Patent ID: 7788489

Claim:
A computer-implemented method of managing permissions to access objects distributed among multiple address spaces in an object-oriented programming environment, the method comprising: creating object permissions configured to allow object actions to be performed on objects distributed among multiple Java address spaces; granting an object permission to one or more subjects; creating a first admin permission configured to allow an administrative action to be performed on the object permission, wherein the created admin permission allows a subject one or more specific actions over an object permission; storing the object permission and admin permission in a centrally managed repository on a computer system which is accessible across different namespaces; maintaining the central repository by maintaining a logical authorization tree which includes an authorization root, a policy sub-tree, and a realm sub-tree; wherein the policy sub-tree associates permissions with subjects that have received permissions; wherein the realm sub-tree identifies multiple realms served by the authentication tree, with a respective realm defining a separate namespace; and wherein a respective node on the realm sub-tree associates corresponding users in that realm with roles within that realm; receiving, at the computer system, an attempt by a first subject to perform said administrative action on the object permission; and determining, at the computer system, whether the first subject possesses access rights by: searching the realm sub-tree to identify the subject's role; and searching the policy sub-tree to determine the permissions granted to the subject's role.