Abstract: A method is presented in which federated domains interact within a federated environment. Domains within a federation can initiate federated single-sign-on operations for a user at other federated domains. A point-of-contact server within a domain relies upon a trust proxy within the domain to manage trust relationships between the domain and the federation. Trust proxies interpret assertions from other federated domains as necessary. Trust proxies may have a trust relationship with one or more trust brokers, and a trust proxy may rely upon a trust broker for assistance in interpreting assertions.

Abstract: An autonomic grid. The autonomic grid can include a multiplicity of hosting services communicatively coupled to one another. Each hosting service can include an administrative service configured to determine whether to deploy requested Web services locally or remotely; a code base for storing implementations of the requested Web services; and, a deployment service configured to deploy on command the implementations stored in the code base. Notably, at least one of the hosting services further can include one or more Web services instances; one or more monitors configured to proxy requests to and responses from the Web services instances; and, one or more agents subscribed to the monitors to analyze the requests to and responses from the Web services instances, and to provision Web services in others of the hosting services based upon the analysis.

Abstract: A method, system, apparatus, or computer program product is presented for routing event messages between data processing systems based on privacy policies associated with the data processing systems and based on event policies associated with event types for the event messages. When a system attempts to publish an event message for a particular type of event or to subscribe to those event messages, an event policy is checked to determine whether the system may publish messages for that type of event or may subscribe to those messages. Moreover, if a publishing system publishes an event message that contains personally identifiable information for a user of a data processing system, and a subscribing system has subscribed to event messages having the same event type, then the privacy policies associated with the systems are compared to determine compatibility or incompatibility between the privacy policies before routing a message between the systems.

Abstract: A system and method are provided for managing a workflow for a document. An electronic form is created for receiving data pertaining to a workflow. A content integration template locates and exposes data fields in the electronic form. A document workflow defines states of the document, transitions between states, and actions for each state.

Abstract: A method, system, apparatus, or computer program product is presented for routing event messages between data processing systems based on privacy policies associated with the data processing systems and based on event policies associated with event types for the event messages. When a system attempts to publish an event message for a particular type of event or to subscribe to those event messages, an event policy is checked to determine whether the system may publish messages for that type of event or may subscribe to those messages. Moreover, if a publishing system publishes an event message that contains personally identifiable information for a user of a data processing system, and a subscribing system has subscribed to event messages having the same event type, then the privacy policies associated with the systems are compared to determine compatibility or incompatibility between the privacy policies before routing a message between the systems.

Abstract: A method is presented in which federated domains interact within a federated environment. Domains within a federation can initiate federated single-sign-on operations for a user at other federated domains. A point-of-contact server within a domain relies upon a trust proxy within the domain to manage trust relationships between the domain and the federation. Trust proxies interpret assertions from other federated domains as necessary. Trust proxies may have a trust relationship with one or more trust brokers, and a trust proxy may rely upon a trust broker for assistance in interpreting assertions. When a user requests to logoff from a domain that has initiated federated single-sign-on operations for the user at other federated domains, the domain initiates a consolidated logoff operation by requesting logoff operations at those other federated domains, which may also initiate logoff operations in a cascaded fashion to the domains at which they have initiated federated single-sign-on operations.

Abstract: A self-healing and self-optimizing grid architecture can be provided in accordance with the present invention. Specifically, the architecture can include a mechanism for detecting component failures, and even degraded component performance, within peer components in a hosting service. Once a failure has been detected, the detecting peer to undertake remedial action to recreate and redeploy the component in the hosting system. In particular, the detecting component can acquire the behavior of the failed component and the detecting component can instantiate an instance of the behavior in another server in the grid. Thus, the mechanism described herein can be analogized to biotechnical DNA as every component in the hosting service can maintain an awareness of the state of the entire system and can recreate the entire system through knowledge provided by grid services DNA.

Abstract: A method is presented in which federated domains interact within a federated environment. Domains within a federation can initiate federated single-sign-on operations for a user at other federated domains. A point-of-contact server within a domain relies upon a trust proxy within the domain to manage trust relationships between the domain and the federation. Trust proxies interpret assertions from other federated domains as necessary. Trust proxies may have a trust relationship with one or more trust brokers, and a trust proxy may rely upon a trust broker for assistance in interpreting assertions. When a user requests to logoff from a domain that has initiated federated single-sign-on operations for the user at other federated domains, the domain initiates a consolidated logoff operation by requesting logoff operations at those other federated domains, which may also initiate logoff operations in a cascaded fashion to the domains at which they have initiated federated single-sign-on operations.

Abstract: A method is presented in which federated domains interact within a federated environment. Domains within a federation can initiate federated single-sign-on operations for a user at other federated domains. A point-of-contact server within a domain relies upon a trust proxy within the domain to manage trust relationships between the domain and the federation. Trust proxies interpret assertions from other federated domains as necessary. Trust proxies may have a trust relationship with one or more trust brokers, and a trust proxy may rely upon a trust broker for assistance in interpreting assertions.

Abstract: A distributed trust infrastructure is presented that interfaces disparate trust models across trust domain boundaries and manages inter-domain and intra-domain trust relationships such that they are not reliant upon a single trust manager entity. A trust relationship between trust domains is represented by a trust link, which associates a namespace with a trust oracle, which is a service in a trust domain given responsibility to authoritatively resolve trust-related operations relative to the associated namespace. Trust links for a given trust domain are used by a trust link reference agent that is supported within the trust domain. The trust link reference agent is consulted for trust-related operations within its trust domain; after identifying the appropriate trust oracle for handling the trust-related operation, the trust-related operation is forwarded to the trust oracle for resolution. In addition, the trust links are associated with policies that guide the management of the trust links.

