DYNAMIC IDENTITY SWITCHING

摘要

Techniques are disclosed for dynamically switching user identity when generating a web service request by receiving, at a client application, an invocation of a web service, the invocation associated with a first authenticated user identity of a first user, identifying a second user identity, verifying that a switch from the first user identity to the second user identity is permitted by switching rules, including the second user identity in a service request when the switch is permitted, and communicating the service request to the web service. The switching rules can include associations between initial user identities and permitted user identities. Verifying that a switch is permitted can include searching the associations for an entry having an initial user identity that matches the first authenticated user identity and a new user identity that matches the second user identity, wherein the switch is permitted when the entry is found.

主权项

1. A method comprising:
receiving, by a computer system, an invocation by a web application acting as a web service client of a web service, the invocation comprising a first property representing a first identity using the web application and a second property representing a second identity declared to be propagateable in web service invocations; determining, by the computer, a set of one or more switching rules using the first identity and the second identity in the invocation of the web service, verifying, by the computer system, during runtime that a switch from the first identity to the second identity is permitted by applying the set of one or more switching rules and determining that the web application is a permitted application in accordance with a permission object; including, by the computer system, the second identity in the second property in a service request to the web service when the switch is permitted; communicating, by the computer system, the service request to the web service; and executing, by the web service, a task using the second identity.