ACCESSING AN APPLICATION THROUGH APPLICATION CLIENTS AND WEB BROWSERS

• US 20160359861A1
• Filed: 06/04/2015
• Published: 12/08/2016
• Est. Priority Date: 06/04/2015
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP SE
• Inventors: RAEPPLE, MARTIN, MANOV, MILEN, MINOV, JASEN
• Granted Patent: US 10,484,385 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A request from an application client is received at a protected application. The request includes an access token. A grant information associated with the received access token is retrieved. The grant information includes a plurality of intersecting scopes of rights granted to the application client. In another aspect, a session is established between the protected application and the application client. Furthermore, at least one scope of rights from the plurality of intersecting scopes of rights is determined to be mapped to at least one Application Programming Interface (API) from a number of APIs provided by the protected application.

Claims

1. A computer implemented method to provide access to protected applications through application clients, the method comprising:

receiving a request from an application client to access a protected application, wherein the request comprises an access token;

upon determining that the access token is valid, retrieving grant information associated with the received access token, wherein the grant information comprises a role of a user, a group of the user, attributes of the user, and a plurality of intersecting scopes of rights granted to the application client;

establishing a session between the application client and the protected application, wherein the session is based on the plurality of intersecting scopes of rights, the role of the user, the group of the user, and the attributes of the user, and

determining at least one scope of rights from the plurality of intersecting scopes of rights granted to the application client that is mapped to at least one application programming interface (API) from a plurality of APIs provided by the protected application, the at least one API is accessible by the application client based on the plurality of intersecting scopes of rights granted to the application client.

2. The method of claim 1, wherein the protected application further comprises a second login module that processes requests sent by web browsers.

3. The method of claim 1, wherein determining the at least one scope of rights from the plurality of intersecting scopes of rights granted to the application client that is mapped to the at least one API from the plurality of APIs accessible by the application client is performed in an authorization filter of the protected application.

4. The method of claim 1, wherein establishing the session with the application client further comprises:

marking the established session with a session author marker to specify the session is established by a login module that processes requests sent directly from the application clients.

5. The method of claim 4 further comprises:

disconnecting the application client from the protected application; and

invalidating the established session to reduce a number of established sessions in the protected application upon determining that the established session is marked.

6. The method of claim 1 further comprises:

determining the plurality of intersecting scopes of rights by intersecting a first set of scopes of rights requested to be granted by the application client, a second set of scopes of rights mapped to the protected application, and a third set of scopes of rights mapped to the role of the user.

7. The method of claim 6 further comprises:

sending a request to the user to approve the determined plurality of intersecting scopes of rights; and

upon approval, adding the plurality of intersected scopes of rights to the grant information.

8. The method of claim 6 further comprises:

at the application client, receiving the access token for authentication with the protected application; and

associating the access token to the grant information.

9. A computer system configured to provide access to a protected application based on user roles and scopes of rights, the computer system including:

at least one processor and memory for executing program code, the program code comprising;

a first set of scopes of rights mapped to a user role of an application client in a first mapping, wherein the first set of scopes of rights are defined to correspond to rights included in the user role;

a second set of scopes of rights mapped to the protected application in a second mapping, wherein the second set of scopes of rights capable of being granted to the protected application; and

a third set of scopes of rights mapped to at least one application programming interface (API) from a plurality of APIs provided by the protected application in a third mapping, wherein mapping of the third set of scopes of rights to the at least one API is created in an authorization filter of the protected application.

10. The computer system of claim 9 further comprising:

a plurality of intersecting scopes of rights that are requested by an application client, mapped to the user role, and can be granted to the protected application, wherein the plurality of intersecting scopes of rights is determined by intersecting the scopes of rights requested by the application client, the first set of scopes of rights mapped to the user role, and the second set of scopes of rights mapped to the protected application.

11. The computer system of claim 10 further comprising:

a session established between the protected application and the application client requesting access, wherein the session is established based on the plurality of intersecting scopes of rights.

12. The computer system of claim 11, further comprising:

a session author marker to differentiate between the established session that is based on scopes of rights and sessions of the protected application that are based on user roles.

13. The computer system of claim 12, wherein the authorization filter is operable to:

invalidate the established session to reduce a number of established sessions in the protected application upon determining the established session is marked.

14. The computer system of claim 11 further comprising:

at least one scope of rights from the plurality of intersecting scopes of rights mapped to the at least one API, the at least one API is accessible by the application client based on the plurality of intersecting scopes of rights granted to the application client.

15. The computer system of claim 14, wherein the established session further includes:

the at least one scope of rights from the plurality of intersecting scopes of rights mapped to the at least one API to specify APIs operable for the application client within the established session.

16. A non-transitory computer readable medium storing instructions, which when executed by at least one processor cause a computer to perform operations comprising:

receiving a request from an application client to access a protected application, wherein the request comprises an access token;

upon determining that the access token is valid, retrieving grant information associated with the received access token, wherein the grant information comprises a role of a user, a group of the user, attributes of the user, and a plurality of intersecting scopes of rights granted to the application client;

establishing a session between the application client and the protected application, wherein the session is based on the plurality of intersecting scopes of rights, the role of the user, the group of the user, and the attributes of the user; and

determining at least one scope of rights from the plurality of intersecting scopes of rights granted to the application client that is mapped to at least one application programming interface (API) from a plurality of APIs provided by the protected application, the at least one API is accessible by the application client based on the plurality of intersecting scopes of rights granted to the application client.

17. The computer readable medium of claim 16, wherein the protected application further comprises a second login module that processes requests sent by web browsers.

18. The computer readable medium of claim 16, wherein establishing the session with the application client further comprises:

marking the established session with a session author marker to specify the session is established by a login module that processes requests sent directly from the application clients;

disconnecting the application client from the protected application; and

invalidating the established session to reduce a number of established sessions in the protected application upon determining that the established session is marked.

19. The computer readable medium of claim 16 further comprises.

determining the plurality of intersecting scopes of rights by intersecting a first set of scopes of rights requested to be granted by the application client, a second set of scopes of rights mapped to the protected application, and a third set of scopes of rights mapped to the role of the user.

20. The computer readable medium of claim 19 further comprises.

sending a request to the user to approve the determined plurality of intersecting scopes of rights;

upon approval, adding the plurality of intersecting scopes of rights to the grant information;

at the application client, receiving the access token for authentication with the protected application; and

associating the access token to the grant information.