Patent ID: 7404203

Claim:
A method of administering access to computing resources distributed among multiple address spaces, the method comprising: maintaining a central database of capability-based access policies, wherein each said capability-based access policy grants a subject one or more access permissions to a resource, wherein maintaining the central database of capability-based access policies comprises maintaining a logical authorization tree which includes an authorization root, and wherein the logical authorization tree comprises a policy sub-tree and a realm sub-tree; and at each of a plurality of distributed computing nodes, wherein each of said distributed computing nodes defines a different Java address space: receiving a connection from a user; granting the user one or more memberships to one or more roles; invoking an interface with the central database to retrieve a capability-based access policy for each role associated with the user; and applying said capability-based access policy to determine whether to permit the user access to a requested resource of the computing node, wherein said capability-based access policy is distributed, thereby enabling said capability-based access policy to be applied to said distributed computing nodes across multiple Java address spaces.