Patent ID: 7392546
Filing Date: 2008-06-24
Classification: G06F

Abstract:
1. A security system for allowing a client to access a protected resource through an application container, the security system comprising: the application container, which provides services for a protected resource, wherein the application container delegates authorization decisions to a security service by passing an access request and a callback handler to the security service when the application container receives the access request for a protected resource from the client; context information, wherein the context information comprises one or more parameter values describing the access request, identity of the protected resource, and profile information describing the client; the security service for making a decision to permit or deny the access request, wherein a plurality of security plug-ins that implement an access decision interface are plugged into the security service, and wherein the plurality of security plug-ins use the callback handler to request the context information from the application container for the access request, and wherein the plurality of security plug-ins determine roles for which the client is entitled, and wherein association of the client to roles is computed dynamically at runtime, and wherein each of the plurality of security plug-ins determines a contributory decision selected from a group comprising: permit, deny, and abstain, and wherein depending on output from each security plug-in the security service determines entitlements for the client to use with the protected resource; and the security service is located at a first computer, and the protected resource is located either at the first computer or at a second computer.