Whitelist construction

• US 10,643,149 B2
• Filed: 08/26/2016
• Issued: 05/05/2020
• Est. Priority Date: 10/22/2015
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Kukehalli Subramanya, Ramya, Martin, Madhu, Uppalapati, Venkatesh
• Primary Examiner(s): Thieu, Benjamin M
• Application Number:
  US15/249,232
• Publication Number:
  US 20170118167A1
• Time in Patent Office: 1,348 Days
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 2101/35 containing special prefixes
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Techniques are provided for of constructing a whitelist of redirection uniform resource locators (URLs). A method can include receiving, by a computing system executing an access manager application, a request to log out a user from an application executing on a device; determining, by the access manager application, a redirection address for the application; validating, by the access manager application, the redirection address; and based on the validation, causing, by the access manager application, the application to perform one of redirecting the user to the redirection address and determining addition of the redirection address to a list of valid redirection addresses.

Claims

1. A method comprising:

constructing, by an access manager of an access management system executing an access manager application, a whitelist of valid redirection addresses, wherein the whitelist is constructed based on redirection addresses that are approved by a user during a prior logout from the application or based on preapproved logout redirection addresses;

receiving, by the access manager, a request to log out the user from the application executing on a device;

determining, by the access manager, a redirection address for redirecting the user after logging out from the application, wherein the redirection address comprises a Uniform Resource Locator (URL) to which the user is redirected after log out from the application, wherein the URL comprises a logout Uniform Resource Locator (URL) and an end URL associated with the application of the access management system;

validating, by the access manager, the redirection address, wherein the validating the redirection address comprises determining whether the redirection address is on the constructed whitelist of valid redirection addresses to which the user can be redirected after logging out from the application; and

based on the validation, causing, by the access manager, the application to perform one of redirecting the user to the redirection address and determining whether to add the redirection address to the whitelist of valid redirection addresses.

2. The method according to claim 1, wherein the application redirects the user to the redirection address in response to the redirection address being on the whitelist of valid redirection addresses.

3. The method according to claim 2, wherein the whitelist of valid redirection addresses comprises one or more approved redirection addresses.

4. The method according to claim 2, wherein the whitelist of valid redirection addresses comprises one of a machine-learned address based on learned previous activity and a user-based address that is based on a user activity.

5. The method according to claim 1, wherein the determining the addition of the redirection address to the whitelist of valid redirection addresses comprises:

determining that the redirection address corresponds to a predetermined event; and

in response to the determining that the redirection address corresponds to the predetermined event, adding the redirection address to the whitelist of valid redirection addresses.

6. The method according to claim 5, wherein the predetermined event comprises one of application registration during which the application is registered with the access management system, product integration during which one or more products are added to operate with the access management system, and log-in page addition in which a new log-in page for the application is added.

7. The method according to claim 1, wherein the determining the addition of the redirection address to the whitelist of valid redirection addresses comprises:

determining that the redirection address corresponds to a predetermined user action; and

in response to the determining that the redirection address corresponds to the predetermined user action, adding the redirection address to the whitelist of valid redirected addresses.

8. The method according to claim 7, wherein the predetermined user action comprises user confirmation of the redirection address.

9. The method according to claim 1, wherein the whitelist of valid redirection addresses comprises at least one of a system-level list that applies to users of the access management system and a user-level list that applies to particular users of the access management system.

10. The method according to claim 9, wherein the system-level list comprises end URLs that are applicable to all access management system users.

11. The method according to claim 9, wherein the user-level list comprises one or more end URLs that are applicable to a particular access management system user.

12. The method according to claim 1, wherein the redirection address comprises a logout Uniform Resource Locator (URL) and an end URL.

13. A non-transitory computer-readable storage medium storing a plurality of instructions executable by one or more processors to cause the one or more processors to perform operations, comprising:

constructing, by an access manager of an access management system executing an access manager application, a whitelist of valid redirection addresses, wherein the whitelist is constructed based on redirection addresses that are approved by a user during a prior logout from the application or based on preapproved logout redirection addresses;

receiving, by the access manager, a request to log out the user from the application executing on a device;

determining, by the access manager, a redirection address for redirecting the user after logging out from the application, wherein the redirection address comprises a Uniform Resource Locator (URL) to which the user is redirected after log out from the application, wherein the URL comprises a logout Uniform Resource Locator (URL) and an end URL associated with the application of the access management system;

validating, by the access manager, the redirection address, wherein the validating the redirection address comprises determining whether the redirection address is on the constructed whitelist of valid redirection addresses to which the user can be redirected after logging out from the application; and

based on the validation, causing, by the access manager, the application to perform one of redirecting the user to the redirection address, and determining addition of the redirection address to a list of valid redirection addresses.

14. The non-transitory computer-readable storage medium according to claim 13, wherein the application redirects the user to the redirection address in response to the redirection address being on the whitelist of valid redirection addresses.

15. The non-transitory computer-readable storage medium according to claim 14, wherein the whitelist of valid redirection addresses comprises one or more approved redirection addresses.

16. The non-transitory computer readable medium according to claim 14, wherein the whitelist of valid redirection addresses comprises one of a machine-learned address based on learned previous activity and a user-based address that is based on a user activity.

17. An access management system comprising:

a memory; and

one or more processors coupled to the memory and configured to;

construct, by an access manager of the access management system executing an access manager application, a whitelist of valid redirection addresses, wherein the whitelist is constructed based on redirection addresses that are approved by a user during a prior logout from the application or based on preapproved logout redirection addresses;

receive, by the access manager, a request to log out the user from the application executing on a device;

determine, by the access manager, a redirection address for redirecting the user after logging out from the application, wherein the redirection address comprises a Uniform Resource Locator (URL) to which the user is redirected after log out from the application, wherein the URL comprises a logout Uniform Resource Locator (URL) and an end URL associated with the application of the access management system;

validate, by the access manager, the redirection address, wherein the validating the redirection address comprises determining whether the redirection address is on the constructed whitelist of valid redirection addresses to which the user can be redirected after logging out from the application; and

based on the validation, cause, by the access manager, the application to perform one of redirecting the user to the redirection address, and determining addition of the redirection address to the whitelist of valid redirection addresses.

18. The system according to claim 17, wherein the application redirects the user to the redirection address in response to the redirection address being on the whitelist of valid redirection addresses.

19. The system according to claim 17, wherein the whitelist of valid redirection addresses comprises at least one of a system-level list that applies to users of the access management system and a user-level list that applies to particular users of the access management system.