COMPOSABLE ROLES

An application developer grants access privileges to application processing services in an object-based application by defining logical classes of users called roles. When the application is deployed on a host computer system, an administrator populates the roles with users and groups recognized by the host computer system. At runtime, a user is not permitted access to a processing service unless the user is a member of a permitted role for the processing service. To ease administration, two or more roles can be composed. In one implementation, roles are associated with a separate composite role. The administrator can then populate the composite role instead of individually populating each of the roles associated with the composite role. In another implementation, the administrator can specify that a role follows another role; user identities in the followed role are automatically considered members of the following role. Additional features include an installation utility to help compose roles when installing an application on the host computer system. An exemplary security framework for implementing composable roles relieves application developers from including security logic in application components.