Providing data to applications from an access system

• US 7,134,137 B2
• Filed: 02/26/2001
• Issued: 11/07/2006
• Est. Priority Date: 07/10/2000
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Joshi, Vrinda S., Thiyagarajan, Lakshmi Velandai
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US09/792,934
• Publication Number:
  US 20020091798A1
• Time in Patent Office: 2,080 Days
• Field of Search: 713200-202, 713/150, 713160-162, 713168-170, 709/237, 709/227, 709/234, 709/229, 707/2, 370/393, 726 1- 4, 726/27, 726/30
• US Class Current: 726/1
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 61/4523 using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/142 Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

An access system is disclosed that can provide data to a downstream application. In one embodiment, the data is provided as header variables associated with an HTTP request. Other embodiments can use other protocols and other means for transmitting the data. The data provided to the downstream applications include information about the user accessing the application. In one embodiment, the data provided to the downstream application includes information from an identity profile stored in an LDAP directory structure.

Claims

1. A method for providing header variables to a resource, comprising the steps of:

detecting an access system event;

adding one or more header variables to information associated with a request for access to said resource, said step of adding one or more header variables is performed in response to said access system event;

providing said one or more header variables to said resource from said information associated with said request; and

receiving configuration information, said configuration information includes an indication of a set of one or more attributes from an identity profile to add to said information, wherein said configuration information is for configuring a policy domain.

2. A method according to claim 1, wherein:

said request is an HTTP request.

3. A method according to claim 1, wherein:

said step of adding includes adding said one or more header variables to an HTTP request; and

said step of providing includes directing said HTTP request toward said resource.

4. A method according to claim 1, wherein:

said step of adding includes adding said one or more header variables to a data structure on a web server.

5. A method according to claim 1, wherein:

said resource is a software application.

6. A method according to claim 1, further comprising the step of:

receiving configuration information, said configuration information includes an indication of what data to add to said information as one or more header variables.

7. A method according to claim 6, wherein:

said indication of what data to add to said information includes an indication of a variable name, a text string and an attribute.

8. A method according to claim 7, wherein:

said attribute is part of an identity profile in an LDAP directory structure.

9. A method according to claim 1, wherein:

said access system event is an authorization success event.

10. A method according to claim 1, wherein:

said access system event is an authorization failure system.

11. A method according to claim 1, wherein:

said access system event is an authentication success system.

12. A method according to claim 1, wherein:

said access system event is an authentication failure event.

13. A method according to claim 1, further comprising the steps of:

receiving said request from a user, said user is associated with an identity profile, said one or more header variables include information from said identity profile; and

authorizing access to said resource for said user, said step of authorizing is said access system event.

14. A method according to claim 1, further comprising the step of:

adding a redirect URL to said information associated with said request.

15. A method according to claim 1, further comprising the steps of:

receiving said information at said resource;

reading said one or more header variables from said information; and

responding to said request, said step of responding includes using said header variables.

16. A method according to claim 1, wherein:

said resource is protected by said access system.

17. A method according to claim 1, wherein:

said access system includes an access management system.

18. A method according to claim 1, wherein:

said access system includes an identity management system.

19. A method according to claim 1, wherein:

said access system includes an access management system and an identity management system.

20. A method for providing header variables to a resource, comprising the steps of:

detecting an access system event;

adding one or more header variables to information associated with a request for access to said resource, said step of adding one or more header variables is performed in response to said access system event;

providing said one or more header variables to said resource from said information associated with said request; and

receiving configuration information, said configuration information includes an indication of a set of one or more attributes from an identity profile to add to said information, wherein said configuration information is for configuring a policy.

21. A method according to claim 20, wherein:

said request is an HTTP request.

22. A method according to claim 20, wherein:

said step of adding includes adding said one or more header variables to an HTTP request; and

said step of providing includes directing said HTTP request toward said resource.

23. A method according to claim 20, wherein:

said step of adding includes adding said one or more header variables to a data structure on a web server.

24. A method according to claim 20, wherein:

said resource is a software application.

25. A method according to claim 20, further comprising the step of:

receiving configuration information, said configuration information includes an indication of what data to add to said information as one or more header variables.

26. A method according to claim 25, wherein:

said indication of what data to add to said information includes an indication of a variable name, a text string and an attribute.

27. A method according to claim 26, wherein:

said attribute is part of an identity profile in an LDAP directory structure.

28. A method according to claim 20, wherein:

said access system event is an authorization success event.

29. A method according to claim 20, wherein:

said access system event is an authorization failure system.

30. A method according to claim 20, wherein:

said access system event is an authentication success system.

31. A method according to claim 20, wherein:

said access system event is an authentication failure event.

32. A method according to claim 20, further comprising the steps of:

receiving said request from a user, said user is associated with an identity profile, said one or more header variables include information from said identity profile; and

authorizing access to said resource for said user, said step of authorizing is said access system event.

