Patent ID: 7823189

Claim:
A system, comprising: a computer including a computer readable medium and processor operating thereon; a security service that makes decisions to permit or deny access requests; an application container that receives an access request for a protected resource from a client and delegates authorization decisions to the security service by passing the access request, and a callback handler to the security service; and a plurality of security plug-ins at the security service that use the callback handler to request context information from the application container describing the access request; wherein the system dynamically associates one or more roles with the client, for the purposes of the access request, at runtime based on the context information, before an authorization decision for the protected resource is determined by the security service; wherein each of the plurality of security plug-ins determines an access decision based on the context information; and wherein the security service then determines entitlements for the client to use with the protected resource based on the access decisions from the plurality of security plug-ins, and uses the one or more roles associated with that client for the purposes of that access request to make the authorization decision.