Oracle International Corporation

Pratibha Gupta

Nickolas Kavantzas

Jiandong Guo

Techniques are disclosed for dynamically switching user identity when generating a web service request by receiving, at a client application, an invocation of a web service, the invocation associated with a first authenticated user identity of a first user, identifying a second user identity, verifying that a switch from the first user identity to the second user identity is permitted by switching rules, including the second user identity in a service request when the switch is permitted, and communicating the service request to the web service. The switching rules can include associations between initial user identities and permitted user identities. Verifying that a switch is permitted can include searching the associations for an entry having an initial user identity that matches the first authenticated user identity and a new user identity that matches the second user identity, wherein the switch is permitted when the entry is found.

Dynamic identity switching

Techniques are provided for dynamically propagating identity context for a user in a Service-Oriented Architecture. Methods and apparatus are provided that include receiving a request to invoke a web service, retrieving first security claims from application identity context information pertaining to a user, generating second security claims at runtime, packaging the first and second security claims into an authentication token, and transmitting the authentication token to a second computer system in a service request. The second computer system can be configured to extract the first and second security claims from the authentication token, validate the extracted first and second security claims, generate identity context information based upon the extracted first and second security claims, and publish and propagate the identity content information in an identity context object. The second computer system can verify that the security claims conform to corresponding security claim schemas stored in a claims dictionary.

Dynamic identity context propagation

Techniques are disclosed for sharing communication session information sharing in web service applications. The techniques include management of concurrent sessions by dynamically determining the session association of web service requests at runtime. These sessions can be shared by a group of web services on the server side, and across multiple web services clients with many users, independently of where these applications reside. Session identifiers are determined for these concurrent web service invocations based on an algorithm that uses information from configuration and runtime data. Different information is used in the session identifier depending on configuration parameters to provide different types of sharing that correspond to different use cases. This mechanism can be used with SOAP-based web services, REST-based web services, and the like.

Session sharing in secure web service conversations

Techniques are disclosed for sharing communication session information, such as encryption keys for data protection, among multiple communication operations and/or multiple users. Multiple users can share the same communication session concurrently, with each message being individually authenticated. The provided techniques include receiving, at a client application, a first request to send a first web service message to a web service application or group of web services, retrieving existing communication session information having the same sharing characteristics as the first request, where the sharing characteristics include web service environment information and/or request information, including the user credentials associated with the user in the message and in each subsequent message communicated using the existing communication session information, and communicating the web service message to the web service application or group of web services using the existing communication session information.

Re-authentication in secure web service conversations

In one set of embodiments, methods, systems, and apparatus are provided to enable secure local invocation of a web service in response to receiving a request from a first composite application to invoke a web service operation of a second composite application, where the first application is associated with a reference policy, and the second application is associated with a service policy, then determining, based upon the service policy and the reference policy, whether local invocation is secure, and invoking the operation using the local invocation in response to determining that the local invocation is secure. Attributes associated with the reference and service policies can indicate whether those policies can be used in a local invocation, or if user authentication is needed before performing the invocation with those policies. The local invocation may comprise a procedure call in an application server from the first application to the second application.

Growing community of inventors

Cupertino, CA, United States of America

Pratibha Gupta