Systems and methods for authenticating a user to a web server

• US 20040193921A1
• Filed: 08/13/2003
• Published: 09/30/2004
• Est. Priority Date: 08/04/2000
• Status: Active Grant

• Current Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Byrne, Barry A.
• Granted Patent: US 7,356,833 B2
• Time in Patent Office: Days
• US Class Current: 726/12
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity

Abstract

A method and system for automatically and transparently providing access to resources associated with a web server which requires authentication. A server is provided for a web browser, which intercepts and responds to authentication requests from web servers. The method and system allows a user to access multiple network resources with a single initial authentication procedure.

Claims

1. A method for providing browser access to network resources protected by a web server, the method comprising:

requesting access by a browser to resources protected by a web server;

intercepting a request for authentication data from the web server to the browser at a server located on the same device as the browser;

determining whether the device has the requested authentication data; and

providing the authentication data from the server to the web server if the device has the requested authentication data.

2. The method of claim 1, wherein the server provides the authentication data by formatting a response according to a hypertext transfer protocol.

3. The method of claim 1, wherein the authentication data includes a role of a user of the browser.

4. The method of claim 3, wherein the authentication data further includes user identification information.

5. The method of claim 1, wherein the request for authentication data includes a hypertext transfer protocol authentication header.

6. The method of claim 5, wherein the step of providing the authentication data includes providing a hypertext transfer protocol authorization header.

7. The method of claim 1, further comprising:

detecting an access denial issued by the server in response to an access request;

providing a supplemental authentication header to the server;

detecting the supplemental authentication header; and

responding to the supplemental authentication header by extracting the authentication data, and forwarding the authentication data to the server in an authentication header.

8. The method of claim 1, further comprising:

requesting access by the browser to resources protected by a second web server;

intercepting a request for authentication data from the second web server to the browser at the server;

determining whether the device has the authentication data for the second web server; and

providing the authentication data from the server to the second web server if the device has the requested authentication data.

9. The method of claim 1, further comprising:

requesting the authentication data from the browser if the device does not include the authentication data;

receiving the authentication data from a user through a web browser interface;

providing the authentication data from the web browser to the server; and

providing the authentication data from the server to the web server.

10. The method of claim 1, wherein the request for authentication data includes a challenge to the request for access and wherein the providing of the authentication data in response to the challenge includes returning the challenge in an encrypted form, wherein the encrypted form indicates a shared secret.

11. The method of claim 10, wherein the web browser is a non-NTLM browser and the web server is a NTLM server.

12. A system for providing access to resources through a web server, the system comprising:

a web browser adapted to receive a user request for access to a resource via the web server; and

a server adapted to pass the user request to the web server, to automatically intercept a request for authentication data from the web server to the web browser, to retrieve the authentication, and to provide the retrieved authentication data to the web server.

13. The system of claim 12, further comprising memory storing the authentication data.

14. The system of claim 12, wherein the server is further adapted to provide authentication data in response to a supplemental authentication header from a filter for the web server.

15. The system of claim 12, wherein the server is further adapted to request the authentication data from the web browser if the server cannot retrieve the authentication data, and wherein the web browser is adapted to request authentication data from a user, and to provide the user entered authentication data to the server.

16. The system of claim 12, wherein the server is further adapted to provide the authentication data by formatting a response according to a hypertext transfer protocol.

17. The system of claim 12, wherein the authentication data includes a role of a user of the browser.

18. The system of claim 12, wherein the authentication data includes user identification information.

19. The system of claim 12, wherein the request for authentication data includes a hypertext transfer protocol authentication header.

20. The system of claim 19, wherein the server is further adapted to provide the authentication data in a hypertext transfer protocol authorization header.

21. The system of claim 12, wherein the server is further adapted to detect a supplemental authentication header and to respond to the supplemental authentication header by extracting the authentication data and forwarding the authentication data to the server in an authentication header.

22. The system of claim 12, wherein the request for authentication data includes a challenge to the request for access and wherein the server is adapted to provide the authentication data in response to the challenge by returning the challenge in an encrypted form, wherein the encrypted form indicates a shared secret.