33. A method according to claim 20, further comprising the step of:

adding a redirect URL to said information associated with said request.

34. A method according to claim 20, further comprising the steps of:

receiving said information at said resource;

reading said one or more header variables from said information; and

responding to said request, said step of responding includes using said header variables.

35. A method according to claim 20, wherein:

said resource is protected by the access system.

36. A method according to claim 20, wherein:

said access system includes an access management system.

37. A method according to claim 20, wherein:

said access system includes an identity management system.

38. A method according to claim 20, wherein:

said access system includes an access management system and an identity management system.

39. A method for providing header variables to a resource, comprising the steps of:

detecting an access system event;

adding one or more header variables to information associated with a request for access to said resource;

providing said one or more header variables to said resource from said information associated with said request; and

said step of adding one or more header variables is performed in response to said access system event, wherein said step of adding includes the step of;

determining whether a redirect URL is designed for said access system event;

determining whether said one or more header variables are designated for said access system event; and

adding said redirect URL to said information associated with said request.

40. A method according to claim 39, wherein:

said request is an HTTP request.

41. A method according to claim 39, wherein:

said step of adding includes adding said one or more header variables to an HTTP request; and

said step of providing includes directing said HTTP request toward said resource.

42. A method according to claim 39, wherein:

said step of adding includes adding said one or more header variables to a data structure on a web server.

43. A method according to claim 39, wherein:

said resource is a software application.

44. A method according to claim 39, further comprising the step of:

receiving configuration information, said configuration information includes an indication of what data to add to said information as one or more header variables.

45. A method according to claim 44, wherein:

said indication of what data to add to said information includes an indication of a variable name, a text string and an attribute.

46. A method according to claim 45, wherein:

said attribute is part of an identity profile in an LDAP directory structure.

47. A method according to claim 39, wherein:

said access system event is an authorization success event.

48. A method according to claim 39, wherein:

said access system event is an authorization failure system.

49. A method according to claim 39, wherein:

said access system event is an authentication success system.

50. A method according to claim 39, wherein:

said access system event is an authentication failure event.

51. A method according to claim 39, further comprising the steps of:

receiving said request from a user, said user is associated with an identity profile, said one or more header variables include information from said identity profile; and

authorizing access to said resource for said user, said step of authorizing is said access system event.

52. A method according to claim 39, further comprising the step of:

adding a redirect URL to said information associated with said request.

53. A method according to claim 39, further comprising the steps of:

receiving said information at said resource;

reading said one or more header variables from said information; and

responding to said request, said step of responding includes using said header variables.

54. A method according to claim 39, wherein:

said resource is protected by the access system.

55. A method according to claim 39, wherein:

said access system includes an access management system.

56. A method according to claim 39, wherein:

said access system includes an identity management system.

57. A method according to claim 39, wherein:

said access system includes an access management system and an identity management system.

58. One or more processor readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors to perform a method comprising the steps of:

detecting an access system event;

adding one or more header variables to information associated with a request for access to said resource, said step of adding one or more header variables is performed in response to said access system event;

providing said one or more header variables to said resource from said information associated with said request; and

receiving configuration information, said configuration information includes an indication of a set of one or more attributes from an identity profile to add to said information, wherein said configuration information is for configuring a policy domain.

59. One or more processor readable storage devices according to claim 58, wherein:

said request is an HTTP request.

60. One or more processor readable storage devices according to claim 58, wherein said method further comprises the step of:

receiving configuration information, said configuration information includes an indication of what data to add to said information as one or more header variables.

61. One or more processor readable storage devices according to claim 58, wherein said method further comprises the step of:

receiving configuration information, said configuration information includes an indication of a set of one or more attributes from an identity profile to add to said information.

62. One or more processor readable storage devices according to claim 58, wherein said method further comprises the steps of:

receiving said request from a user, said user is associated with an identity profile, said one or more header variables include information from said identity profile; and

authorizing access to said resource for said user, said step of authorizing is said access system event.

63. An access system, comprising:

a communication interface;

one or more storage devices; and

one or more processors in communication with said one or more storage devices and said communication interface, said one or more processors programmed to perform a method comprising the steps of;

detecting an access system event;

adding one or more header variables to information associated with a request for access to said resource, said step of adding one or more header variables is performed in response to said access system event;

providing said one or more header variables to said resource from said information associated with said request; and

receiving configuration information, said configuration information includes an indication of a set of one or more attributes from an identity profile to add to said information, wherein said configuration information is for configuring a policy domain.

64. An access system according to claim 63, wherein:

said request is an HTTP request.

65. An access system according to claim 63, wherein said method further comprises the step of:

receiving configuration information, said configuration information includes an indication of what data to add to said information as one or more header variables.

66. An access system according to claim 63, wherein said method further comprises the step of:

receiving configuration information, said configuration information includes an indication of a set of one or more attributes from an identity profile to add to said information.

