System and method for enforcing role membership removal requirements

摘要

System and method for enforcing role membership removal requirements are described. In one embodiment, the method includes, responsive to receipt of a removal request, performing a role evaluation of the removal request to generate a policy request; performing a policy evaluation of the policy request; generating a policy response in accordance with the policy evaluation; and enforcing the policy response.

主权项

1. A computer-implemented method for enforcing role membership removal requirements in a role-based system, the method comprising:
responsive to receipt of a removal request, performing a role evaluation of the removal request to generate a policy request, wherein the performing a role evaluation is executed by a computer-implemented role manager, and the policy request is associated with the removal request; performing a policy evaluation of the policy request; generating a policy response in accordance with the policy evaluation; and enforcing the policy response, wherein the policy response is responsive to the removal request and includes doing nothing or doing at least one action; wherein the performing a role evaluation, performing a policy evaluation, generating, and enforcing are all performed by a computer and further comprises checking for applicable conditions based on a role relationship, wherein the relationship is defined by at least one of a nested group and an aggregation.