Granted Patent B1

US 8,397,056 · App. 12/763,582 · Granted Mar 12, 2013

Abstract

Claims (51)

1. A computer system, comprising:

a processor configured with:

a mashup section that provides a mashup that performs an action on a resource included in the mashup;

an attribute identification section that identifies an attribute of a user running the mashup to perform the action on the resource; and

an access control section providing an access control,

the mashup being associated to a permission artifact, the permission artifact specifying a principal and whether one of to permit and to prohibit the principal to take the action on the resource,

wherein

the access control is triggered only when the mashup attempts to perform the action on the resource,

the access control (i) checks whether the attribute of the user running the mashup to perform the action is predefined as belonging to the principal specified in the permission artifact associated to the mashup, and then (ii) performs the one of to permit and to prohibit the action on the resource only when the attribute belongs to the principal,

plural users that have a same single attribute belong to the principal when the same single attribute is defined as belonging to the principal, and

the permission artifact further specifies: (i) the resource used by the mashup and (ii) the action on the resource for which permission is needed.

2. The computer system of claim 1 , further comprising:

changing whether the single attribute belongs to the principal, thereby changing whether one of to permit and to prohibit the action on the resource for all of the plural users that have the same single attribute.

3. The computer system of claim 1 , the access control being separate from an authentication and an authorization passed through from the resource included in the mashup.

4. The computer system of claim 1 , the mashup further comprising an extensible access control markup language (XACML) attribute-based artifact, the running of the mashup with the XACML attribute-based artifact results in a second access control.

5. The computer system of claim 1 , further comprising

a user interface configured to specify, in the permission artifact, the principal, the action, the resource, and that the principal is one of permitted and prohibited from taking the action on the resource.

6. The computer system of claim 1 , further comprising associating the user as an owner of the mashup, only the owner of the mashup being allowed to set and update the permission artifact for the mashup.

7. A computer-implemented method for providing a mashup, comprising:

providing, in a processor, a mashup that performs an action on a resource included in the mashup;

identifying an attribute of a user running the mashup to perform the action on the resource; and

providing an access control,

the mashup being associated to a permission artifact, the permission artifact specifying a principal and whether one of to permit and to prohibit the principal to take the action on the resource,

wherein

the access control is triggered only when the mashup attempts to perform the action on the resource,

the access control (i) checks whether the attribute of the user running the mashup to perform the action is predefined as belonging to the principal specified in the permission artifact associated to the mashup, and then (ii) performs the one of to permit and to prohibit the action on the

resource only when the attribute belongs to the principal, plural users that have a same single attribute belong to the principal when the same single attribute is defined as belonging to the principal, and

the permission artifact further specifies: (i) the resource used by the mashup, and (ii) the action on the resource for which permission is needed.

8. The method of claim 7 , further comprising:

changing whether the single attribute belongs to the principal, thereby changing whether one of to permit and to prohibit the action on the resource for all of the plural users that have the same single attribute.

9. The method of claim 7 , the access control being separate from an authentication and an authorization passed through from the resource included in the mashup.

10. The method of claim 7 , the mashup further comprising an extensible access control markup language (XACML) attribute-based artifact, the running of the mashup with the XACML attribute-based artifact results in a second access control.

11. The method of claim 7 , further comprising

specifying, via a user interface, in the permission artifact, the principal, the action, the resource, and that the principal is one of permitted and prohibited from taking the action on the resource.

12. The method of claim 7 , further comprising associating the user as an owner of the mashup, only the owner of the mashup being allowed to set and update the permission artifact for the mashup.

13. A non-transitory computer-readable medium comprising instructions for execution by a computer, the instructions including a computer-implemented method for providing a mashup, the instructions for implementing:

providing a mashup that performs an action on a resource included in the mashup;

identifying an attribute of a user running the mashup to perform the action on the resource; and

providing an access control,

the mashup being associated to a permission artifact, the permission artifact specifying a principal and whether one of to permit and to prohibit the principal to take the action on the resource,

wherein

the access control is triggered only when the mashup attempts to perform the action on the resource,

the access control (i) checks whether the attribute of the user running the mashup to perform the action is predefined as belonging to the principal specified in the permission artifact associated to the mashup, and then (ii) performs the one of to permit and to prohibit the action on the resource only when the attribute belongs to the principal,

plural users that have a same single attribute belong to the principal when the same single attribute is defined as belonging to the principal, and

the permission artifact further specifies: (i) the resource used by the mashup, and (ii) the action on the resource for which permission is needed.

14. The computer-readable medium of claim 13 , further comprising:

changing whether the single attribute belongs to the principal, thereby changing whether one of to permit and to prohibit the action on the resource for all of the plural users that have the same single attribute.

15. The computer-readable medium of claim 13 , the mashup further comprising an extensible access control markup language (XACML) attribute-based artifact, the running of the mashup with the XACML attribute-based artifact results in a second access control.

16. The computer-readable medium of claim 13 , further comprising

specifying, via a user interface, in the permission artifact, the principal, the action, the resource, and that the principal is one of permitted and prohibited from taking the action on the resource.

17. The computer-readable medium of claim 13 , further comprising associating the user as an owner of the mashup, only the owner of the mashup being allowed to set and update the permission artifact for the mashup.

Assignments (8)