Flexible authentication framework

• US 9,177,124 B2
• Filed: 02/28/2007
• Issued: 11/03/2015
• Est. Priority Date: 03/01/2006
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Krishnaprasad, Muralidhar, Davis, Mark, Ture, Mark, Hsin, Cindy, Bhavsar, Meeten, Koide, Hiroshi, Delgado, Joaquin, Yang, Chi-Ming, Nimani, Visar, Ouyang, Hui, Bhatkar, Sachin, Chang, Thomas
• Primary Examiner(s): HOLDER, BRADLEY W
• Application Number:
  US11/680,530
• Publication Number:
  US 20070208744A1
• Time in Patent Office: 3,170 Days
• Field of Search: 726/2, 726/3, 726/28
• US Class Current: 1/1
• CPC Class Codes: G06F 16/2228 Indexing structures
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 16/9538 Presentation of query results
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A flexible and extensible architecture allows for secure searching across an enterprise. Such an architecture can provide a simple Internet-like search experience to users searching secure content inside (and outside) the enterprise. The architecture allows for the crawling and searching of a variety of sources across an enterprise, regardless of whether any of these sources conform to a conventional user role model. The architecture further allows for security attributes to be submitted at query time, for example, in order to provide real-time secure access to enterprise resources. The user query also can be transformed to provide for dynamic querying that provides for a more current result list than can be obtained for static queries.

Claims

1. A method for authenticating users in a secure search system, comprising:

receiving, using one or more processors, user identification information from a user in a secure enterprise system;

authenticating, using the one or more processors, the user to a plurality of secure data sources by providing the user identification information to a plurality of application program interfaces (APIs), with each API interfacing with a respective identity management computer system, and with each identity management computer system of a plurality of identity management computer systems managing identities for one or more secure data sources in the secure enterprise system, where each secure data source provides access to data by authenticated and authorized users, where a number or types of objects representing the user identification information required by a first identity management computer system is different from a number or types of objects representing the user identification information required by a second identity management computer system;

crawling, using the one or more processors, a secure data source associated with the at least one identity management computer system and building an index of documents based on the crawling;

receiving, using the one or more processors, a query from the user;

calling, using the one or more processors, back into the at least one identity management computer system to obtain a security attribute value for the user in response to the query;

appending, using the one or more processors, the security attribute value for the user to the query and using the appended query to query the index; and

based on the appended query and security attributes of documents in the secure data source, determining, using the one or more processors, one or more documents from the index of documents, that are accessible to the user.

2. The method according to claim 1, wherein calling back into the at least one identity management computer system includes obtaining access information selected from a group consisting of role information, group information, and project information.

3. The method according to claim 1, further comprising:

if the user cannot be validated, denying the user access to the secure data source.

4. The method according to claim 1, further comprising:

refreshing access information for the user.

5. The method according to claim 1, further comprising:

providing an additional API to allow the user identification information to be passed to an additional secure data source.

6. The method according to claim 1, wherein:

calling back into the identity management computer system includes obtaining project information associated with the user.

7. A non-transitory computer readable storage medium storing instructions, which when executed by one or more processors cause the one or more processors to authenticate users in a secure search system, the instructions comprising:

instructions for receiving user identification information from a user in a secure enterprise system;

instructions for authenticating the user to a plurality of secure data sources by providing the user identification information to a plurality of application program interfaces (APIs), with each API interfacing with a respective identity management computer system, and with each identity management computer system of a plurality of identity management computer systems managing identities for one or more secure data sources in the secure enterprise system, where each secure data source provides access to data by authenticated and authorized users, where a number or types of objects representing the user identification information required by a first identity management computer system is different from a number or types of objects representing the user identification information required by a second identity management computer system;

instructions for crawling a secure data source associated with the at least one identity management computer system and building an index of documents based on the crawling;

instructions for receiving a query from the user;

instructions for calling back into the at least one identity management computer system to obtain a security attribute value for the user in response to the query;

instructions for appending the security attribute value for the user to the query and using the appended query to query the index; and

instructions for determining, based on the appended query and security attributes of documents in the secure data source, one or more documents from the index of documents, that are accessible to the user.

8. The non-transitory computer-readable storage medium according to claim 7, wherein

instructions for calling back into the at least one identity management computer system includes instructions for obtaining access information selected from a group consisting of role information, group information, and project information.

9. The non-transitory computer-readable storage medium according to claim 7, further comprising:

instructions for denying the user access to the secure data source when the user cannot be validated.

10. The non-transitory computer-readable storage medium according to claim 7, further comprising:

instructions for refreshing access information for the user.

11. The non-transitory computer-readable storage medium according to claim 7, further comprising:

instructions for providing an additional API to allow the user identification information to be passed to an additional secure data source.

12. The non-transitory computer-readable storage medium according to claim 7, wherein:

calling back into the identity management computer system includes obtaining project information associated with the user.

13. A secure search system comprising:

one or more hardware processors; and

one or more memory devices comprising instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising;

receiving user identification information from a user in a secure enterprise system;

authenticating the user to a plurality of secure data sources by providing the user identification information to a plurality of application program interfaces (APIs), with each API interfacing with a respective identity management computer system, and with each identity management computer system of a plurality of identity management computer systems managing identities for one or more secure data sources in the secure enterprise system, where each secure data source provides access to data by authenticated and authorized users, where a number or types of objects representing the user identification information required by a first identity management computer system is different from a number or types of objects representing the user identification information required by a second identity management computer system;

crawling a secure data source associated with the at least one identity management computer system and building an index of documents based on the crawling;

receiving a query from the user;

calling back into the at least one identity management computer system to obtain a security attribute value for the user in response to the query;

appending the security attribute value for the user to the query and using the appended query to query the index; and

based on the appended query and security attributes of documents in the secure data source, determining one or more documents from the index of documents, that are accessible to the user.

14. The secure search system of claim 13, wherein calling back into the at least one identity management computer system includes obtaining access information selected from a group consisting of role information, group information, and project information.

15. The secure search system of claim 13, wherein the one or more memory devices further comprise instructions that, when executed by the one or more processors, cause the one or more processors to perform further operations comprising:

denying the user access to the secure data source when the user cannot be validated.

16. The secure search system of claim 13, wherein the one or more memory devices further comprise instructions that, when executed by the one or more processors, cause the one or more processors to perform further operations comprising:

refreshing access information for the user.

17. The secure search system of claim 13, wherein the one or more memory devices further comprise instructions that, when executed by the one or more processors, cause the one or more processors to perform further operations comprising:

providing an additional API to allow the user identification information to be passed to an additional secure data source.

18. The secure search system of claim 13, wherein calling back into the at least one identity management computer system includes obtaining project information associated with the user.