Patent ID: 7546633
Filing Date: 2009-06-09
Classification: G06F,H04L

Abstract:
1. A method implemented by an authorization management system to determine, based on data stored in a role-based authorization policy store, whether a user is authorized to perform a requested operation of an application, the method comprising: receiving an authorization request comprising: identifying in the authorization policy store, an application object that represents the application, wherein the authorization policy store comprises an object-based hierarchical data structure, comprising: identifying, in the authorization policy store, a scope object that, according to the object-based hierarchical data structure, is a child object of the application object and that represents the scope of the application indicated by the scope identifier; identifying a role object that, according to the object-based hierarchical data structure, is a child object of the scope object, wherein the role object comprises a members attribute that identifies one or more entities that are members of the role; determining whether the user is represented by any one of the one or more entities that are members of the role; in an event that the user is represented by at least one of the one or more entities that are members of the role, determining that the user is authorized to perform the requested operation of the application; and in an event that the user is not represented by at least one of the one or more entities that are members of the role, determining that the user is not authorized to perform the requested operation of the application.