Method and apparatus for facilitating single sign-on of an application cluster

• US 20040199794A1
• Filed: 04/01/2003
• Published: 10/07/2004
• Est. Priority Date: 04/01/2003
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Philips, Andrew B., Schneider Hollinger, Marilyn Joyce
• Granted Patent: US 7,530,094 B2
• Time in Patent Office: Days
• US Class Current: 726/8
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

One embodiment of the present invention provides a system that facilitates single sign-on of an application cluster, wherein the application cluster includes a plurality of computer applications residing on the same computer system. The system operates by first receiving a logon request at a server from the application cluster, wherein the logon request specifies an account for the server. Next, the system authenticates the application cluster to the server and determines if the application cluster is authorized to use the specified account. If so, the system authorizes the application cluster to use the specified account.

Claims

1. A method for facilitating single sign-on of an application cluster, wherein the application cluster provides a common identity for a plurality of computer applications residing on the same computer system, comprising:

receiving a logon request at a server from the application cluster, wherein the logon request specifies an account for the server;

authenticating the application cluster to the server;

determining if the application cluster is authorized to use the specified account; and

if so, authorizing the application cluster to use the specified account.

2. The method of claim 1, wherein authenticating the application cluster to the server involves verifying an authentication credential supplied by the application cluster.

3. The method of claim 2, wherein verifying the authentication credential involves:

requesting a password verifier from a directory service;

challenging the application cluster with the password verifier;

examining a response to this challenge; and

if the response is valid, accepting the authentication credential.

4. The method of claim 1, wherein determining if the application cluster is authorized to use the specified account involves:

requesting authorization from a directory service;

receiving a response from the directory service; and

if an authorization is contained in the response, granting access to the application cluster.

5. The method of claim 1, wherein authenticating the application cluster to the server involves providing an account name and an account password for the specified account.

6. The method of claim 1, wherein applications hosted by the application cluster share a common authentication credential.

7. The method of claim 1, wherein the server includes a directory server.

8. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for facilitating single sign-on of an application cluster, wherein the application cluster provides a common identity for a plurality of computer applications residing on the same computer system, the method comprising:

receiving a logon request at a server from the application cluster, wherein the logon request specifies an account for the server;

authenticating the application cluster to the server;

determining if the application cluster is authorized to use the specified account; and

if so, authorizing the application cluster to use the specified account.

9. The computer-readable storage medium of claim 8, wherein authenticating the application cluster to the server involves verifying an authentication credential supplied by the application cluster.

10. The computer-readable storage medium of claim 9, wherein verifying the authentication credential involves:

requesting a password verifier from a directory service;

challenging the application cluster with the password verifier;

examining a response to this challenge; and

if the response is valid, accepting the authentication credential.

11. The computer-readable storage medium of claim 8, wherein determining if the application cluster is authorized to use the specified account involves:

requesting authorization from a directory service;

receiving a response from the directory service; and

if an authorization is contained in the response, granting access to the application cluster.

12. The computer-readable storage medium of claim 8, wherein authenticating the application cluster to the server involves providing an account name and an account password for the specified account.

13. The computer-readable storage medium of claim 8, wherein applications hosted by the application cluster share a common authentication credential.

14. The computer-readable storage medium of claim 8, wherein the server includes a directory server.

15. An apparatus for facilitating single sign-on of an application cluster, wherein the application cluster provides a common identity for a plurality of computer applications residing on the same computer system, comprising:

a receiving mechanism configured to receive a logon request at a server from the application cluster, wherein the logon request specifies an account for the server;

an authenticating mechanism configured to authenticate the application cluster to the server;

a determining mechanism configured to determine if the application cluster is authorized to use the specified account; and

an authorizing mechanism configured to authorize the application cluster to use the specified account if the application cluster is authorized to use the specified account.

16. The apparatus of claim 15, further comprising a verifying mechanism configured to verify an authentication credential supplied by the application cluster.

17. The apparatus of claim 16, further comprising:

a requesting mechanism configured to request a password verifier from a directory service;

a challenging mechanism configured to challenge the application cluster using the password verifier;

an examining mechanism configured to examine a response to this challenge; and

an accepting mechanism configured to accept the authentication credential if the response is valid.

18. The apparatus of claim 15, further comprising:

a requesting mechanism configured to request authorization from a directory service;

a receiving mechanism configured to receive a response from the directory service; and

a granting mechanism configured to grant access to the application cluster if an authorization is contained in the response.

19. The apparatus of claim 15, wherein authenticating the application cluster to the server involves providing an account name and an account password for the specified account.

20. The apparatus of claim 15, wherein applications hosted by the application cluster share a common authentication credential.

21. The apparatus of claim 15, wherein the server includes a directory server.