Abstract: A method, system, apparatus, or computer program product is presented for routing event messages between data processing systems based on privacy policies associated with the data processing systems and based on event policies associated with event types for the event messages. When a system attempts to publish an event message for a particular type of event or to subscribe to those event messages, an event policy is checked to determine whether the system may publish messages for that type of event or may subscribe to those messages. Moreover, if a publishing system publishes an event message that contains personally identifiable information for a user of a data processing system, and a subscribing system has subscribed to event messages having the same event type, then the privacy policies associated with the systems are compared to determine compatibility or incompatibility between the privacy policies before routing a message between the systems.

Abstract: A self-healing and self-optimizing grid architecture can be provided in accordance with the present invention. Specifically, the architecture can include a mechanism for detecting component failures, and even degraded component performance, within peer components in a hosting service. Once a failure has been detected, the detecting peer to undertake remedial action to recreate and redeploy the component in the hosting system. In particular, the detecting component can acquire the behavior of the failed component and the detecting component can instantiate an instance of the behavior in another server in the grid. Thus, the mechanism described herein can be analogized to biotechnical DNA as every component in the hosting service can maintain an awareness of the state of the entire system and can recreate the entire system through knowledge provided by grid services DNA.

Abstract: A self-governing, self-healing and self-optimizing policy oriented grid architecture. The architecture can include a hosting service configured for use in a computing grid. The hosting service can include a Web service; grid instrumentation coupled to the Web service; a Web service descriptive document; and, a service policy element disposed in the Web service descriptive document. The Web service descriptive document can include a WSDL type document. Moreover, at least one WSLA can be referenced in the WSDL type document. Notably, the service policy element can include at least one policy selected from the group consisting of a security assertion and a business rule. The security assertion can include a security assertion markup language (SAML) formatted authentication statement having a subject specifying a role identifier.

Abstract: An autonomic grid. The autonomic grid can include a multiplicity of hosting services communicatively coupled to one another. Each hosting service can include an administrative service configured to determine whether to deploy requested Web services locally or remotely; a code base for storing implementations of the requested Web services; and, a deployment service configured to deploy on command the implementations stored in the code base. Notably, at least one of the hosting services further can include one or more Web services instances; one or more monitors configured to proxy requests to and responses from the Web services instances; and, one or more agents subscribed to the monitors to analyze the requests to and responses from the Web services instances, and to provision Web services in others of the hosting services based upon the analysis.

Abstract: A method and apparatus in a distributed data processing system for providing proxy services. Requests are processed by a primary proxy, using a shared memory in the distributed data processing system. A challenge from a secondary proxy to the primary proxy is detected. A determination is made as to whether the secondary proxy has priority over the primary proxy. This may be determined using priorities assigned to the proxies. Responsive to determining whether the secondary proxy has priority over the primary proxy, a priority of the secondary proxy is stored. Responsive to the secondary proxy having priority over the primary proxy, the secondary proxy to is allowed access the shared memory. Further, the secondary proxy is then allowed to multi-cast a message to clients indicating the secondary proxy's location. This message indicates that the secondary proxy is now the primary proxy.

Abstract: A method, system, and computer-readable code with which a scheduling system can be implemented that allows a sender and a receiver to change priorities of queued messages. A technique is also defined for providing a receiver with an advance notice of intended message priority, enabling the receiver to request a priority change before transmission begins. These techniques provide the flexibility to respond to changes in dynamic, volatile network environments, as well as changes in user's wishes or requirements. A ranking technique is defined, whereby requests to change priority may be accepted or denied through a ranking algorithm that resolves potential conflicts in desired transmission priority using proposals exchanged by the parties (e.g. during connection establishment).

Abstract: A method and apparatus in a distributed data processing system for scaling servers. Access to a shared memory for a period of time is selectively provided to a server within a plurality of servers, wherein the shared memory is used by the server to process requests. All other servers within the plurality of servers are prevented from accessing the shared memory during the period of time.

Abstract: Method, apparatus and program products for increasing the performance of communications using differencing data communications over a message queue supporting asynchronous communications from a variety of applications executing on a source device over a shared external communication link to destination devices are provided. A data stream between the source device and the destination device is segmented based on the type of the data stream to provide a logical segmentation which increases the occurrence of repeated transmissions of a segment. The segments are then placed in the message queue as a message for transport to a destination computer. Differencing is provided by replacing the segment with an associated identifier for segments which have previously been transported to provide a reduced volume of data for transmittal based on recognition and replacement of data segments which have previously been transmitted by the source device.

Abstract: A technique, system, and computer program for encapsulating socket functionality in a uniform communications object model. This object model is system- and language-independent, and supports both synchronous and asynchronous I/O. Further, the object model functionality is lightweight and modular, enabling its use within devices having limited memory and storage capability. The functionality included in this model is based on the common denominator of functions provided in modem operating systems, which provide the capability for basic sockets support as well as support for threads. Use of this uniform communications object model enables porting an application across environments ranging from resource-constrained devices through servers.

Abstract: Methods, systems, and computer program products are provided for communicating between a source device and a destination device over an external communication link by transmitting a message stored in a source persistent queue at the source device over the external communication link to the destination device. The transmitted message has transmitted with it an associated sequence identifier which identifies the message stored in the source persistent queue. The transmitted message and the associated sequence identifier are received at the destination device and stored in a destination persistent queue at the destination device. Occasionally, a commit message is transmitted to the source device from the destination device which identifies a sequence identifier associated with received message which has been persistently stored in the destination persistent queue.