Catalog-Based User Authorization to Access to Multiple Applications

Patent metadata

Field	Value
Publication number	US-2016379002-A1
Application number	US-201514752417-A
Country	US
Kind code	A1
Filing date	Jun 26, 2015
Priority date	Jun 26, 2015
Publication date	Dec 29, 2016
Grant date	—

Abstract

Embodiments manage user authorization to access multiple grouped software applications, via a catalog mechanism. Functionality of related software is divided into semantically meaningful catalogs, representing tasks or sub-processes within a business scenario. These catalogs represent a unit of functionality utilized to structure work and authorization. Functionality and authorizations are associated to system entry points, and assigned to catalogs bundling applications and services. Responsibilities may be defined statically or dynamically in terms of rule-based access restrictions to data structure (e.g., business object) instances. Catalogs may be assigned to business roles, and business roles assigned to users. Based on such assignments, corresponding authorizations are generated and linked to users at compile or deployment time. At run time, access decision and enforcement is granted based on these authorizations and restrictions. Decision and enforcement points are associated with the system entry points within software applications belonging to catalog(s).

First claim

1 . (canceled)

2 . A computer-implemented method of providing entry point security as in claim 7 wherein:
the first software application comprises a first functionality;
the catalog further comprises a restriction; and
the method further comprises the engine granting the user access to the first functionality according to the restriction.

3 . A computer-implemented method of providing entry point security as in claim 2 further comprising assigning a value of the restriction at design time.

4 . A computer-implemented method of providing entry point security as in claim 2 further comprising assigning a value of the restriction by evaluating the rule at runtime.

5 . (canceled)

6 . A computer-implemented method of providing entry point security as in claim 7 wherein the read authorization is instance-based.

7 . A computer-implemented method of providing entry point security, the method comprising:
an in-memory database engine of an in-memory database receiving a role from a user; and based upon the role and a stored rule, the in-memory database engine granting the user a read authorization from a catalog that is part of the in-memory database to access a first system entry point of a first software application, and to access a second system entry point of a second software application; wherein the in-memory database engine grants the read authorization based upon a WHERE-clause expressed via a data control language and pushed down to the in-memory database.

8 . A computer-implemented method of providing entry point security as in claim 7 wherein the first system entry point comprises an HTML graphic user interface.

9 . A computer-implemented method of providing entry point security as in claim 7 wherein the first system entry point is utilized in a key performance indicator.

10 . (canceled)

11 . A non-transitory computer readable storage medium as in claim 15 wherein the method of providing entry point security further comprising assigning a value of the restriction at design time.

12 . A non-transitory computer readable storage medium as in claim 15 wherein the method of providing entry point security further comprises assigning a value of the restriction by evaluating the rule at runtime.

13 . (canceled)

14 . A non-transitory computer readable storage medium as in claim 15 wherein the authorization is instance-based.

15 . A non-transitory computer readable storage medium embodying a computer program for performing a method of providing entry point security, said method comprising:
an in-memory database engine of an in-memory database receiving a role from a user; and based upon the role and a stored rule, the in-memory database engine granting the user an authorization from a catalog that is part of the in-memory database to access a first system entry point of a first software application, and to access a second system entry point of a second software application, wherein, the first software application comprises a first functionality; the catalog further comprises a restriction; and the method further comprises the in-memory database engine granting the user access to the first functionality according to the restriction; wherein the in-memory database engine grants the authorization based upon a WHERE-clause expressed via a data control language and pushed down to the in-memory database.

16 . A non-transitory computer readable storage medium as in claim 15 wherein the first system entry point is utilized in a key performance indicator.

17 . (canceled)

18 . A computer system implementing entry point security as in claim 20 wherein:
the first software application comprises a first functionality;
the catalog further comprises a restriction; and
the software application further causes the engine to grant the user access to the first functionality according to the restriction.

19 . A computer system implementing entry point security as in claim 20 wherein the authorization is instance-based.

20 . A computer system implementing entry point security and comprising:
one or more processors; a software program, executable on said computer system, the software program configured to cause an in-memory database engine of an in-memory database to: receive a role from a user; and based upon the role and a stored rule, grant the user an authorization from a catalog that is part of the in-memory database to access a first system entry point of a first software application, and to access a second system entry point of a second software application; wherein the software program is configured to cause the in-memory database engine to grant the user access based upon a WHERE-clause expressed via a data control language and pushed down to the in-memory database.

Assignees

• Sap Se

Inventors

• Drabant Bernhard
• Drittler Bernhard
• Lucius Roland
• Schmid Martin

Classifications

• G06F21/6236 Primary

  between heterogeneous systems · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F21/31

  User authentication · CPC title