Method and system for enabling federated user lifecycle management

• US 20060048216A1
• Filed: 07/21/2004
• Published: 03/02/2006
• Est. Priority Date: 07/21/2004
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Wardrop, Patrick Ryan, Hinton, Heather Maria, Falola, Dolapo Martin, Moran, Anthony Scott
• Application Number:
  US10/896,316
• Publication Number:
  US 20060048216A1
• Time in Patent Office: Days
• US Class Current: 726/8
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]
• CPC Class Codes: H04W 80/10 adapted for application session management, e.g. SIP [Session Initiation Protocol] connection management H04W76/00; arrangements for session management H04L67/14

Abstract

A method and a system are presented in which federated service providers interact within a federated environment to initiate federated operations. A point-of-contact component that provides session management capabilities at a first service provider receives a request from a client. The request is then sent, possibly using redirection through a client, to a federated user lifecycle management functional component of the first service provider, which may interact with a point-of-contact component at a second service provider to initiate a federated user lifecycle management function at the second service provider, which enlists the assistance of a federated user lifecycle management functional component at the second service provider. In response to completion of a federated user lifecycle management function, the point-of-contact component at the first service provider subsequently receives a response from the federated user lifecycle management functional component at the first service provider, and the original request can be further processed.

Claims

1. A method for providing federated functionality within a data processing system, the method comprising:

receiving a first request from a client at a point-of-contact functional component of a first service provider, wherein the point-of-contact functional component performs session management for the first service provider with respect to clients of the first service provider, and wherein the service provider is associated with a plurality of service providers within a federated computing environment; and

in response to a determination that subsequent processing of the first request requires prior invocation of a federated user lifecycle management function, sending a second request from the point-of-contact functional component of the first service provider to a federated user lifecycle management functional component of the first service provider, wherein the second request contains information derived from the first request.

2. The method of claim 1 further comprising:

in response to completion of the federated user lifecycle management function, receiving a first response at the point-of-contact functional component of the first service provider from the federated user lifecycle management functional component of the first service provider.

3. The method of claim 2 further comprising:

performing subsequent processing on the first request at the point-of-contact functional component in accordance with the first response.

4. The method of claim 1 further comprising:

sending the second request from the point-of-contact functional component of the first service provider to the federated user lifecycle management functional component of the first service provider via redirection through the client.

5. The method of claim 1 further comprising:

building a session for the client at the point-of-contact functional component.

6. The method of claim 1 further comprising:

sending a third request from the point-of-contact functional component of the first service provider to a resource accessing functional component of the first service provider, wherein the third request contains information derived from the first request.

7. The method of claim 1 further comprising:

sending a fourth request from the federated user lifecycle management functional component of the first service provider to a point-of-contact functional component at a second service provider, wherein the second service provider is an identity provider, and the fourth request requests an authentication token for completing a single-sign-on operation at the first service provider.

8. The method of claim 7 further comprising:

receiving a second response from the federated user lifecycle management functional component of the second service provider at the federated user lifecycle management functional component of the first service provider, wherein the second response contains an authentication token.

9. An apparatus for providing federated functionality within a data processing system, the apparatus comprising:

means for receiving a first request from a client at a point-of-contact functional component of a first service provider, wherein the point-of-contact functional component performs session management for the first service provider with respect to clients of the first service provider, and wherein the service provider is associated with a plurality of service providers within a federated computing environment; and

means for sending, in response to a determination that subsequent processing of the first request requires prior invocation of a federated user lifecycle management function, a second request from the point-of-contact functional component of the first service provider to a federated user lifecycle management functional component of the first service provider, wherein the second request contains information derived from the first request.

10. The apparatus of claim 9 further comprising:

means for receiving, in response to completion of the federated user lifecycle management function, a first response at the point-of-contact functional component of the first service provider from the federated user lifecycle management functional component of the first service provider.

11. The apparatus of claim 10 further comprising:

means for performing subsequent processing on the first request at the point-of-contact functional component in accordance with the first response.

12. The apparatus of claim 9 further comprising:

means for sending the second request from the point-of-contact functional component of the first service provider to the federated user lifecycle management functional component of the first service provider via redirection through the client.

13. The apparatus of claim 9 further comprising:

means for building a session for the client at the point-of-contact functional component.

14. The apparatus of claim 9 further comprising:

means for sending a third request from the point-of-contact functional component of the first service provider to a resource accessing functional component of the first service provider, wherein the third request contains information derived from the first request.

15. The apparatus of claim 9 further comprising:

means for sending a fourth request from the federated user lifecycle management functional component of the first service provider to a point-of-contact functional component at a second service provider, wherein the second service provider is an identity provider, and the fourth request requests an authentication token for completing a single-sign-on operation at the first service provider.

16. The apparatus of claim 15 further comprising:

means for receiving a second response from the federated user lifecycle management functional component of the second service provider at the federated user lifecycle management functional component of the first service provider, wherein the second response contains an authentication token.

17. A computer program product on a computer readable medium for use in a data processing system for providing federated functionality, the computer program product comprising:

means for receiving a first request from a client at a point-of-contact functional component of a first service provider, wherein the point-of-contact functional component performs session management for the first service provider with respect to clients of the first service provider, and wherein the service provider is associated with a plurality of service providers within a federated computing environment; and

means for sending, in response to a determination that subsequent processing of the first request requires prior invocation of a federated user lifecycle management function, a second request from the point-of-contact functional component of the first service provider to a federated user lifecycle management functional component of the first service provider, wherein the second request contains information derived from the first request.

18. The computer program product of claim 17 further comprising:

means for receiving, in response to completion of the federated user lifecycle management function, a first response at the point-of-contact functional component of the first service provider from the federated user lifecycle management functional component of the first service provider.

19. The computer program product of claim 18 further comprising:

means for performing subsequent processing on the first request at the point-of-contact functional component in accordance with the first response.

20. The computer program product of claim 17 further comprising:

means for sending the second request from the point-of-contact functional component of the first service provider to the federated user lifecycle management functional component of the first service provider via redirection through the client.

21. The computer program product of claim 17 further comprising:

means for building a session for the client at the point-of-contact functional component.

22. The computer program product of claim 17 further comprising:

means for sending a third request from the point-of-contact functional component of the first service provider to a resource accessing functional component of the first service provider, wherein the third request contains information derived from the first request.

23. The computer program product of claim 17 further comprising:

means for sending a fourth request from the federated user lifecycle management functional component of the first service provider to a point-of-contact functional component at a second service provider, wherein the second service provider is an identity provider, and the fourth request requests an authentication token for completing a single-sign-on operation at the first service provider.

24. The computer program product of claim 23 further comprising:

means for receiving a second response from the federated user lifecycle management functional component of the second service provider at the federated user lifecycle management functional component of the first service provider, wherein the second response contains an authentication token.