Identity-based address normalization

1. A machine-implemented method residing in a non-transitory machine-readable medium and to execute on a machine, comprising:

receiving, by the machine, an electronic address for accessing a resource, the electronic address is received from a principal for purposes of gaining access to the resource;

resolving, by the machine, a resource identity for the resource and a principal identity for the principal;

determining, by the machine, a set of patterns that the electronic address can be represented as based on the resource identity and the principal identity, the set of patterns are identity-based and determined based on the resource identity and the principal identity, and the set of patterns include constant and hard coded information along with variable and regular expression information, one or more of said patterns being dynamically defined in real time;

attempting, by the machine, to match the electronic address against the set of patterns when policy dictates;

normalizing, by the machine, the electronic address in response to a matched pattern into a normalized address, the normalized address is to a location for the principal to retrieve the resource based on the principal identity and the resource identity;

querying the address pattern repository using the principal identity for the principal and the resource identity for the resource; and

enforcing, by the machine, one or more actions against the principal before directing the principal to the resource for access in response to the normalized address, the normalized address permits designated services to process the one or more actions before the principal accesses the resource via the location identified in the normalized address and the designated services customized based on the principal identity and the resource identity and the one or more actions affect security to access the resource, auditing with respect to accessing the resource, and load balancing for the resource when the resource is accessed at the location.

2. The method of claim 1 , wherein receiving further includes receiving the electronic address via a WWW browser in response to a principal supplied or activated link, within the WWW browser, representing a Uniform Resource Locator (URL) link or Universal Resource Identifier (URI) link.

3. The method of claim 1 , wherein receiving further includes receiving the electronic address in response to a Hypertext Transfer Protocol (HTTP) command or a File Transfer Protocol (FTP) command issued from the principal to access the resource.

4. The method of claim 1 , wherein resolving further includes consulting a remote identity service to supply authentication services or identity-resolution services for resolving the resource identity and the principal identity.

5. The method of claim 1 , wherein said determining comprises dynamically defining said one or more address patterns in real time by an administrator, and further includes accessing a pattern repository with at least one of the resource identity and the principal identity to acquire the set of patterns.

6. The method of claim 1 , wherein attempting further includes bypassing the matching when the policy permits for the principal and in response to the principal identity for the principal and considering the principal supplied electronic address to be matched and the normalized address.

7. The method of claim 1 , wherein attempting further includes bypassing the matching when the policy permits for the resource and in response to the resource identity and considering the principal supplied electronic address to be matched and the normalized address.

8. A machine-implemented method residing in a non-transitory machine-readable medium and to execute on a machine, comprising:

acquiring, by the machine, an address pattern for referencing a resource, wherein the address pattern is tied and customized to a principal identity for a principal attempting to access the resource and tied and customized to a resource identity for the resource and the address pattern includes constant and hard coded information along with variable and regular expression information, said address pattern being dynamically defined in real time;

matching, by the machine, the address pattern to an electronic address supplied by the principal, wherein the principal is attempting to access the resource and the matching to the address pattern occurs based on and customized to the principal identity and the resource identity;

normalizing, by the machine, the electronic address to a normalized address for the resource customized to and based on the principal identity and the resource identity, the normalized address being to a location for the principal to retrieve the resource based on the principal identity and the resource identity;

querying an address pattern repository using the principal identity for the principal and the resource identity for the resource; and

routing, by the machine, the principal to the resource via the normalized address and processing one or more designated services before the principal accesses the resource, the one or more designated services affect security with respect to accessing the resource, auditing with respect to accessing the resource, and load balancing when accessing the resource.

9. The method of claim 8 , wherein acquiring further includes interacting with an administrator via a graphical user interface to receive the address pattern as the regular expression that defines the address pattern, said administrator defining the address pattern in real time.

10. The method of claim 9 further comprising, dynamically updating, by the machine, a repository of patterns with the address pattern when the administrator commits the address pattern for update.

11. The method of claim 8 , wherein matching further includes using a set of additional patterns to compare against the electronic address before matching the electronic address to the address pattern.

