Abstract: Methods, systems, and computer program products are provided for controlling a GUI display for a plug-in in an application supporting plug-ins. Embodiments include receiving, at run time, in the application from the plug-in a request to display a GUI object; responsive to the request, retrieving an XML representation of the GUI object; and displaying the GUI object in dependence upon the retrieved XML representation of the GUI object. Typical embodiments also include receiving from the plug-in a request to retrieve user input responsive to the GUI object; and returning to the plug-in responsive user input.

Abstract: Methods, systems, and computer program products are provided for cross domain security information conversion. Embodiments include receiving from a system entity, in a security service, security information in a native format of a first security domain regarding a system entity having an identity in at least one security domain; translating the security information to a canonical format for security information; transforming the security information in the canonical format using a predefined mapping from the first security domain to a second security domain; translating the transformed security information in the canonical format to a native format of the second security domain; and returning to the system entity the security information in the native format of the second security domain.

Abstract: A method, apparatus and computer instructions for handling intrusions. A tracer packet is sent back to an intruder causing the intrusion in response to receiving notification of an intrusion from a particular node in a network data processing system. Nodes in the network data processing system are notified of the tracer packet. Identification of the node is stored for use in tracing a route of the tracer packet through the data processing system in response to receiving a message from a node indicating receipt of the tracer packet.

Abstract: The invention provides federated functionality within a data processing system by means of a set of specialized runtimes, which are instances of an application for providing federation services to requesters. Each of the plurality of specialized runtimes provides requested federation services for selected ones of the requestors according to configuration data of respective federation relationships of the requestors with the identity provider. The configuration data is dynamically retrieved during initialization of the runtimes which allows the respective_runtime to be specialized for a given federation relationship. Requests are routed to the appropriate specialized runtime using the first requestor identity and the given federation relationship. The data, which describes each federation relationship between the identity provider and each of the plurality of requestors, is configured prior to initialization of the runtimes.

Abstract: An autonomic grid. The autonomic grid can include a multiplicity of hosting services communicatively coupled to one another. Each hosting service can include an administrative service configured to determine whether to deploy requested Web services locally or remotely; a code base for storing implementations of the requested Web services; and, a deployment service configured to deploy on command the implementations stored in the code base. Notably, at least one of the hosting services further can include one or more Web services instances; one or more monitors configured to proxy requests to and responses from the Web services instances; and, one or more agents subscribed to the monitors to analyze the requests to and responses from the Web services instances, and to provision Web services in others of the hosting services based upon the analysis.

Abstract: A method, apparatus, and computer instructions for handling intrusions. A tracer packet is sent back to an intruder causing the intrusion in response to receiving notification of an intrusion from a particular node in a network data processing system. Nodes in the network data processing system are notified of the tracer packet. Identification of the node is stored for use in tracing a route of the tracer packet through the data processing system in response to receiving a message from a node indicating receipt of the tracer packet.

Abstract: A method and a system are presented in which federated domains interact within a federated environment. Domains within a federation can initiate federated operations for a user at other federated domains. A point-of-contact server within a domain relies upon a trust proxy within the domain to manage trust relationships between the domain and the federation. The point-of-contact server receives incoming requests directed to the domain and interfaces with a first application server and a second application server, wherein the first application server responds to requests for access to controlled resources and the second application server responds to requests for access to federated user lifecycle management functions, which are implemented using one or more pluggable modules that interface with the second application server.

Abstract: The invention provides federated functionality within a data processing system by means of a set of specialized runtimes, which are instances of an application for providing federation services to requesters. Each of the plurality of specialized runtimes provides requested federation services for selected ones of the requestors according to configuration data of respective federation relationships of the requestors with the identity provider. The configuration data is dynamically retrieved during initialization of the runtimes which allows the respective_runtime to be specialized for a given federation relationship. Requests are routed to the appropriate specialized runtime using the first requestor identity and the given federation relationship. The data, which describes each federation relationship between the identity provider and each of the plurality of requestors, is configured prior to initialization of the runtimes.

