On-demand authorization management
View Patent ↗Methods and apparatus, including computer program products, are provided for authorization management. In one aspect, there is provided a computer-implemented method. The method may include receiving a request to authorize at least one user to at least one module of a system; mapping the received request to a semantic tag; processing, based on the semantic tag, the request to authorize the at least one user to determine whether to grant the at least one user access to the at least one module; and sending a response to the request to authorize the at least one user, wherein the response is in accordance with the result of the processing. Related apparatus, systems, methods, and articles are also described.
1. A non-transitory computer-readable storage medium containing instructions to configure at least one processor to cause operations comprising:
receiving a request to authorize at least one user to at least one module of a system;
determining at least one of a role or a work center of the at least one user;
mapping, based on the determining, the received request in a first format to a semantic tag in a common format, wherein the common format indicates the at least one of the role or the work center;
processing, based on the semantic tag in the common format, the request to authorize the at least one user to determine whether to grant the at least one user access to the at least one module; and
detecting, based on at least one segregation of duty rule, whether the request by the at least one user poses a segregation of duty violation, wherein the at least one segregation of duty rule represents a rule to segregate an action indicated by the received request from the determined at least one of the role or the work center of the at least one user; and
authorizing, when the processing grants the access and the segregation of duty violation is not detected, the at least one user access to the at least one module;
sending a first message indicating the authorizing, when the processing grants the access and the segregation of duty violation is not detected;
sending a second message indicating access is not granted, when at least one of the processing does not grant the access or the segregation of duty violation is detected.
2. The computer-readable storage medium of claim 1 , wherein the at least one module is implemented as at least one of an on-premises module and an on-demand module.
3. The computer-readable storage medium of claim 1 further comprising:
converting the first message to at least one of the first format or a second format before sending the first message.
4. A method comprising:
receiving a request to authorize at least one user to at least one module of a system;
determining at least one of a role or a work center of the at least one user;
mapping, based on the determining, the received request in a first format to a semantic tag in a common format, wherein the common format indicates the at least one of the role or the work center;
processing, based on the semantic tag in the common format, the request to authorize the at least one user to determine whether to grant the at least one user access to the at least one module; and
detecting, based on at least one segregation of duty rule, whether the request by the at least one user poses a segregation of duty violation, wherein the at least one segregation of duty rule represents a rule to segregate an action indicated by the received request from the determined at least one of the role or the work center of the at least one user; and
authorizing, when the processing grants the access and the segregation of duty violation is not detected, the at least one user access to the at least one module;
sending a first message indicating the authorizing, when the processing grants the access and the segregation of duty violation is not detected;
sending a second message indicating access is not granted, when at least one of the processing does not grant the access or the segregation of duty violation is detected.
5. The method of claim 4 , wherein the at least one module is implemented as at least one of an on-premises module and an on-demand module.
6. The method of claim 4 further comprising:
converting the first message to at least one of the first format or a second format before sending the first message.
7. A system comprising:
at least one processor; and
at least one memory including code which when executed by the at least one processor causes operations comprising:
receiving a request to authorize at least one user to at least one module of a system;
determining at least one of a role or a work center of the at least one user;
mapping, based on the determining, the received request in a first format to a semantic tag in a common format, wherein the common format indicates the at least one of the role or the work center;
processing, based on the semantic tag in the common format, the request to authorize the at least one user to determine whether to grant the at least one user access to the at least one module; and
detecting, based on at least one segregation of duty rule, whether the request by the at least one user poses a segregation of duty violation, wherein the at least one segregation of duty rule represents a rule to segregate an action indicated by the received request from the determined at least one of the role or the work center of the at least one user; and
authorizing, when the processing grants the access and the segregation of duty violation is not detected, the at least one user access to the at least one module;
sending a first message indicating the authorizing, when the processing grants the access and the segregation of duty violation is not detected;
sending a second message indicating access is not granted, when at least one of the processing does not grant the access or the segregation of duty violation is detected.
8. The system of claim 7 , wherein the at least one module is implemented as at least one of an on-premises module and an on-demand module.
9. The system of claim 7 further comprising:
converting the first message to at least one of the first format or a second format before sending the first message.