Web based applications single sign on system and method

• US 20030200465A1
• Filed: 04/22/2002
• Published: 10/23/2003
• Est. Priority Date: 08/06/2001
• Status: Abandoned Application

• Current Assignee: Aravindan Ranganathan, Sai Allavarpu, Shivaram Bhat
• Original Assignee: Aravindan Ranganathan, Sai Allavarpu, Shivaram Bhat
• Inventors: Ranganathan, Aravindan, Allavarpu, Sai, Bhat, Shivaram
• Application Number:
  US10/128,415
• Publication Number:
  US 20030200465A1
• Time in Patent Office: Days
• US Class Current: 713/202
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

In an enterprise server system having a server, a web-base applications single sign-on method and system. The single sign-on system includes logic for assigning and retrieving uniquely identifying tokens that are assigned to a user attempting to access one of many applications in the server. The token is assigned after the user has successfully logged into the server. The assigned token enables the user to access different applications in the server without having to authenticate every time the user goes from one application to the other. In one embodiment of the present invention, the single sign-on system includes a token that provides a listening mechanism for the applications that need to be notified when a token expires in order to deny access to the particular user identified with the expired token.

Claims

1. A server system for having web-based applications and services, comprising:

an authentication module for authenticating user credentials for users attempting to connect to said server system;

a session module coupled to said authentication module to monitor users access to said server system after a user has successfully authenticated to said server system;

a profile module coupled to said session module to store user profile information of said user upon said user successfully authenticating to said server system; and

a single sign-on module coupled to said authentication module for providing a single sign on service to said user across several web-based applications in said server provided said user has successfully authenticated in said server system and after an initial sign on.

2. The server system of claim 1, wherein said single sign-on module comprises a single sign-on token for uniquely identifying a successfully authenticated user during a login sequence in said server system.

3. The server system of claim 2, wherein said single sign-on module uses said token to validate an identity of said user during a user access request to said web-based applications in said server system.

4. The server system of claim 3, wherein said single sign-on module further comprises a token manager for providing and maintaining validation sequences to validate said tokens.

5. The server system of claim 4, wherein said token manager further retrieves validated tokens associated with said user that has been successfully authenticated.

6. The server system of claim 5, wherein said single sign-on module further comprises token providers for providing and encrypting said tokens and corresponding attributes for storage in an Internet based applications protocol.

7. The server system of claim 6, wherein said Internet based applications protocol is substantially compliant with a hypertext transport protocol.

8. The server system of claim 4, wherein said single sign-on module further comprises token listening logic for notifying each of said web-based applications when a corresponding token expires that is assigned to a user to access said applications.

9. The server system of claim 4, wherein said single sign-on module further comprises token identifiers for storing validated token identifiers for each authenticated user request.

10. The server system of claim 7, wherein said authentication service module comprises logic to set said token identifiers in a hypertext transport protocol cookie header.

11. The server system of claim 7, wherein said authentication service module further comprises logic to set said token identifiers in a hypertext transport protocol session.

12. A web-based applications single sign-on system, comprising:

a server comprising a centrally controlled Uniform Resource Locator system for accessing applications;

a plurality of web-based applications accessed via said centrally controlled URL system for accessing applications; and

a single sign-on access system coupled to said server for providing single sign-on access authentication and authorization to said plurality of web-based applications for a designated user.

13. The web-based applications single sign-on system of claim 12, wherein said server further comprises an authentication service system for authenticating user access requests to said plurality of web-based applications.

14. The web-based applications single sign-on system of claim 12, wherein said single sign-on access system comprises a sign-on token manager for providing unique token identifiers for said designated user on a first attempt that said user makes access to a particular application in said plurality of web-based applications.

15. The web-based applications single sign-on system of claim 14, wherein said single sign-on access system further comprises token providers for providing and encrypting said tokens identifiers and corresponding attributes for storage in an Internet based applications protocol.

16. The web-based applications single sign-on system of claim 15, wherein said Internet based applications protocol is substantially compliant with a hypertext transport protocol.

17. The web-based applications single sign-on system of claim 16, wherein said single sign-on access system further comprises token listening logic for notifying each of said plurality of web-based applications when a corresponding token expires that is assigned to a user to access said applications.

18. The web-based applications single sign-on system of claim 17, wherein said single sign-on module further comprises token identifiers for storing validating token identifiers for each authenticated user request.

19. The web-based applications single sign-on system of claim 17, wherein said server further comprises authentication logic for setting said token identifiers in a hypertext transport protocol cookie header.

20. The web-based applications single sign-on system of claim 17, wherein said server further comprises authentication logic for setting said token identifiers in a hypertext transport protocol cookie session.

21. A method of providing single sign-on access to a plurality of web-based applications in a server, comprising:

receiving a user request to access a first application of said plurality of web-based applications by said server;

authenticating said user to allow access to said first application; and

assigning a sign-on token to said user after said user has successfully authenticated to access said first application, and wherein said token allows an authenticated user to access different applications of said plurality of web-based applications after being granted access to said first application without having to re-authenticate.

22. The method of claim 21, wherein said assigning a sign-on token further comprises checking the status of said sign-on token to ensure said sign-on token has not expired.

23. The method of claim 21, wherein said authenticating said user further comprises validating credentials of said user to ensure authorization of said user to access said first application.

24. The method of claim 23, further comprising managing said token to support multiple and disparate token providers in said server.

25. The method of claim of 24, wherein said assigning a sign-on tokens to said user further comprises notifying said plurality of web-based applications when a particular token expires in order to terminate access granted to said user to said plurality of web-based applications.