Flexible Role Based Authorization Model

摘要

Systems and methods described herein relate to role-based authorization systems which allow customization of role templates as well as the ability, using roles, for one user to act on behalf of another user.

主权项

1. A computer machine system comprising one or more computer machines wherein said computer machine system further comprises:
at least one computer memory comprising a rights database configured to store:
a set of roles wherein each role is associated with one or more capabilities;a set of user identifiers wherein each user identifier is associated with:
a specific user;one or more roles from said set of roles; andone or more capabilities from each of said roles; at least one policy decision point configured to authorize a service request received from a policy enforcement point wherein:
said policy decision point determines if a first set of capabilities allocated to a first role, wherein said first role is specified in a request header associated with said service request, matches a set of required privileges necessary to perform said service request;said policy decision point determines if a second set of capabilities allocated to a first user, wherein said first user is specified in said request header, acting as said first role matches said set of required privileges necessary to perform said service request.