Method, System and Computer Program for Automating Configuration of Software Applications

• US 20080250493A1
• Filed: 12/03/2007
• Published: 10/09/2008
• Est. Priority Date: 12/06/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Secchi, Marco, Morgia, Claudio, Ferrari, Gaetano, Bassani, Manuela
• Granted Patent: US 8,024,564 B2
• Time in Patent Office: Days
• US Class Current: 726/17
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems

Abstract

A solution (300) is proposed for populating a policy file (320) in a Java environment automatically. For this purpose, there is provided a wrapper (325) for a security manager (315)—in charge of controlling any access to protected resources. A generic Java application (310) is run in a test environment. Whenever a specific operation must be executed on a secured resource, the Java application submits a corresponding permission request to the wrapper (A1). The wrapper forwards the permission request to the security manager (A2), which verifies whether the required permission is available in the policy file (A3-A4). The wrapper logs any denied permission (A5); in any case, the wrapper always grants the required permission to the Java application (A6-A7), so that its operation can continue without any problem. At the end of the running of the Java application, the logged missing permissions are added to the policy file (A8).

Claims

1. A method for configuring a software application, comprising:

running the software application on a data processing system;

invoking a plurality of operations of the software application, the execution of each operation requiring a configuration feature of the software application;

verifying an availability of the configuration feature for each operation;

logging an indication of each non-available configuration feature;

simulating the availability of each non-available configuration feature to enable the execution of the corresponding operation;

executing each operation; and

configuring the software application according to the logged non-available configuration features.

2. The method according to claim 1, wherein each configuration feature includes an indication of a permission to execute the corresponding operation.

3. The method according to claim 2, wherein verifying comprises verifying the permission to execute each operation, wherein logging comprises, in response to a denial of each permission, logging an indication of the denied permission, and wherein simulating comprises forcing a grant of each permission in response to the denial of the permission.

4. The method according to claim 3, wherein the available permissions are stored in a security structure, and wherein configuring comprises:

updating the security structure according to the logged denied permissions.

5. The method according to claim 4, wherein updating the security structure comprises:

adding the logged denied permissions to the security structure.

6. The method according to claim 4, wherein the software application is a Java application and the security structure is a policy file.

7. The method according to claim 2, wherein the permissions are granted or denied by a security module, and wherein verifying comprises:

submitting a request for verifying the permission to execute each operation to an auxiliary module wrapping the security module,

forwarding the request from the auxiliary module to the security module, and

returning a response indicative of the grant or the denial of the permission from the security module to the auxiliary module, the steps of logging and simulating being performed under the control of the auxiliary module.

8. The method according to claim 1, wherein running, submitting, verifying, logging, simulating, and configuring are executed in a test environment, the method further comprising:

deploying the configured software application in a production environment.

9-10. -10. (canceled)

11. A data processing system, comprising:

a processor; and

a memory coupled to the processor, wherein the memory comprises instructions which, when executed by the processor, cause the processor to;

run a software application on the data processing system;

invoke a plurality of operations of the software application, the execution of each operation requiring a configuration feature of the software application;

verify an availability of the configuration feature for each operation;

log an indication of each non-available configuration feature;

simulate the availability of each non-available configuration feature to enable the execution of the corresponding operation;

execute each operation; and

configure the software application according to the logged non-available configuration features.

12. The system according to claim 11, wherein each configuration feature includes an indication of a permission to execute the corresponding operation.

13. The system according to claim 12, wherein the instructions cause the processor to verify by verifying the permission to execute each operation, wherein the instructions cause the processor to log, in response to a denial of each permission, an indication of the denied permission, and wherein the instructions cause the processor to simulate by forcing a grant of each permission in response to the denial of the permission.

14. The system according to claim 13, wherein the available permissions are stored in a security structure, and wherein configuring comprises:

updating the security structure according to the logged denied permissions.

15. The system according to claim 14, wherein the instructions cause the processor to update the security structure by:

adding the logged denied permissions to the security structure.

16. The system according to claim 14, wherein the software application is a Java application and the security structure is a policy file.

17. The system according to claim 12, wherein the permissions are granted or denied by a security module, and wherein the instructions cause the processor to verify by:

submitting a request for verifying the permission to execute each operation to an auxiliary module wrapping the security module,

forwarding the request from the auxiliary module to the security module, and

returning a response indicative of the grant or the denial of the permission from the security module to the auxiliary module, the steps of logging and simulating being performed under the control of the auxiliary module.

18. The system according to claim 11, wherein the instructions cause the processor to run, submit, verify, log, simulate, and configure in a test environment, and wherein the instructions further cause the processor to:

deploy the configured software application in a production environment.

19. A computer program product, in a computer readable medium having a computer readable program, wherein the computer readable program, when executed by a computing device, causes the computing device to:

run a software application on a data processing system;

invoke a plurality of operations of the software application, the execution of each operation requiring a configuration feature of the software application;

verify an availability of the configuration feature for each operation;

log an indication of each non-available configuration feature;

simulate the availability of each non-available configuration feature to enable the execution of the corresponding operation;

execute each operation; and

configure the software application according to the logged non-available configuration features.

20. The computer program product according to claim 19, wherein each configuration feature includes an indication of a permission to execute the corresponding operation.

21. The computer program product according to claim 20, wherein the computer readable program causes the computing device to verify by verifying the permission to execute each operation, wherein the computer readable program causes the computing device to log, in response to a denial of each permission, an indication of the denied permission, and wherein the computer readable program causes the computing device to simulate by forcing a grant of each permission in response to the denial of the permission.

22. The computer program product according to claim 21, wherein the available permissions are stored in a security structure, and wherein the computer readable program causes the computing device to configure by:

updating the security structure according to the logged denied permissions.

23. The computer program product according to claim 22, wherein the computer readable program causes the computing device to update the security structure by:

adding the logged denied permissions to the security structure.

24. The computer program product according to claim 20, wherein the permissions are granted or denied by a security module, and wherein the computer readable program causes the computing device to verify by:

submitting a request for verifying the permission to execute each operation to an auxiliary module wrapping the security module,

forwarding the request from the auxiliary module to the security module, and

returning a response indicative of the grant or the denial of the permission from the security module to the auxiliary module, the steps of logging and simulating being performed under the control of the auxiliary module.

25. The computer program product according to claim 19, wherein the computer readable program causes the computing device to run, submit, verify, log, simulate, and configure in a test environment, and wherein the computer readable program further causes the computing device to:

deploy the configured software application in a production environment.