International Business Machines Corporation

Jan Paul Buchwald

Timo Kussmaul

Richard Jacob

Daniel Blum

Oliver Then

Dieter Buehler

Holger Waterstrat

Sybille Kurz

In a method of and system for enforcing authentication strength for remote portlets, a portlet is provided by a producer portal and consumed as remote portlet by a consumer portal. The producer portal defines an authentication strength level requirement for the portlet. A user requests the remote portlet from the consumer portal. The consumer portal authenticates the user with a particular authentication method that implies a particular authentication strength level. The producer portal authenticates the consumer portal with a particular authentication method that implies a particular authentication strength assertion level. The consumer portal requests the portlet from the producer portal with an assertion of the authentication strength level of the user. The producer portal rejects the request from the consumer portal if the authentication strength level of the user is less than the authentication strength level requirement for the portlet. The producer portal also rejects the request from the consumer portal if the authentication strength assertion level of the consumer portal is not high enough to assert the authentication strength level of the user. The producer portal accepts the request from the consumer portal only if the authentication strength level of the user is not less than the authentication strength level requirement for the portlet and the authentication strength assertion level of the consumer portal is high enough to assert the authentication strength level of the user.

Method of and system for enforcing authentication strength for remote portlets

A client system is controlled for accessing protected remote resources via a Web Application using a rewriter proxy that supports relative URLs. In one configuration, the Web application can be a Portal application. A URL utility module can be provided for a rewriter proxy that splits an absolute URL into a base part (the URL string up to the resource) and the resource part. A security module computes an authentication identifier for the base part. This can occur by applying a secure hash algorithm and/or secret key. The URL utility module then constructs the rewritten URL by concatenating the URL encoded base part, the authentication identifier, and the resource part as separate path elements.

Controlling access of a client system to access protected remote resources supporting relative URLs

The present invention relates to a method and system for controlling access rights to dynamically instantiated portal applications in a portal environment, wherein new instances of a portal application and respective access control information on resources used in the application are generated dynamically from an automated programmed mechanism, and wherein a user-application role mapping is demanded for the portal application by a respective runtime access control function implemented at the portal environment. The method includes: assigning an individual user-to-application role mapping to a respective individual one of the created instances of the portal application, wherein for each incoming user request to one of the created instances the runtime access control function checks a target application instance identifier, which identifies an individual application instance desired to be addressed by the incoming request; and granting access rights to incoming user requests according to the application roles as they are defined for the target application instance.

Access control on dynamically instantiated portal applications

A method of handling cookies defines a scope attribute, which is in addition to a domain attribute and path attribute. The method allocates separate storage areas for cookies according to identified scopes and a global storage area for cookies with unidentified scopes. The method determines if a cookie received with a response includes an identified scope. If so, the method stores the cookie in the storage area allocated to the identified scope of the cookie. If the cookie has an unidentified scope, the method stores the cookie in the global storage area. The method determines a scope, domain and path for an outgoing request. The method retrieves and attaches to the outgoing request cookies from the global storage area having the determined domain and path. If the outgoing request is associated with an identified scope, the method additionally retrieves all cookies having the determined domain and path from the storage area allocated to the scope of the outgoing request and attaches the retrieved cookies to the outgoing request.

Growing community of inventors

Boeblingen, Germany

Jan Paul Buchwald