Modular enterprise authorization solution

• US 8,060,932 B2
• Filed: 11/03/2006
• Issued: 11/15/2011
• Est. Priority Date: 11/03/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Mohammed, Mannan, Brown, Mark, Tielke, Ron, Kayal, Saivendra, Dolly, Nathan
• Primary Examiner(s): Pearson; David J
• Assistant Examiner(s): HOLMES, ANGELA R
• Application Number:
  US11/556,607
• Publication Number:
  US 20080109898A1
• Time in Patent Office: 1,838 Days
• Field of Search: 726/21, 726/4, 726/5, 726/9, 726/17, 726/19, 726/20, 726/10, 713182-185
• US Class Current: 726/21
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

An authorization framework located external to an application may be invoked to determine user authorization for a requested application component. Small amounts of supplemental authentication code are added to application code to invoke provider modules within the authentication framework. The provider modules perform authorization functions outside of the application and return authorization results to the application. The functions include determining a user role, determining the permissions associated with the user role, comparing the role permissions to the security defined on the requested application component by a rule, and returning an authorization state to the authentication framework. The supplemental authentication code may invoke one or more providers through provider interfaces that translate requests to a particular provider. Using the provider based authorization framework, authorization for an application component is achieved externally without hard-coding authorization code within the application itself.

Claims

1. A method for authorizing a request for a component within an application, comprising:

providing a first interface for directly calling a plurality of provider modules that are for implementing authorization, the provider modules are directly callable through the first interface by supplemental authorization code to provide a granular level of authorization;

providing a second interface that is directly callable by supplemental authorization code, a call to the second interface allows one or more of the plurality of provider modules to be specified, the second interface invokes at least the specified provider module or modules to provide authorization;

receiving an authorization request at an external authorization system from supplemental authorization code inside an application, the authentication request is received either at the first interface or the second interface, the authorization request requests authorization to perform an operation on a component within the application, the external authorization system located external to the application;

determining whether a role is authorized to perform the requested operation on the application component by the external authorization system, the determining includes retrieving a rule which specifies one or more operations that one or more roles are allowed to perform on the application component;

configuring a token in response to said step of determining, the token indicating the authorization for the requested operation on the application component; and

providing the token to said application.

2. The method of claim 1, wherein said step of determining whether a role is authorized includes:

sending a request to a role provider interface by a first set of code within the external authorization system;

receiving a response with the user role from the role provider interface.

3. The method of claim 1, wherein said step of determining whether a role is authorized includes:

sending a request with a username to a provider module within the external authorization system by a first set of code in the external authorization system.

4. The method of claim 3, further comprising:

retrieving the username from login data associated with user authentication data.

5. The method of claim 1, wherein said step of determining whether a role is authorized includes:

invoking a first set of code for authorizing a web page within the external authorization system;

invoking a set of principal identification code by a first set of code; and

invoking a role provider module through a role provider interface by the principal identification code.

6. The method of claim 1, wherein said step of determining whether a role is authorized includes:

invoking a first set of code for authorizing a form within the external authorization system;

invoking a set of permission identification code by a first set of code; and

invoking a rule provider module through a rule provider interface by the permission identification code.

7. The method of claim 1, wherein said step of receiving an authorization request includes:

receiving a first request from the supplemental authorization code to invoke a role provider to provide user role data;

receiving a second request from the supplemental authorization code to invoke a rule provider to provide user rule data, wherein said step of determining whether a role is authorized is performed using the role data retrieved by the first request and the rule data retrieved by the second request.

8. The method of claim 1, wherein said step of determining whether a role is authorized includes:

comparing the user role to one or more roles specified in the rule.

17. The method of claim 1, wherein the component within the application is a field in a user interface provided by the application.

18. The method of claim 1, further comprising providing the plurality of provider module, including:

providing a role provider module that returns roles of users;

providing a rule provider module that inputs a name of a rule and returns a rule expression;

providing a control provider module that receives a token name and returns one or more resources that are grouped together inside the token name; and

providing an operation provider module that inputs a token name and returns a set of operations that are defined for the token name.

19. The method of claim 18, wherein providing the second interface includes providing a module that inputs a rule, an indicator of the rule provider module, an operation, and an indicator of the operation provider module that are provided in a call to the second interface, the module calls the rule provider module and the operation provider module.

9. A computer storage device having processor readable code embodied on said computer storage device, said processor readable code for programming one or more processors to perform a method comprising:

adding first supplemental authorization code to an application, the application having a plurality of application components within the application, the supplemental authorization code associated with a first of the application components, said adding includes adding, to the application, a rule name, rule provider module name, and code for sending the rule name and rule provider module name in a message to an external authorization system;

adding second supplemental authorization code to the application, the second supplemental authorization code associated with a second of the application components, said adding includes adding, to the application, code for directly calling the rule provider module name in a message to the external authorization system;

receiving a request for the first application component at the application;

invoking the external authorization system by the first supplemental authorization code to determine whether the request for the first application component is authorized, the external authorization system located external to the application;

receiving authorization results from the external authorization system by the first supplemental authorization code of the application;

receiving a request for the second application component at the application;

invoking the rule provider module in the external authorization system by the second supplemental authorization code directly calling the rule provider module; and

receiving results from the rule provider module by the second supplemental authorization code.

10. The computer storage device of claim 9, wherein said adding includes adding, to the application, code for sending role data associated with a user that initiated the request.

11. The computer storage device of claim 9, wherein said adding includes adding, to the application, code for sending a role provider module.

12. The computer storage device of claim 9, further comprising:

performing an authorization action for the component application on the authorization results.

13. A method for providing authorization, comprising:

storing role data in a role provider and rule data in a rule provider, the role provider and rule provider are included in a set of providers, the role data associated with a user of an application and the rule data associated with a resource within the application, the set of one or more providers included in an external authorization system located external to the application;

providing a form authorization module that provides authorization support for smart clients, the form authorization module starts authorization for a web page when invoked by supplemental authorization code within an application;

providing a web authorization module that provides authorization support for web clients, the web authorization module starts authorization for a web page when invoked by supplemental authorization code within an application;

receiving an authorization request for the resource from supplemental authorization code within the application, the supplemental authorization code is associated with the resource, the authorization request identifies a user name, the role provider, the rule provider, and a rule name, the authorization request is received through a set of provider interfaces included in the external authorization system;

accessing the role data by the set of providers in response to the authorization request received through the set of provider interfaces;

accessing the rule data by the set of providers in response to the authorization request received through the set of provider interfaces;

determining an authorization state from the accessed role data and rule data; and

providing the authorization state to the application.

14. The method of claim 13, wherein said step of determining an authorization state includes:

comparing the accessed role data to one or more roles specified in the accessed rule data.

15. The method of claim 13 wherein said step of determining an authorization state includes:

identifying an operation requested by a user on the application resource;

comparing the requested operation to one or more allowed operations specified in the rule associated with the application resource.

16. The method of claim 13 wherein said step of providing the authorization state to the application includes:

returning a Boolean value to the application in response to said step of determining an authorization state.

20. The method of claim 13 wherein the form authorization module includes a method that is invoked on each active server page for the smart client.