User Role Mapping in Web Applications

• US 20110047611A1
• Filed: 11/02/2010
• Published: 02/24/2011
• Est. Priority Date: 09/22/2006
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: BEA Systems Incorporated (Oracle Corporation)
• Inventors: Vu, Daniel, Hayler, Don L.
• Granted Patent: US 8,136,150 B2
• Time in Patent Office: Days
• US Class Current: 726/12
• CPC Class Codes: G06F 12/1466 Key-lock mechanism
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

Roles and policies are used to provide display and access to data in a flexible manner. Users and/or web applications can be mapped to user roles that dictate which displays or other application resources are available to the user or application. Roles are assigned to web applications individually, allowing for user roles to be used without requiring an independent mapping of users to roles. In some cases, application roles can be centrally managed, so that presentation systems also avoid the need for an independent mapping of user or application roles.

Claims

1. A method comprising:

storing a plurality of application role mappings at a reverse proxy server, each application role mapping defining an application resource that a web application is allowed to access;

receiving a user request for a first web application at the reverse proxy server, the first web application being associated with at least one of the plurality of stored role mappings;

based upon the at least one of the plurality of stored application role mappings, determining a proper first user role for the web application requested by the user at the reverse proxy server;

sending the determined first user role as part of a HTTP header to the web application;

wherein the web application uses the user role without doing an independent mapping of the user to a role;

generating a display of the first web application suitable for use according to the determined first user role for the web application; and

providing the generated display to the user that requested the first web application.

2. The method of claim 1, further comprising:

receiving an indication of one or more roles supported by the web application from an administrator by way of an administrative user interface at the reverse proxy server.

3. The method of claim 1, further comprising:

identifying a tag in code for the first web application that refers to a second web application; and

inserting the second web application into the generated display.

4. The method of claim 3, wherein the second web application uses a second user role different from the first user role identified for the first web application.

5. The method of claim 4, further comprising sending the second user role as part of the HTTP header sent to the web application.

6. The method of claim 1, further comprising:

determining a plurality of proper user roles, each user role corresponding to a separate one of a plurality of web applications; and

including code from each of the plurality of web applications in the generated display according to the user role determined for each web application.

7. A system comprising:

a storage medium storing a plurality of application role mappings, each application role mapping defining an application resource that a web application is allowed to access;

a server in communication with the storage medium, the server adapted to;

receive a user request for a first web application at the reverse proxy server, the first web application being associated with at least one of the plurality of stored role mappings;

based upon the at least one of the plurality of stored application role mappings, determine a proper first user role for the web application requested by the user at the reverse proxy server;

send the determined first user role as part of a HTTP header to the web application;

wherein the web application uses the user role without doing an independent mapping of the user to a role;

generate a presentation of the first web application suitable for use according to the determined first user role for the web application; and

provide the generated presentation to the user that requested the first web application.

8. The system of claim 7, the processor further configured to:

receive an indication of one or more roles supported by the web application from an administrator by way of an administrative user interface at the reverse proxy server.

9. The system of claim 7, the processor further configured to:

identify a tag in code for the first web application that refers to a second web application; and

insert the second web application into the generated display.

10. The system of claim 9, wherein the second web application uses a second user role different from the first user role identified for the first web application.

11. The system of claim 10, the processor further configured to send the second user role as part of the HTTP header sent to the web application.

12. The system of claim 7, the processor further configured to:

determine a plurality of proper user roles, each user role corresponding to a separate one of a plurality of web applications; and

include code from each of the plurality of web applications in the generated display according to the user role determined for each web application.

13. A non-transitory computer-readable storage medium storing a plurality of instructions that cause a processor to:

store a plurality of application role mappings, each application role mapping defining an application resource that a web application is allowed to access;

receive a user request for a first web application at the reverse proxy server, the first web application being associated with at least one of the plurality of stored role mappings;

based upon the at least one of the plurality of stored application role mappings, determine a proper first user role for the web application requested by the user at the reverse proxy server;

send the determined first user role as part of a HTTP header to the web application;

wherein the web application uses the user role without doing an independent mapping of the user to a role;

generate a presentation of the first web application suitable for use according to the determined first user role for the web application; and

provide the generated presentation to the user that requested the first web application.

14. The computer-readable medium of claim 13, the instructions further causing the processor to:

receive an indication of one or more roles supported by the web application from an administrator by way of an administrative user interface at the reverse proxy server.

15. The computer-readable medium of claim 13, the instructions further causing the processor to:

identify a tag in code for the first web application that refers to a second web application; and

insert the second web application into the generated display.

16. The computer-readable medium of claim 13, wherein the second web application uses a second user role different from the first user role identified for the first web application.

17. The computer-readable medium of claim 16, the instructions further causing the processor to send the second user role as part of the HTTP header sent to the web application.

18. The computer-readable medium of claim 17, the instructions further causing the processor to:

determine a plurality of proper user roles, each user role corresponding to a separate one of a plurality of web applications; and

include code from each of the plurality of web applications in the generated display according to the user role determined for each web application.