Pluggable Authorization Framework for JAAS Customization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing Java Authentication Authorization Service (JAAS) security model is inflexible and requires significant coding for customization, making it difficult to accommodate custom security repositories and change access control mechanisms, especially in enterprise applications.
Innovation Solution
An authorization framework with a plugin architecture that allows multiple pluggable modules to make weighted and combined authorization decisions, enabling dynamic addition of new authorizations without modifying the existing code base, using a configurable criteria or policy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If JAAS uses a code-centric or user-centric security model with policy files, then authorization decisions can be made based on trust evaluation, but customization to accommodate custom security repositories requires significant coding and understanding of JAAS modules
Solution Approach 1:
The patent divides the authorization framework into separate pluggable modules (authentication module, authorization module, policy module) that can be independently configured and exchanged. This segmentation allows customization of security repositories without requiring modifications to the core JAAS architecture, reducing coding complexity while maintaining adaptability.
Solution Approach 2:
The patent introduces a policy file as an intermediary between the authorization framework and custom security repositories. The policy file serves as a configuration mechanism that mediates between the standardized JAAS interface and custom security requirements, eliminating the need for direct coding interactions with JAAS modules.
2Adaptability or versatility
If JAAS allows customization of authorization and policies, then custom security logic can be implemented, but it requires significant coding to create proper classes and configure policy files
Solution Approach 1:
The policy file acts as an intermediary configuration mechanism that simplifies customization. Instead of requiring direct coding of authorization classes and policies, users can configure custom security logic through the policy file interface, making the system easier to manufacture and customize.
Solution Approach 2:
The patent allows copying of authorization decisions from template policy files or predefined configurations. This enables customization without requiring creation of entirely new classes, reducing the coding effort needed while maintaining the ability to implement custom security logic.
3Productivity
If JAAS uses a monolithic authorization approach, then authorization decisions can be made efficiently, but it is difficult to add new authorizations or change access control mechanisms without modifying existing code
Solution Approach 1:
The patent segments the authorization framework into pluggable modules that can be independently added or modified. This allows new authorizations to be introduced through additional modules rather than modifying existing code, maintaining decision efficiency while enabling flexible adaptation to changing security requirements.
Solution Approach 2:
The patent introduces dynamic configurability where authorization policies can be changed at runtime through policy file updates without requiring code modifications. This dynamic approach allows the system to adapt to changing security needs while maintaining efficient authorization decision processing.
Data Source
AI summary
Embodiments disclosed herein provide an authorization framework. An apparatus may include a data storage to store a first plurality of authorization plugin modules and a server coupled to the data storage. The server may receive a request to access a resource, identify a second plurality of authorization plugin modules that is a proper subset of the first plurality of authorization plugin modules, execute each of the second plurality of authorization plugin modules to generate a plurality of authorization decisions and determine whether to grant the request in view of plurality of authorization decisions.