Abstract: The present invention describes a privilege transfer method between programs in a computing system. This transfer method allows a resource manager such as a security manager to be initially started on the system by the system's native privileged user. This user has the needed native privilege to add it to the system. Subsequently the privilege to administer the security manager is transferred from the native privileged identity to a designated user identity. Once transferred, the initial privileged identity, the system's native privileged user, losses privilege with respect to the security manager and the new registered identity gains administrative control over the security manager. Since the new registered identity is not the native root identity, the security of the native system is not compromised.

Abstract: The present invention is an algorithm that manages the ability of an impersonator program to impersonate a user identity. This invention operates in the context of an external security manager. One aspect of the invention is a technique in which a security manager is used to control the security of an impersonator program and to allow that impersonator program's impersonated user to be represented as a user identity in that external security manager. A second aspect of the present invention is a technique that controls an impersonator program's ability to change its user identity. This invention will allow the specification of security policy to control which users an impersonator program can impersonate.

Abstract: The present invention describes a privilege transfer method between programs in a computing system. This transfer method allows a resource manager such as a security manager to be initially started on the system by the system's native privileged user. This user has the needed native privilege to add it to the system. Subsequently the privilege to administer the security manager is transferred from the native privileged identity to a designated user identity. Once transferred, the initial privileged identity, the system's native privileged user, losses privilege with respect to the security manager and the new registered identity gains administrative control over the security manager. Since the new registered identity is not the native root identity, the security of the native system is not compromised.

Abstract: A method of enabling a Web server to impersonate a Web client to thereby obtain access to files stored in a distributed file system of a distributed computing environment. The distributed computing environment includes a security service for returning a credential to a user authenticated to access the distributed file system. In response to receipt of a transaction request from the Web client, a determination is made whether the transaction request has originated from a user authenticated to access the distributed file system. If so, the Web server is controlled to reuse the credential of the user across multiple file accesses in the distributed file system on behalf of the Web client.