67. An access system according to claim 63, wherein said method further comprises the steps of:

receiving said request from a user, said user is associated with an identity profile, said one or more header variables include information from said identity profile; and

authorizing access to said resource for said user, said step of authorizing is said access system event.

68. One or more processor readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors to perform a method comprising the steps of:

detecting an access system event;

adding one or more header variables to information associated with a request for access to said resource, said step of adding one or more header variables is performed in response to said access system event;

providing said one or more header variables to said resource from said information associated with said request; and

receiving configuration information, said configuration information includes an indication of a set of one or more attributes from an identity profile to add to said information, wherein said configuration information is for configuring a policy.

69. One or more processor readable storage devices according to claim 68, wherein:

said request is an HTTP request.

70. One or more processor readable storage devices according to claim 68, wherein said method further comprises the step of:

receiving configuration information, said configuration information includes an indication of what data to add to said information as one or more header variables.

71. One or more processor readable storage devices according to claim 68, wherein said method further comprises the step of:

receiving configuration information, said configuration information includes an indication of a set of one or more attributes from an identity profile to add to said information.

72. One or more processor readable storage devices according to claim 68, wherein said method further comprises the steps of:

receiving said request from a user, said user is associated with an identity profile, said one or more header variables include information from said identity profile; and

authorizing access to said resource for said user, said step of authorizing is said access system event.

73. One or more processor readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors to perform a method comprising the steps of:

detecting an access system event;

adding one or more header variables to information associated with a request for access to said resource;

providing said one or more header variables to said resource from said information associated with said request; and

said step of adding one or more header variables is performed in response to said access system event, wherein said step of adding includes the step of;

determining whether a redirect URL is designed for said access system event;

determining whether said one or more header variables are designated for said access system event; and

adding said redirect URL to said information associated with said request.

74. One or more processor readable storage devices according to claim 73, wherein:

said request is an HTTP request.

75. One or more processor readable storage devices according to claim 73, wherein said method further comprises the step of:

receiving configuration information, said configuration information includes an indication of what data to add to said information as one or more header variables.

76. One or more processor readable storage devices according to claim 73, wherein said method further comprises the step of:

receiving configuration information, said configuration information includes an indication of a set of one or more attributes from an identity profile to add to said information.

77. One or more processor readable storage devices according to claim 73, wherein said method further comprises the steps of:

receiving said request from a user, said user is associated with an identity profile, said one or more header variables include information from said identity profile; and

authorizing access to said resource for said user, said step of authorizing is said access system event.

78. An access system, comprising:

a communication interface;

one or more storage devices; and

one or more processors in communication with said one or more storage devices and said communication interface, said one or more processors programmed to perform a method comprising the steps of;

detecting an access system event;

adding one or more header variables to information associated with a request for access to said resource, said step of adding one or more header variables is performed in response to said access system event;

providing said one or more header variables to said resource from said information associated with said request; and

receiving configuration information, said configuration information includes an indication of a set of one or more attributes from an identity profile to add to said information, wherein said configuration information is for configuring a policy.

79. An access system according to claim 78, wherein:

said request is an HTTP request.

80. An access system according to claim 78, wherein said method further comprises the step of:

receiving configuration information, said configuration information includes an indication of what data to add to said information as one or more header variables.

81. An access system according to claim 78, wherein said method further comprises the step of:

receiving configuration information, said configuration information includes an indication of a set of one or more attributes from an identity profile to add to said information.

82. An access system according to claim 78, wherein said method further comprises the steps of:

receiving said request from a user, said user is associated with an identity profile, said one or more header variables include information from said identity profile; and

authorizing access to said resource for said user, said step of authorizing is said access system event.

83. An access system, comprising:

a communication interface;

one or more storage devices; and

one or more processors in communication with said one or more storage devices and said communication interface, said one or more processors programmed to perform a method comprising the steps of;

detecting an access system event;

adding one or more header variables to information associated with a request for access to said resource;

providing said one or more header variables to said resource from said information associated with said request; and

said step of adding one or more header variables is performed in response to said access system event, wherein said step of adding includes the step of;

determining whether a redirect URL is designed for said access system event;

determining whether said one or more header variables are designated for said access system event; and

adding said redirect URL to said information associated with said request.

84. An access system according to claim 83, wherein:

said request is an HTTP request.

85. An access system according to claim 83, wherein said method further comprises the step of:

receiving configuration information, said configuration information includes an indication of what data to add to said information as one or more header variables.

86. An access system according to claim 83, wherein said method further comprises the step of:

receiving configuration information, said configuration information includes an indication of a set of one or more attributes from an identity profile to add to said information.

87. An access system according to claim 83, wherein said method further comprises the steps of:

receiving said request from a user, said user is associated with an identity profile, said one or more header variables include information from said identity profile; and

authorizing access to said resource for said user, said step of authorizing is said access system event.