Abstract: The invention provides federated functionality within a data processing system by means of a set of specialized runtimes. Each of the plurality of specialized runtimes provides requested federation services for selected ones of the requestors according to configuration data of respective federation relationships of the requestors with the identity provider. The configuration data is dynamically retrieved during initialization of the runtimes which allows the respective runtime to be specialized for a given federation relationship. Requests are routed to the appropriate specialized runtime using the first requestor identity and the given federation relationship. The data which describes each federation relationship between the identity provider and each of the plurality of requesters is configured prior to initialization of the runtimes.

Abstract: Methods, systems, and computer program products are provided for controlling a GUI display for a plug-in in an application supporting plug-ins. Embodiments include receiving, at run time, in the application from the plug-in a request to display a GUI object; responsive to the request, retrieving an XML representation of the GUI object; and displaying the GUI object in dependence upon the retrieved XML representation of the GUI object. Typical embodiments also include receiving from the plug-in a request to retrieve user input responsive to the GUI object; and returning to the plug-in responsive user input.

Abstract: Methods, systems, and computer program products are provided for controlling a GUI display for a plug-in in an application supporting plug-ins. Embodiments include receiving, at run time, in the application from the plug-in a request to display a GUI object; responsive to the request, retrieving an XML representation of the GUI object; and displaying the GUI object in dependence upon the retrieved XML representation of the GUI object. Typical embodiments also include receiving from the plug-in a request to retrieve user input responsive to the GUI object; and returning to the plug-in responsive user input.

Abstract: A self-healing and self-optimizing grid architecture can be provided in accordance with the present invention. Specifically, the architecture can include a mechanism for detecting component failures, and even degraded component performance, within peer components in a hosting service. Once a failure has been detected, the detecting peer to undertake remedial action to recreate and redeploy the component in the hosting system. In particular, the detecting component can acquire the behavior of the failed component and the detecting component can instantiate an instance of the behavior in another server in the grid. Thus, the mechanism described herein can be analogized to biotechnical DNA as every component in the hosting service can maintain an awareness of the state of the entire system and can recreate the entire system through knowledge provided by grid services DNA.

Abstract: An autonomic grid. The autonomic grid can include a multiplicity of hosting services communicatively coupled to one another. Each hosting service can include an administrative service configured to determine whether to deploy requested Web services locally or remotely; a code base for storing implementations of the requested Web services; and, a deployment service configured to deploy on command the implementations stored in the code base. Notably, at least one of the hosting services further can include one or more Web services instances; one or more monitors configured to proxy requests to and responses from the Web services instances; and, one or more agents subscribed to the monitors to analyze the requests to and responses from the Web services instances, and to provision Web services in others of the hosting services based upon the analysis.

Abstract: A self-healing and self-optimizing grid architecture can be provided in accordance with the present invention. Specifically, the architecture can include a mechanism for detecting component failures, and even degraded component performance, within peer components in a hosting service. Once a failure has been detected, the detecting peer to undertake remedial action to recreate and redeploy the component in the hosting system. In particular, the detecting component can acquire the behavior of the failed component and the detecting component can instantiate an instance of the behavior in another server in the grid. Thus, the mechanism described herein can be analogized to biotechnical DNA as every component in the hosting service can maintain an awareness of the state of the entire system and can recreate the entire system through knowledge provided by grid services DNA.

Abstract: A self-governing, self-healing and self-optimizing policy oriented grid architecture. The architecture can include a hosting service configured for use in a computing grid. The hosting service can include a Web service; grid instrumentation coupled to the Web service; a Web service descriptive document; and, a service policy element disposed in the Web service descriptive document. The Web service descriptive document can include a WSDL type document. Moreover, at least one WSLA can be referenced in the WSDL type document. Notably, the service policy element can include at least one policy selected from the group consisting of a security assertion and a business rule. The security assertion can include a security assertion markup language (SAML) formatted authentication statement having a subject specifying a role identifier.

Abstract: A method, apparatus, and computer instructions for handling intrusions. A tracer packet is sent back to an intruder causing the intrusion in response to receiving notification of an intrusion from a particular node in a network data processing system. Nodes in the network data processing system are notified of the tracer packet. Identification of the node is stored for use in tracing a route of the tracer packet through the data processing system in response to receiving a message from a node indicating receipt of the tracer packet.