System and method for controlling access to resources in a distributed environment

1. A computer implemented method for determining if a particular user is authorized to perform an operation on a particular resource, the method comprising:

providing resource hierarchy information describing hierarchical relationships between the particular resource and the particular resource's ancestor resources;

providing access list information for the resources in the resource hierarchy information; and

determining if a permission is asserted for the operation based on the resource hierarchy information and access list information for the resources in the resource hierarchy information;

wherein determining if the permission is asserted for the operation based on the resource hierarchy information and the access list information for the resources in the resource hierarchy information comprises:

(a) initializing a first resource collection to include the particular resource;

(b) determining if the permission is asserted for the operation in the access list information of the members of the first collection for the particular user;

(c) if the permission is not asserted, initializing a second resource collection to include only members of the first collection, and reinitializing the first resource collection, based on the resource hierarchy information, to include only parents of the members in the second resource collection;

(d) if the permission is not asserted, repeating steps (b) and (c) while the permission is not asserted and the first resource collection includes at least one ancestor resource of the particular resource; and

(e) if the permission is asserted, attributing the permission to the particular user for the operation to be performed on the particular resource.

2. The method of claim 1 wherein the permission for the operation is a positive permission indicating that the particular user is authorized to perform the operation on the particular resource, or a negative permission indicating that the particular user is prohibited from performing the operation on the particular resource.

3. The method of claim 1 wherein the access list information for the resources includes information indicating operations which can be performed on the resources, users which can perform operations on the resources, and permissions for the users and operations.

4. The method of claim 1 wherein determining if the permission has been asserted for the operation based on the resource hierarchy information and the access list information for the resources in the resource hierarchy information comprises:

determining if the permission is asserted for the operation in the access list information of the particular resource for the particular user;

if the permission is not asserted:

determining ancestor resources of the particular resource from the resource hierarchy information;

determining if the permission is asserted for the operation in the access list information of the ancestor resources for the particular user; and

if the permission is asserted for the operation in the access list information of the ancestor resources for the particular user, attributing the permission to the particular user for the operation to be performed on the particular resource; and

if the permission has been set for the user for the operation in the access list information of the particular resource, attributing the permission to the particular user for the operation to be performed on the particular resource.

5. The method of claim 1 further comprising:

if it cannot be determined if the permission is asserted based on the resource hierarchy information and the access list information of the resources in the resource hierarchy information;

providing user hierarchy information for the particular user, the user hierarchy information comprising information on hierarchical relationships between principals which include the particular user and the user's ancestors; and

determining if the permission has been asserted for the operation based on the user hierarchy information, the resource hierarchy information, and the access list information for the resources in the resource hierarchy information.

6. The method of claim 5 wherein determining if the permission is asserted for the operation based on the user hierarchy information, the resource hierarchy information, and access list information for the resources in the resource hierarchy information comprises:

determining ancestors of the particular user from the user hierarchy information;

determining if the permission is asserted for the operation in the access list information of the particular resource and ancestor resources of the particular for ancestors of the particular user; and

if the permission is asserted, attributing the permission to the particular user for the operation to be performed on the particular resource.

7. The method of claim 5 wherein determining if the permission is asserted for the operation based on the user hierarchy information, the resource hierarchy information, and access list information for the resources in the resource hierarchy information comprises:

(a) initializing a first variable to indicate a first user level;

(b) determining ancestors of the particular user from the resource hierarchy information at a level indicated by the first variable;

(c) determining if the permission is asserted for the operation in the access list information of the resources in the resource hierarchy information for the ancestor of the particular user determined in (b);

(d) if the permission is not asserted, incrementing the first variable by one user level;

(e) repeating (b), (c), and (d) while the permission is not asserted and the user hierarchy information comprises ancestors of the particular user at the level indicated by the first variable; and

(f) if the permission is asserted, attributing the permission to the particular user for the operation to be performed on the particular resource.