23. The system of claim 12, wherein the web browser is a non-NTLM browser and the web server is a NTLM server.

24. A system for providing browser access to network resources protected by a web server, the system comprising:

means for requesting access by a browser to resources protected by a web server,

means for intercepting a request for authentication data from the web server to the browser at a server located on the same device as the browser;

means for determining whether the device has the requested authentication data; and

means for providing the authentication data from the server to the web server if the device has the requested authentication data.

25. The system of claim 24, wherein the server provides the authentication data by formatting a response according to a hypertext transfer protocol.

26. The system of claim 24, wherein the authentication data includes a role of a user of the browser.

27. The system of claim 26, wherein the authentication data further includes user identification information.

28. The system of claim 24, wherein the request for authentication data includes a hypertext transfer protocol authentication header.

29. The system of claim 28, wherein the means for providing the authentication data includes means for providing a hypertext transfer protocol authorization header.

30. The system of claim 24, further comprising:

means for detecting an access denial issued by the server in response to an access request;

means for providing a supplemental authentication header to the server;

means for detecting the supplemental authentication header; and

means for responding to the supplemental authentication header by extracting the authentication data, and forwarding the authentication data to the server in an authentication header.

31. The system of claim 24, further comprising:

means for requesting access by the browser to resources protected by a second web server;

means for intercepting a request for authentication data from the second web server to the browser at the server;

means for determining whether the device has the authentication data for the second web server; and

means for providing the authentication data from the server to the second web server if the device has the requested authentication data.

32. The system of claim 24, further comprising:

means for requesting the authentication data from the browser if the device does not include the authentication data;

means for receiving the authentication data from a user through a web browser interface;

means for providing the authentication data from the web browser to the server, and

means for providing the authentication data from the server to the web server.

33. The system of claim 24, wherein the request for authentication data includes a challenge to the request for access and wherein the means for providing of the authentication data in response to the challenge includes means for returning the challenge in an encrypted form, wherein the encrypted form indicates a shared secret.

34. The system of claim 33, wherein the web browser is a non-NTLM browser and the web server is a NTLM server.

35. An information storage media comprising:

information that requests access by a browser to resources protected by a web server;

information that intercepts a request for authentication data from the web server to the browser at a server located on the same device as the browser;

information that determines whether the requested authentication data is available; and

information that provides the authentication data from the server to the web server if the requested authentication data is available.

36. The information storage media of claim 35, wherein the information which provides the authentication data further comprises information that formats a response according to a hypertext transfer protocol.

37. The information storage media of claim 35, wherein the authentication data includes a role of a user of the browser.

38. The information storage media of claim 37, wherein the authentication data further includes user identification information.

39. The information storage media of claim 35, wherein the request for authentication data includes a hypertext transfer protocol authentication header.

40. The information storage media of claim 39, wherein the information that provides the authentication data further comprises information that provides a hypertext transfer protocol authorization header.

41. The information storage media of claim 35, further comprising:

information that detects an access denial issued by the server in response to an access request;

information that provides a supplemental authentication header to the server;

information that detects the supplemental authentication header; and

information that responds to the supplemental authentication header by extracting the authentication data, and forwards the authentication data to the server in an authentication header.

42. The information storage media of claim 35, further comprising:

information that requests access by the browser to resources protected by a second web server;

information that intercepts a request for authentication data from the second web server to the browser at the server;

information that determines whether the device has the authentication data for the second web server; and

information that provides the authentication data from the server to the second web server if the device has the requested authentication data.

43. The information storage media of claim 35, further comprising:

information that request the authentication data from the browser if the device does not include the authentication data;

information that receives the authentication data from a user through a web browser interface;

information that provides the authentication data from the web browser to the server, and

information that provides the authentication data from the server to the web server.

44. The information storage media of claim 35, wherein the request for authentication data includes a challenge to the request for access and wherein the information that provides the authentication data in response to the challenge further includes information that returns the challenge in an encrypted form, wherein the encrypted form indicates a shared secret.

45. The information storage media of claim 44, wherein the web browser is a non-NTLM browser and the web server is a NTLM server.