Dynamic Identity Switching in Web Service Clients
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In enterprise Web service and SOA environments, existing technologies face challenges in dynamically switching user identities to accommodate tasks requiring different authorization privileges, as user identity information is typically propagated based on the authenticated subject and does not allow for switching to alternative users with more extensive permissions at runtime.
Innovation Solution
A method and system for dynamically switching user identities by receiving a web service invocation associated with a first authenticated user, identifying a second user identity based on preconfigured or runtime-determined switching rules, and including the second user identity in the service request, allowing for permission verification and communication to the web service.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user identity information is propagated based on the authenticated subject, then security and authentication reliability are improved, but the system cannot switch to alternative users with different authorization privileges at runtime
Solution Approach 1:
The patent implements dynamic identity switching by allowing the system to change the user identity context at runtime based on switching rules. The identity context is no longer static but can be dynamically adjusted to match different authorization requirements for specific web service operations, while maintaining the authenticated subject's identity as the base context.
Solution Approach 2:
The system changes the identity parameter dynamically by evaluating switching rules that determine whether to use the authenticated subject's identity or an alternative identity. This parameter change allows the same authenticated user to invoke services under different identity contexts depending on the specific operation and authorization requirements.
2Ease of operation
If the authenticated subject's identity is always used, then identity propagation is simple and reliable, but tasks requiring different authorization levels cannot be completed
Solution Approach 1:
The patent introduces switching rules as an intermediary mechanism between the authenticated subject and the identity used for service invocation. These rules evaluate whether to propagate the subject's identity directly or switch to an alternative identity, providing a structured way to handle authorization requirements without complicating the basic identity propagation process.
3Adaptability or versatility
If identity switching is implemented, then authorization flexibility is improved, but system complexity increases due to switching rules verification
Solution Approach 1:
The system performs preliminary evaluation of switching rules before identity propagation to determine the appropriate identity context. By evaluating the switching rules in advance and caching the determination, the system avoids complex runtime decisions during service invocation, reducing the perceived complexity during actual operation.
Data Source
AI summary
Techniques are disclosed for dynamically switching user identity when generating a web service request by receiving, at a client application, an invocation of a web service, the invocation associated with a first authenticated user identity of a first user, identifying a second user identity, verifying that a switch from the first user identity to the second user identity is permitted by switching rules, including the second user identity in a service request when the switch is permitted, and communicating the service request to the web service. The switching rules can include associations between initial user identities and permitted user identities. Verifying that a switch is permitted can include searching the associations for an entry having an initial user identity that matches the first authenticated user identity and a new user identity that matches the second user identity, wherein the switch is permitted when the entry is found.