Patent ID: 8032558
Filing Date: 2011-10-04
Classification: G06F,G06Q

Abstract:
1. A method implemented in a computer-readable storage medium and processed by a machine as a role extension service, comprising: receiving, by the role extension service on the machine, a role request and role assignment, the role request identifies a requesting Policy Enforcement Point (PEP) service and a principal, the PEP service is acting on behalf of the principal and the role assignment represents permissible roles of that principal, the role request represents a particular request by a principal to access one or more resources and the PEP service is a module that dynamically enforces policy that includes access permissions and restrictions for access to the resources; evaluating, by the role extension service on the machine, a resource association in response to the role request and role assignment in order to identify a resource profile by considering a relationship among the principal, the role request, the role assignment, membership inheritance requirements, and the PEP service, the relationship maps to the PEP service, and the resource profile identifies one or more resource decorations that are applied to the role assignment or the resource association; applying, by the role extension service on the machine, the one or more resource decorations to the role assignment, each resource decoration defines a processing context for the resource association and includes access restrictions, permissions, and formatting and syntax requirements for the resource association, the one or more resource decorations are applied in response to the identified resource profile to modify the role assignment when dictated by policy; sending, by the role extension service on the machine, a modified role assignment to the PEP service that then dynamically enforces the modified role assignment; and extending, by the role extension service on the machine, the role assignment and role functionality for an existing role management system with the modified role assignment without affecting other uses of the existing role management system and without affecting other legacy applications, services, and systems that use the existing role management system.