Business-Driven Enterprise Authorization - Moving Towards a Unified Authorization Architecture

Information systems of large enterprises experience a shift from an application-centric architecture towards a focus on process orientation and web services. The information system is opened to business partners to allow for self-management and seamless cross-enterprise process integration. Aiming at higher flexibility and lower costs, this strategy also produces great new challenges the security and administrative support systems have to cope with. The security of the enterprise system has to keep up and scale with the new qualitive level of the overall system. In this context we propose an enterprise authorization system model which allows a unified treatment of the enterprise’s authorization issues, and permits the native integration of authorization processes into the business system for greater synergy. The proposed model supports information system architects to avoid that authorization becomes a major obstacle for the new architecture