said one or more users being associated with a role; and

affect runtime behavior of at least one of said applications based, at least in part, on said role, wherein said at least one of said applications is constructed from role agnostic source code.

50. The article of claim 49, wherein said at least one of said applications comprises one or more secured entities and said role is associated with one or more functional abilities associated with said one or more secured entities.

51. The article of claim 49, wherein said role agnostic source code comprises a call portion and wherein said storage medium further comprises machine-readable instructions stored thereon to determine whether said user is authorized to access a secured entity of said at least one of said applications in response to an attempt to access said secured entity.

52. The article of claim 51, wherein said storage medium further comprises machine-readable instructions stored thereon to:

request authorization metadata from a Web service in response to executing said call portion; and

selectively enable access to said secured entity based, at least in part, on said authorization metadata.