Local architecture for federated heterogeneous system

• US 20040128541A1
• Filed: 12/31/2002
• Published: 07/01/2004
• Est. Priority Date: 12/31/2002
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Nadalin, Anthony Joseph, Hinton, Heather Maria, Blakley, George Robert III
• Application Number:
  US10/334,273
• Publication Number:
  US 20040128541A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A method is presented in which federated domains interact within a federated environment. Domains within a federation can initiate federated single-sign-on operations for a user at other federated domains. A point-of-contact server within a domain relies upon a trust proxy within the domain to manage trust relationships between the domain and the federation. Trust proxies interpret assertions from other federated domains as necessary. Trust proxies may have a trust relationship with one or more trust brokers, and a trust proxy may rely upon a trust broker for assistance in interpreting assertions.

Claims

1. A method for authenticating a user within a data processing system, the method comprising:

generating an authentication assertion for the user at a first trust proxy within a first domain;

receiving at a system in a second domain a request from a client operated by the user to access a controlled resource within the second domain;

sending the authentication assertion from the first domain to a second trust proxy in the second domain; and

validating the authentication assertion at the second trust proxy in the second domain.

2. The method of claim 1 further comprising:

providing access to the controlled resource in response to a successful validation of the authentication assertion at the second trust proxy.

3. The method of claim 1 further comprising:

determining within the first domain to generate the authentication assertion for the user at the first trust proxy prior to receipt of the request for the controlled resource at the system in the second domain; and

pushing the authentication assertion from the first domain to the second domain along with the request for the controlled resource.

4. The method of claim 1 further comprising:

pulling the authentication assertion from the second trust proxy from the first trust proxy after receipt of the request for the controlled resource at the system in the second domain.

5. The method of claim 1 further comprising:

establishing a trust relationship between the first trust proxy and the second trust proxy.

6. The method of claim 1 further comprising:

maintaining an indirect relationship between the first trust proxy and the second trust proxy through a trust broker.

7. An apparatus for authenticating a user within a data processing system, the apparatus comprising:

means for generating an authentication assertion for the user at a first trust proxy within a first domain;

means for receiving at a system in a second domain a request from a client operated by the user to access a controlled resource within the second domain;

means for sending the authentication assertion from the first domain to a second trust proxy in the second domain; and

means for validating the authentication assertion at the second trust proxy in the second domain.

8. The apparatus of claim 7 further comprising:

means for providing access to the controlled resource in response to a successful validation of the authentication assertion at the second trust proxy.

9. The apparatus of claim 7 further comprising:

means for determining within the first domain to generate the authentication assertion for the user at the first trust proxy prior to receipt of the request for the controlled resource at the system in the second domain; and

means for pushing the authentication assertion from the first domain to the second domain along with the request for the controlled resource.

10. The apparatus of claim 7 further comprising:

means for pulling the authentication assertion from the second trust proxy from the first trust proxy after receipt of the request for the controlled resource at the system in the second domain.

11. The apparatus of claim 7 further comprising:

means for establishing a trust relationship between the first trust proxy and the second trust proxy.

12. The apparatus of claim 7 further comprising:

means for maintaining an indirect relationship between the first trust proxy and the second trust proxy through a trust broker.

13. A computer program product in a computer readable medium for use in a data processing system for authenticating a user, the computer program product comprising:

means for generating an authentication assertion for the user at a first trust proxy within a first domain;

means for receiving at a system in a second domain a request from a client operated by the user to access a controlled resource within the second domain;

means for sending the authentication assertion from the first domain to a second trust proxy in the second domain; and

means for validating the authentication assertion at the second trust proxy in the second domain.

14. The computer program product of claim 13 further comprising:

means for providing access to the controlled resource in response to a successful validation of the authentication assertion at the second trust proxy.

15. The computer program product of claim 13 further comprising:

means for determining within the first domain to generate the authentication assertion for the user at the first trust proxy prior to receipt of the request for the controlled resource at the system in the second domain; and

means for pushing the authentication assertion from the first domain to the second domain along with the request for the controlled resource.

16. The computer program product of claim 13 further comprising:

means for pulling the authentication assertion from the second trust proxy from the first trust proxy after receipt of the request for the controlled resource at the system in the second domain.

17. The computer program product of claim 13 further comprising:

means for establishing a trust relationship between the first trust proxy and the second trust proxy.

18. The computer program product of claim 13 further comprising:

means for maintaining an indirect relationship between the first trust proxy and the second trust proxy through a trust broker.