Patent ID: 8015301

Claim:
A method implemented in a non-transitory computer-readable medium and for executing on a proxy server the method for policy and attribute based access to a resource, comprising: receiving, at the proxy server, a session request for access to a resource, the session request is sent from a service and includes alias identity information for a principal, the alias identity information includes a random password and a random principal identification, the alias identity information is randomly generated for identity information, the identity information identifies a true identity for the principal; mapping, by the proxy server, the alias identity information to the identity information of the principal, the identity information associated with the true identity of the principal whereas the alias identity information is the random password and the random principal identification and the identity information and the true identity of the principal is available to the proxy server but not the service or the resource; authenticating, by the proxy server, the identity information; acquiring, by the proxy server, a service contract for the principal, the service, and the resource, the service contract is derived from an identity configuration for the principal and the identity configuration represents aggregated access policies and attributes for the principal with respect to the resource and all known services that are available to the principal, each service is an application or system that the principal uses to gain access to the resource; obtaining from the service contract selective resource access policies and attributes which are permissibly used by the service when accessing the resource on behalf of the principal; defining, via the service contract, a tripartite relationship among the principal, the service, and the resource, the service contract is derived from an identity configuration of the principal, the service contract including security strictures for the tripartite relationship including the selective resource access policies and the attributes, the access policies define operations that the service can and cannot perform on behalf of the principal against the attributes of the resource the attributes define specific data fields defined within the resource; establishing, by the proxy server, a session with the service, the session is controlled by the service contract, the service interacts through the proxy server with a Lightweight Directory Access Protocol (LDAP) legacy interface for the resource to make access requests for the principal in a format that is handled by the LDAP legacy interface and the LDAP legacy interface is not modified to handle the access requests, the access requests are in accordance with the service contract; and managing, at the proxy server, the session by acting as an intermediary between the service and the legacy LDAP interface which has access privileges to the resource.