12. The method of claim 8 , wherein normalizing further includes receiving the modification instructions for producing the normalized address from the resource.

13. The method of claim 8 , wherein normalizing further includes receiving modification instructions for producing the normalized address from a policy decision point service.

14. The method of claim 8 , wherein normalizing further includes altering, modifying, or editing a path associated with the electronic address to produce the normalized address.

15. A machine-implemented method residing in a non-transitory machine-readable medium and to execute on a machine, comprising:

intercepting, by the machine, a Uniform Resource Locator (URL) address supplied by a principal and directed to a resource;

acquiring, by the machine, a principal identity for the principal and a resource identity for the resource that the principal is attempting to access via the URL address;

normalizing the URL address to a normalized address for the principal to retrieve the resource based upon the principal identity and the resource identity;

querying an address pattern repository using the principal identity for the principal and the resource identity for the resource;

accessing, by the machine, the address pattern repository in response to the principal identity and the resource identity to acquire a set of candidate patterns for references made to the resource, the candidate patterns being customized based on the principal identity and the resource identity and each of the candidate patterns includes constant and hard coded information along with variable and regular expression information, one or more of said candidate patterns being dynamically defined in real time;

comparing, by the machine, the set of candidate patterns against the URL address supplied by the principal;

matching, by the machine, a particular pattern to the URL address, the particular pattern being customized based on the principal identity and the resource identity;

processing, by the machine, an action in response to the particular pattern matched, the action processed when the principal uses the particular pattern to access the resource and before the principal is given access to the resource and the action affects security when accessing the resource.

16. The method of claim 15 further comprising, processing, by the machine, the method as a reverse proxy service for the resource.

17. The method of claim 15 , wherein acquiring further includes asking an identity service to supply and verify the principal identity and the resource identity.

18. The method of claim 15 , wherein accessing further includes dynamically obtaining at least one pattern in the set of patterns from an administrator in real-time, and wherein said administrator defines said one or more address patterns.

19. The method of claim 15 , wherein processing further includes normalizing the URL address and enforcing access restrictions in response to a normalized URL address.

20. The method of claim 15 , wherein processing further includes assigning access privileges to the resource in response to the principal identity.

21. A machine-implemented system, comprising:

an address pattern repository implemented in a non-transitory machine-accessible and readable medium and accessible to an address normalization service that processes address patterns included in the address pattern repository, the address patterns including constant and hard coded information along with variable and regular expression information, one or more of said address patterns being dynamically defined in real time; and

the address normalization service implemented in a non-transitory machine-accessible and readable medium to process on a machine, wherein the address normalization service is to process principal supplied addresses for resources by querying the address pattern repository using principal identities for the principals and resource identities for the resources to acquire selective and customized address patterns based on the principal identities and the resource identities, the customized address patterns are then attempted to be matched to the principal supplied addresses and when matches occur the principal supplied addresses are normalized into normalized addresses and policies applied before the principals are forwarded to the resources associated with the normalized addresses, the normalized addresses being to locations for a principal to retrieve a resource based on the principal identity and the resource identity, the normalized addresses and policies are customized based on the principal identities and the resource identities and when a particular principal uses a particular normalized address to access a particular resource a particular policy is enforced and one or more designated services are processed before access is given to the particular resource.

22. The system of claim 21 further comprising, an identity service that supplies or verifies the principal identities on behalf of the address normalization service, the identity service implemented and residing in a non-transitory machine-readable medium and to execute on the machine.

23. The system of claim 21 , wherein at least some of said one or more address patterns are dynamically defined in real time by an administrator via a graphical user interface and dynamically updated to the address pattern repository and dynamically made available to the address normalization service.

24. The system of claim 21 , wherein at least one policy assigns access rights to the resources or assigns roles to the principals for accessing the resources.

25. The system of claim 21 , wherein the principal supplied addresses are received via a World-Wide Web (WWW) browser as Uniform Resource Locator (URL) references or Universal Resource Identifier (URI) references.