JPWO2020225616A5

JPWO2020225616A5 -

Info

Publication number: JPWO2020225616A5
Application number: JP2021565850A
Authority: JP
Publication date: 2022-08-30

Claims

A computer-implemented method for token-based authorization within a data processing environment, said data processing environment comprising at least a user system, an application, an authentication server, and an access control server, said user system having a network connection. connected to a server running said application via, said application providing access to operations, at least said operations being identifiable by their identifiers, said method comprising:
accessing the application via a user system request;
redirecting access requests to the authentication server;
authenticating a user with authentication credentials exchanged between the authentication server and the application, wherein the authentication credentials validate requests for restricted entitlements using standard semantics of scope; said authenticating, wherein said restricted entitlements represent a subset of existing entitlements managed by said access control server for resources;
sending an access token together with a refresh token from the authentication server to the application if the authentication is successful and the application is registered with the authentication server, wherein the access token and the refresh token are said sending, including limited entitlements;
requesting execution of an operation by the application initiated by the user system,
invoking the operation by the application providing the access token containing the restricted entitlement;
invoking the access control server by the operation;
providing the access control server with an identifier of the user system and the scope of the token that includes the subset of the existing entitlements;
determining access of the user system to the operation using the subset of entitlements for filtering the existing entitlements by the access control server; ,Method.

2. The method of claim 1, wherein the standard semantics are based on OAuth2.

3. A method according to claim 1 or 2, wherein said application is an insecure component.

4. Any one of claims 1 to 3, wherein said request for restricted entitlements contained within said authentication credentials is a first request, said first request comprising a maximum subset of existing entitlements. the method described in section.

5. The method of claim 4, wherein subsequent requests for refresh tokens also include requests for another limited entitlement.

at least one selected from the group including access to predefined data, database access, file access, predefined application programming interface, and access to a specific subnet of a network; 6. A method according to any one of claims 1 to 5, comprising

7. The method according to any one of claims 1 to 6, wherein said access token has a predefined validity time.

8. The method of claim 7, wherein said predefined validity time is updatable by a privileged user system.

An access system for token-based authorization in a data processing environment, said data processing environment comprising at least a user system, an application, an authentication server and an access control server, said user system having a network connection. connected to a server running said application via, said application providing access to operations, at least said operations being identifiable by their identifiers, said access system comprising:
an accessing module adapted to access said application via a user system request;
a redirecting module adapted to redirect access requests to said authentication server;
An authentication server adapted to authenticate a user by means of authentication credentials exchanged between said authentication server and said application, said authentication credentials being a restricted entity using standard semantics of scope. said authorization server comprising a request for an entitlement, said restricted entitlement representing a subset of existing entitlements managed by said access control server for a resource;
a sender adapted to send an access token together with a refresh token from the authentication server to the application if the authentication is successful and the application is registered with the authentication server, wherein the access token and said sender, wherein said refresh token includes said restricted entitlement;
said user system being adapted to request execution of an operation by said application initiated by said user system, requesting execution of said operation;
invoking the operation by the application providing the access token containing the restricted entitlement;
invoking the access control server by the operation;
providing the access control server with an identifier of the user system and the scope of the token that includes the subset of the existing entitlements;
determining access of said user system to said operation using said subset of entitlements for filtering said existing entitlements by said access control server.

10. The access system of claim 9, wherein said standard semantics are based on OAuth2.

11. The access system according to claim 9 or 10, wherein said application is an unsecured component.

12. Any one of claims 9 to 11, wherein the request for restricted entitlements contained within the authentication certificate is a first request, the first request comprising a maximum subset of existing entitlements. the access system described in paragraph 1.

13. The access system of claim 12, wherein subsequent requests for refresh tokens also include requests for another limited entitlement.

at least one selected from the group including access to predefined data, database access, file access, predefined application programming interface, and access to a specific subnet of a network. 14. An access system according to any one of claims 9 to 13, comprising:

15. The access system according to any one of claims 9-14, wherein said access token has a predefined validity time.

16. The access system of claim 15, wherein said predefined validity time is updatable by a privileged user system.

A computer program for token-based authorization in a data processing environment, for causing one or more computing systems to perform the method of any one of claims 1 to 8, computer program.