Method and system of integrating third party authentication into internet browser code

• US 20060185021A1
• Filed: 04/24/2006
• Published: 08/17/2006
• Est. Priority Date: 03/15/2002
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Rouskov, Yordan, Wang, Biao, Hawkins, John M., Erdogan, Samim, Dujari, Rajeev
• Granted Patent: US 7,698,735 B2
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A method and system for using an Internet client'"'"'s local authentication mechanism in systems having updated browser code, so as to enable third party authentication according to an authentication scheme specified by a participating server on clients with updated browser code, while not breaking clients with legacy browser code. A redirect response from a server has authentication data added thereto such that updated browser code can detect the data'"'"'s presence and enable the use of local security mechanisms for authentication purposes with the server-specified authentication scheme, including local credential entry for verification at a third party login server. At the same time, if such a redirect response is received by prior browser code, the added data is ignored while conventional redirection occurs, such that third party authentication may be performed via redirection to a third party'"'"'s Internet page that provides a form for credential entry.

Claims

1. In a computing environment, a method, comprising:

requesting content from a remote server;

receiving a redirect response from the server, the redirect response including information identifying a location corresponding to a server of a third party authentication service;

determining whether the redirect response includes authentication data identifying a specified authentication scheme, and if so;

a) invoking local code corresponding to the specified authentication scheme to obtain credentials locally, and

b) providing those credentials to the third party authentication service.

2. The method of claim 1 wherein requesting content from a remote server comprises issuing an HTTP get request, and wherein receiving a redirect response from the server comprises receiving an HTTP 302 response.

3. The method of claim 1 wherein invoking local code corresponding to the specified authentication scheme comprises converting the HTTP 302 response into an HTTP 401 response based on the authentication data in the HTTP 302 response.

4. The method of claim 1 wherein determining whether the redirect response includes authentication data comprises evaluating a header of the redirect response.

5. The method of claim 1 wherein invoking local code corresponding to the specified authentication scheme comprises generating an authentication context object.

6. The method of claim 1 wherein invoking local code corresponding to the specified authentication scheme comprises generating a response that simulates an authentication response.

7. The method of claim 1 wherein invoking the local code corresponding to the specified authentication scheme to obtain credentials locally comprises, providing a user interface, and obtaining the credentials via the user interface.

8. The method of claim 1 further comprising, receiving a ticket from the third party authentication service, providing the ticket to the remote server, and receiving content from the remote server.

9. The method of claim 1 wherein the redirect response does not include authentication data, and further comprising, redirecting a request to the server of the third party authentication service that is identified in the redirect response.

10. A computer-readable medium having computer-executable instructions for performing the method of claim 1.

11. In a computing environment, a system comprising:

local authentication code corresponding to an authentication scheme, the local authentication code configured to obtain credentials corresponding to the authentication scheme and return the credentials to an entity that invokes the local authentication code; and

local browser code configured to;

a) request content from a remote resource server,

b) receive responses from the remote resource server, including a redirect response, the redirect response including information identifying a location corresponding to a server of a third party authentication service and authentication data identifying a specified authentication scheme;

c) evaluate the response and detect the authentication data;

d) invoke the local authentication code and receive credentials in response;

e) provide the credentials to a remote third party authentication service server;

g) receive a ticket from the remote third party authentication service; and

h) provide the ticket to the remote resource server in association with another request for content.

12. The system of claim 11 wherein the local authentication code obtains the credentials from a storage location.

13. The system of claim 11 wherein the local authentication code obtains the credentials by providing a user interface.

14. The system of claim 11 wherein the local browser code communicates with the local authentication code via an authentication context object.

15. The system of claim 11 wherein the local browser code invokes the local authentication code by converting the redirect response to an authentication response.

16. The system of claim 15 wherein the redirect response comprises an HTTP 302 status response and the authentication response comprises an HTTP 401 status response.

17. The system of claim 11 wherein the local browser code detects the authentication data in a header of the redirect response.

18. A computer-readable medium having stored thereon a data structure, comprising:

a first set of data indicating that the data structure is a redirect response received from a remote server in response to a request to that remote server;

a second set of data identifying a location to where the request should be redirected; and

a third set of data corresponding to an authentication scheme;

wherein when the data structure is evaluated by first browser code that recognizes that the authentication scheme data is present, the first browser code invokes local authentication code to obtain credentials, and

when the data structure is evaluated by second browser code that does not recognize that the authentication scheme data is present, the second browser code redirects the request to the location identified in the second set of data.