Identity cloud service authorization model with dynamic roles and scopes

Patent metadata

Field	Value
Publication number	US-10878079-B2
Application number	US-201715590482-A
Country	US
Kind code	B2
Filing date	May 9, 2017
Priority date	May 11, 2016
Publication date	Dec 29, 2020
Grant date	Dec 29, 2020

Abstract

A system for authorizing access to a resource associated with a tenancy in an identity management system that includes a plurality of tenancies receives an access token request for an access token that corresponds to the resource, the request including user information and application information, the user information including roles of a user and the application information including roles of the application. The system evaluates the access token request by computing dynamic roles and corresponding dynamic scopes for the access token including a second intersection between the dynamic roles of the user and the dynamic roles of the application. The system then provides the access token that includes the computed static scopes, where the scopes are based at least on the roles of the user and the roles of the application, and further including the computed dynamic roles and corresponding dynamic scopes.

First claim

What is claimed is:

1. A method of authorizing access to a resource associated with a tenancy in an identity management system that comprises a plurality of tenancies, the method comprising:
receiving at the identity management system an access token request from a client for an access token that corresponds to the resource, wherein the request comprises user information and application information, the user information comprising roles of a user and the application information comprising roles of an application;
determining dynamic roles for the user and dynamic roles for the application;
evaluating the access token request by computing static scopes for the access token comprising determining a first intersection between the user information and the application information;
evaluating the access token request by computing dynamic roles and corresponding dynamic scopes for the access token comprising a second intersection between the dynamic roles of the user and the dynamic roles of the application, the dynamic scopes based at least on a first tenancy that corresponds to the user;
generating and providing the access token to the client, the generated access token comprising the computed static scopes as a first claim that is encoded in the access token, wherein the static scopes are based at least on roles of the user and the roles of the application, and further comprising the computed dynamic roles and corresponding dynamic scopes as a second claim that is different than the first claim and is encoded in the access token;
after providing the access token to the client, determining, at the identity management system, access to a resource in response to receiving, from the client, the access token with an access authorization request, the determining access comprising:
fetching the dynamic roles from the second claim of the access token;
evaluating a dynamic policy that corresponds to the dynamic roles, wherein the evaluating the dynamic policy comprises evaluating a condition associated with the dynamic policy; and
based on the evaluating the dynamic policy, adding the dynamic scopes to the static scopes from the first claim of the access token to generate allowed scopes for the access authorization request.

2. The method of claim 1 , wherein the resource is protected from access based at least on a tenancy of an access requesting user or an access requesting application, and the access token request further comprises a corresponding tenant of the user, and an indication of whether the user is an administrator for the application.

3. The method of claim 2 , wherein the access token comprises custom token claims indicating whether the user is the administrator for the application.

4. The method of claim 1 , wherein when an OnBehalfOfUser property is true, the second intersection include the dynamic roles of the application and the dynamic roles of the user when present.

5. The method of claim 1 , wherein providing the access token comprises recording a tuple comprising the dynamic roles and the corresponding dynamic scopes.

6. The method of claim 1 , wherein the dynamic scopes comprise OAuth scopes and the client comprises an OAuth client and comprises the user or the application.

7. The method of claim 2 , wherein the determining access to the resource is based on an eXtensible Access Control Markup Language (XACML) based authorization policy.

8. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, authorizes access to a resource associated with a tenancy in an identity management system that comprises a plurality of tenancies, the authorizes access comprising:
receiving at the identity management system an access token request from a client for an access token that corresponds to the resource, wherein the request comprises user information and application information, the user information comprising roles of a user and the application information comprising roles of an application;
determining dynamic roles for the user and dynamic roles for the application;
evaluating the access token request by computing static scopes for the access token comprising determining a first intersection between the user information and the application information;
evaluating the access token request by computing dynamic roles and corresponding dynamic scopes for the access token comprising a second intersection between the dynamic roles of the user and the dynamic roles of the application, the dynamic scopes based at least on a first tenancy that corresponds to the user;
generating and providing the access token to the client, the generated access token comprising the computed static scopes as a first claim that is encoded in the access token, wherein the static scopes are based at least on roles of the user and the roles of the application, and further comprising the computed dynamic roles and corresponding dynamic scopes as a second claim that is different than the first claim and is encoded in the access token;
after providing the access token to the client, determining, at the identity management system, access to a resource in response to receiving, from the client, the access token with an access authorization request, the determining access comprising:
fetching the dynamic roles from the second claim of the access token;
evaluating a dynamic policy that corresponds to the dynamic roles, wherein the evaluating the dynamic policy comprises evaluating a condition associated with the dynamic policy; and
based on the evaluating the dynamic policy, adding the dynamic scopes to the static scopes from the first claim of the access token to generate allowed scopes for the access authorization request.

9. The computer readable medium of claim 8 , wherein the resource is protected from access based at least on a tenancy of an access requesting user or an access requesting application, and the access token request further comprises a corresponding tenant of the user, and an indication of whether the user is an administrator for the application.

10. The computer readable medium of claim 9 , wherein the access token comprises custom token claims indicating whether the user is the administrator for the application.

11. The computer readable medium of claim 8 , wherein when an OnBehalfOfUser property is true, the second intersection include the dynamic roles of the application and the dynamic roles of the user when present.

12. The computer readable medium of claim 8 , wherein providing the access token comprises recording a tuple comprising the dynamic roles and the corresponding dynamic scopes.

13. The computer readable medium of claim 8 , wherein the dynamic scopes comprise OAuth scopes and the client comprises an OAuth client and comprises the user or the application.

14. The computer readable medium of claim 9 , wherein the determining access to the resource is based on an eXtensible Access Control Markup Language (XACML) based authorization policy.

15. A cloud based system for authorizing access to a resource associated with a tenancy in an identity management system that comprises a plurality of tenancies, the system comprising:
one or more processors that execute instructions to implements a microservice, a microservice functionality comprising:
receiving at the identity management system an access token request from a client for an access token that corresponds to the resource, wherein the request comprises user information and application information, the user information comprising roles of a user and the application information comprising roles of an applicatio

Assignees

• Oracle Int Corp

Inventors

• Vepa Sirish V
• Katti Sreedhar
• Dhaduk Maheshkumar Shivlal
• Lander Vadim

Classifications

• G06F21/335

  for accessing specific resources, e.g. using Kerberos tickets · CPC title

• G06F21/629

  to features or functions of an application · CPC title

• G06F21/34

  involving the use of external additional devices, e.g. dongles or smart cards · CPC title

• G06F21/445 Primary

  by mutual authentication, e.g. between devices or programs · CPC title