Patent ID: 8224873

Claim:
For a security access manager of a data management system of an enterprise, a method of authenticating and authorizing a user of a client application to access secure data resources, said method comprising: providing a first security module for (i) receiving, from the client application which authenticates an identity of the user against an external user directory that operates outside of the data management system, a request comprising the identity of the user, (ii) accessing the external user directory, and (iii) verifying the identity against the external user directory; providing a second security module for performing a first level authorization upon verification of the identity by (i) accessing an external role repository that operates outside of the data management system, (ii) retrieving an enterprise role associated with the identity from the external role repository, and (iii) associating the enterprise role with an internal role that provides access to a set of secured data resources; and providing a third security module for performing a second level authorization upon performing the first level authorization by (i) retrieving a set of internal policy definitions and (ii) restricting access to a subset of the set of secured resources using the set of internal policy definitions, wherein said first, second, and third security modules are modules of the security access manager.