International Business Machines Corporation

Michael C Thompson

Paul William Bennett

Elisa Ferracane

William J O'Donnell

Daniel E Morris

Ajay Reddy Karkala

Ut Van Le

Dana Lea Price

Eduardo N Spring

Steven Duane Clay

Michal Broz

Maxim Avery Moldenhauer

Federico A Galarraga

Michael Dettlaff Christopher

Christopher M Dettlaff

A system and computer-implemented method for cloud-based anonymous traffic routing is disclosed. The method may include receiving, from a client application by a router, network traffic identified for a destination. The method may include determining, for a set of internal cloud nodes distinct from both the client application and the destination, a set of internet protocol (IP) addresses including a first IP address for a first internal cloud node of the set of internal cloud nodes. The method may also include establishing an anonymity algorithm for cloud-based anonymous traffic routing, the anonymity algorithm configured to use the set of IP addresses. The method may also include routing, based on the anonymity algorithm, the network traffic to the first internal cloud node using the first IP address. The method may also include routing the network traffic from the set of internal cloud nodes to the destination identified by the client application.

Cloud-based anonymous routing

A method, executed by a computer, for deferring an alarm includes determining a user's location relative to an appointment, calculating a required alert time, and setting a deferral duration to less than or equal to a difference between a required alert time and a current time. In some embodiments, a final alarm is activated when the deferral duration has elapsed. The alarm may be deactivated when the appointment occurs or when the user arrives at the appointment location. In some embodiments, the travel time to the appointment is calculated and the mode of transportation is determined. The required alert time may correspond to an amount of time the user requires to prepare for the appointment or for departure to the appointment. A computer program product and computer system corresponding to the above method are also disclosed herein.

Deferring appointment alarms

Mechanisms are provided for performing security role definition testing. An application is received in a container of a runtime environment of the data processing system. The application has methods and security role definitions associated with the methods. A properties object, which specifies a user identifier to security role mapping, is received in the container. A test application is executed, in the container, by the processor, on an execution of the methods of the application based on the user identifier to security role mapping and the security role definitions. The test application tests an operation of the application with regard to the security role definitions. A result of the execution of the test application on the execution of the methods of the application is then output.

Security role testing using an embeddable container and properties object

Disclosed is a computer implemented method, computer program product, and apparatus to switch security configurations. A data processing system accesses a first security configuration via a thread of execution, wherein a security configuration comprises at least one security parameter. The thread receives an incoming request. The thread switches to a second security configuration that specifies a resource, based on the incoming request, responsive to receiving the incoming request. The thread stores the second security configuration or a reference to the second security configuration to a stack. The thread authenticates the incoming request based on the second security configuration. The thread grants or denies access to the resource. The thread executes a method referenced in the incoming request. The thread restores to a first security configuration, responsive to completing the method.

Dynamic switching of security configurations

A method, data processing system, and computer program product for managing user identification information. A determination is made whether an instance of security information in use on the first application server and referenced by a token that has expired was generated by an application server compatible with a first application server in response to receiving the token. A determination is made whether the instance of the security information is managed by a set of rules for a group of users of the first application server. A determination is made whether a user identifier from the token is authorized to access the first application server. The token is renewed in response to determining that the user identifier is authorized to access the first application server.

Renewal of user identification information

A method, system and computer-usable medium are disclosed for managing identity authorizations to access information processing system resources. An application thread requiring access to target resources is initiated and associated with an authenticated client identity and a server identity. The resource authorization attribute of a resource required for execution of the application thread designates the use of a client identity, a server identity, or a client identity and server identity when attempting authorized access of the resource. The client identity, the server identity, or the client identity and server identity is then respectively used to access the target resource and the application thread is executed.

System and method for maintaining dual identity in a server process

A method for dynamically assigning a displayable realm name begins upon receipt of an authentication request to an application, such as a web application, being executed by an application server. In response, a determination is made whether an application realm name has been set in a configuration file associated with the application. If not, a custom display property is then evaluated. If the custom display property is set true, a realm name associated with an active authentication mechanism is retrieved and provided for display in an authentication panel. If the custom display property is set false, a default string is provided for display in the authentication panel. In this manner, an application server administrator can control what realm name is displayed to an end user in the event an application developer has not specified the realm name in the application configuration.

System and method to control display of a realm name

A method for selectively refreshing group membership for an identifier associated with an authenticated user. The identifier represents an application server security context, and it is generated to enable a user credential associated with the authenticated user to be persisted. Following such authentication, the client is provided with a time-bounded, renewable security token. The method begins by configuring an option whether group membership information is refreshed during renewal of an expired security token. During renewal of an expired security token, the method determines whether the option is set. If so, an attempt is made to refresh information. This attempt performs a set of checks to verify certain conditions. If these checks are valid, the identifier is refreshed and the security token renewed with updated group membership information. If any check is not valid, the identifier is refreshed and the security token renewed with existing information.

Refreshing group membership information for a user identifier associated with a security context

A method is described for merging security constraints associated with an application when using security annotations. The application comprises one or more servlets, such as a Java servlet. During application deployment, a list of role names is generated by merging static security constraints, for example, identified in a deployment descriptor, and in a static security annotation that defines a list containing the names of authorized roles for a servlet. Later, during application runtime in an application server, security constraints are retrieved from a plurality of sources, including both dynamic and static security annotations. Using the list of role names and the security constraints retrieved, a set of merged security constraints having a defined and proper order of precedence is generated. In particular, preferably one or more dynamic security annotations are first merged with one or more static security annotations to generate a set of runtime constraints. The security constraints from the deployment descriptor are then merged with the set of runtime constraints and the list of roles to generate the set of merged security constraints. These merged security constraints are then applied to process a request being handled by the application server.

System and method for merging security constraints when using security annotations

A method, system, and computer usable program product for flexibly assigning security configurations to applications are provided in the illustrative embodiments. An embodiment determines, forming a first determination, whether a first identifier identifying the application is mapped to the security configuration. The embodiment determines, forming a second determination, whether the application participates in a group by determining whether a second identifier identifying the group is mapped to the security configuration. The embodiment assigns, forming a first assignment, the security configuration to the application if either of the first and the second determinations is true. The embodiment assigns, forming a second assignment, the security configuration to the application using a determination by a first policy if the first and the second determinations are false.

Growing community of inventors

Austin, TX, United States of America

Michael C Thompson