초록 ▼

A single secure sign-on gives a user access to authorized Web resources, based on the user's role in the organization that controls the Web resources. The information resources are stored on a protected Web server. A user of a client or browser logs in to the system. A runtime module on the protecte

A single secure sign-on gives a user access to authorized Web resources, based on the user's role in the organization that controls the Web resources. The information resources are stored on a protected Web server. A user of a client or browser logs in to the system. A runtime module on the protected server receives the login request and intercepts all other request by the client to use a resource. The runtime module connects to an access server that can determine whether a particular user is authentic and which resources the user is authorized to access. User information is associated with roles and functional groups of an organization to which the user belongs; the roles are associated with access privileges. The access server connects to a registry server that stores information about users, roles, functional groups, resources, and associations among them. The access server and registry server exchange encrypted information that authorized the user to use the resource. The user is presented with a customized Web page showing only those resources that the user may access. Thereafter, the access server can resolve requests to use other resources without contacting the registry server. The registry server controls a flexible, extensible, additive data model stored in a database that describes the user, the resources, roles of the user, and functional groups in the enterprise that are associated with the user.

대표청구항 ▼

1. In a World Wide Web computer system, a computer-implemented method of controlling access to one or more resources to which access is controlled through a Web server, the method comprising the steps of:the Web server receiving information describing a user; said Web server causing transmission of

1. In a World Wide Web computer system, a computer-implemented method of controlling access to one or more resources to which access is controlled through a Web server, the method comprising the steps of:the Web server receiving information describing a user; said Web server causing transmission of said information describing said user to a Web application server; said Web application server receiving said information describing said user; in response to receiving said information describing said user: said Web application server identifying a subset of the one or more resources that the user is authorized to access, based on stored information describing one or more roles and one or more access rights of the user that are stored in association with user identifying information, and said Web application server communicating information defining the subset to the Web server; said Web server storing said information defining the subset; communicating, to a client that is associated with the user, a Web page containing links to only those resources that the user is authorized to access, based on the user's role within an enterprise that controls the resources; after communicating information defining the subset, said Web server receiving one or more requests from said client to access said one or more resources; and said Web server resolving whether to grant said one or more requests based on said information defining the subset.