FLEXIBLE AUTHENTICATION FRAMEWORK

摘要

A flexible and extensible architecture allows for secure searching across an enterprise. Such an architecture can provide a simple Internet-like search experience to users searching secure content inside (and outside) the enterprise. The architecture allows for the crawling and searching of a variety of sources across an enterprise, regardless of whether any of these sources conform to a conventional user role model. The architecture further allows for security attributes to be received at query time, for example, in order to provide real-time secure access to enterprise resources. The user query also can be transformed to provide for dynamic querying that provides for a more current result list than can be obtained for static queries.

主权项

1. A method comprising:
crawling, by a computer system, a plurality of secure data stores; generating, by the computer system, an index of a plurality of documents from across the plurality of data stores, wherein:
each of the plurality of documents is associated with one or more security attributes; andeach of the one or more security attributes for each of the plurality of documents is associated with a set of acceptable security attribute values; storing, by the computer system, in the index, for each document in the plurality of documents, the one or more security attributes of the document and each corresponding set of acceptable security attribute values; receiving, by the computer system, a query from a client device; in response to receiving the query, obtaining, by the computer system, security information for a user of the client device, the security information comprising one or more security attributes of the user and one or more security attribute values for each of the one or more security attributes of the user; selecting, by the computer system, each document in the index that is responsive to the query and where, for each of the one or more security attribute of the document:
the security attribute of the document matches at least one of the one or more security attributes of the user; andat least one of the one or more security attribute values of the at least one of the one or more security attributes of the user falls within the set of acceptable security attribute values of the security attribute of the document; and transmitting, by the computer system, each selected document in the index as a result set to the client device.