Method for role and resource policy management

• US 6,917,975 B2
• Filed: 02/14/2003
• Issued: 07/12/2005
• Est. Priority Date: 02/14/2003
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: BEA Systems Incorporated (Oracle Corporation)
• Inventors: Griffin, Philip B., McCauley, Rod, Toussaint, Alex, Devgan, Manish
• Primary Examiner(s): VU, VIET DUY
• Application Number:
  US10/367,462
• Publication Number:
  US 20040162894A1
• Time in Patent Office: 879 Days
• Field of Search: 709/225, 709/229, 709/223, 709/226, 709/227, 707/9, 707/10, 713/104, 713/201
• US Class Current: 709/225
• CPC Class Codes: G06F 9/50 Allocation of resources, e.g. of the central processing unit [CPU]
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

A method for adaptively managing entitlements, comprising the steps of providing for the association of a role with a first resource; and providing for the association of a policy with a second resource, wherein the policy is based at least partially on the role; and providing for hierarchically relating the role and the policy; and wherein the role is hierarchically equal or superior to the policy.

Claims

1. A method for managing entitlements in an enterprise application, comprising the steps of:

associating a role with a first enterprise application resource;

associating a policy with a second enterprise application resource, wherein the policy is based at least partially on the role;

mapping the role to a principal in order to determine whether or not the principal can access the second application resource;

wherein the first application resource is hierarchically related to the second application resource;

wherein the second application resource can inherit one or more roles associated with the first application resource;

wherein the role is hierarchically equal or superior to the policy;

the role can supersede a second role associated with a parent of the first application resource; and

wherein the policy can supersede a second policy associated with a parent of the second application resource.

2. The method of claim 1 wherein:

the step of associating the policy with the second application resource is initiated by an authenticated user, group or process.

3. The method of claim 1 wherein the step of mapping the role further comprises:

evaluating the role to true or false for a principal in a context.

4. The method of claim 1 wherein:

the role is a Boolean expression that can include at least one of (1) another Boolean expression and (2) a predicate.

5. The method of claim 4 wherein:

the predicate is one of a user, group, time and segment.

6. The method of claim 4 wherein:

the predicate can be evaluated against the principal and a context.

7. The method of claim 4 wherein:

the predicate is specified in natural language.

8. The method of claim 1 wherein:

the policy is an association between the second resource and a set of roles.

9. A method for managing entitlements, comprising the steps of:

associating a first role with a first resource in a hierarchy of resources;

associating a first policy with a second resource in the hierarchy of resources, wherein the first policy is based at least partially on the first role;

wherein the second resource in the hierarchy of resources is capable of inheriting at least one role associated with the first resource in the hierarchy of resources;

wherein the first role can supersede a second role associated with a parent of the first resource; and

wherein the first policy can supersede a second policy associated with a parent of the second resource.

10. The method of claim 9 wherein:

the step of associating the first policy with the second resource is initiated by an authenticated user, group or process.

11. The method of claim 9 including the step of:

mapping the first role to a principal in order to determine whether or not the principal can access the second resource.

12. The method of claim 9 including the step of:

evaluating the first role to true or false for a principal in a context.

13. The method of claim 9 wherein:

the first role is a Boolean expression that can include at least one of (1) another Boolean expression and (2) a predicate.

14. The method of claim 13 wherein:

the predicate is one of a user, group, time and segment.

15. The method of claim 13 wherein:

the predicate can be evaluated against a principal and a context.

16. The method of claim 15 wherein:

the predicate is specified in natural language.

17. The method of claim 9 wherein:

the first policy is an association between the second resource and a set of roles.

18. The method of claim 9 wherein:

the first resource and the second resource are part of an enterprise application.

19. A method for managing entitlements, comprising the steps of:

associating a role with a first resource in a hierarchy of resources;

associating a policy with a second resource in the hierarchy of resources, wherein the policy is based at least partially on the role; and

wherein the second resource in the hierarchy of resources is capable of inheriting at least one role associated with the first resource in the hierarchy of resources;

wherein the second resource in the hierarchy of resources is capable of inheriting at least one policy associated with the first resource in the hierarchy of resources;

wherein the role can block a less local role; and

wherein the policy can block a less local policy.

20. The method of claim 19 wherein:

the step of associating the policy with the second resource is initiated by an authenticated user, group or process.

21. The method of claim 19 including the step of:

mapping the role to a principal in order to specify whether or not the principal can access the second resource.

22. The method of claim 19 including the step of:

evaluating the role to true or false for a principal in a context.

23. The method of claim 19 wherein:

the role is a Boolean expression that can include at least one of (1) another Boolean expression and (2) a predicate.

24. The method of claim 23 wherein:

the predicate is one of a user, group, time and segment.

25. The method of claim 23 wherein:

the predicate can be evaluated against a principal and a context.

26. The method of claim 23 wherein:

the predicate is specified in natural language.

27. The method of claim 19 wherein:

the policy is an association between the second resource and a set of roles.

28. The method of claim 19 wherein:

the first resource and the second resource are part of an enterprise application.