ENABLING AUTHENTICATION OF OPENID USER WHEN REQUESTED IDENTITY PROVIDER IS UNAVAILABLE

• US 20100011421A1
• Filed: 07/13/2008
• Published: 01/14/2010
• Est. Priority Date: 07/13/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Chen, Gang, Kaplinger, Todd Eric, Chari, Suresh N.
• Granted Patent: US 8,250,635 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A method, system and computer program product for enabling authentication of an OpenID user when a requested identity provider is unavailable. A relying party receives a login request from the OpenID user, where the login request includes a username. The relying party reads a list of trusted identity providers that are associated with the received username and selects one of those identity providers. The relying party generating an OpenID identifier using an identification (e.g., Uniform Resource Locator) of the selected identity provider and the username. The relying party transmits an authentication request (request to authenticate the OpenID user) to the selected identity provider using the formed OpenID identifier. If the selected identity provider is unavailable, then the relying party selects another identity provider from the list of identity providers that are associated with the received username and repeats the above process.

Claims

1. A method for enabling authentication of an OpenID user when a requested identity provider is unavailable, the method comprising:

receiving a login request from said OpenID user, wherein said login request comprises a username;

reading a list of identity providers associated with said username;

identifying a first available identity provider from said list of identity providers;

generating a first OpenID identifier using an identification of said first identified identity provider and said username; and

transmitting a request to said first identified identity provider to authenticate said OpenID user using said first OpenID identifier.

2. The method as recited in claim 1 further comprising:

configuring a relying party to contain said list of identity providers associated with said username.

3. The method as recited in claim 1 further comprising:

completing said OpenID authentication with said first identified identity provider if said first identified identity provider is available.

4. The method as recited in claim 1 further comprising:

incrementing a counter if said first identified identity provider was not available.

5. The method as recited in claim 4 further comprising:

reading said list of identity providers associated with said username to identify a next available identity provider.

6. The method as recited in claim 5 further comprising:

identifying said next available identity provider;

generating a second OpenID identifier using an identification of said next identified identity provider and said username; and

transmitting a request to said next identified identity provider to authenticate said OpenID user using said second OpenID identifier.

7. A computer program product embodied in a computer readable medium for enabling authentication of an OpenID user when a requested identity provider is unavailable, the computer program product comprising the programming instructions for:

receiving a login request from said OpenID user, wherein said login request comprises a username;

reading a list of identity providers associated with said username;

identifying a first available identity provider from said list of identity providers;

generating a first OpenID identifier using an identification of said first identified identity provider and said username; and

transmitting a request to said first identified identity provider to authenticate said OpenID user using said first OpenID identifier.

8. The computer program product as recited in claim 7 further comprising the programming instructions for:

configuring a relying party to contain said list of identity providers associated with said username.

9. The computer program product as recited in claim 7 further comprising the programming instructions for:

completing said OpenID authentication with said first identified identity provider if said first identified identity provider is available.

10. The computer program product as recited in claim 7 further comprising the programming instructions for:

incrementing a counter if said first identified identity provider was not available.

11. The computer program product as recited in claim 10 further comprising the programming instructions for:

reading said list of identity providers associated with said username to identify a next available identity provider.

12. The computer program product as recited in claim 11 further comprising the programming instructions for:

identifying said next available identity provider;

generating a second OpenID identifier using an identification of said next identified identity provider and said username; and

transmitting a request to said next identified identity provider to authenticate said OpenID user using said second OpenID identifier.

13. A method for obtaining attribute information for an OpenID user during an authentication phase, the method comprising:

receiving a login request from said OpenID user, wherein said login request comprises a username;

determining user profile attributes to be requested from one or more identity providers;

reading a list of identity providers associated with said username;

identifying a first available identity provider from said list of identity providers;

generating a first OpenID identifier using an identification of said first identified identity provider and said username; and

transmitting an authentication request to said first identified identity provider to authenticate said OpenID user using said first OpenID identifier.

14. The method as recited in claim 13, wherein said authentication request comprises a request to obtain all of said determined user profile attributes.

15. The method as recited in claim 14 further comprising:

completing said OpenID authentication with said first identified identity provider if said first identified identity provider is available and if said first identified identity provider can provide all of said determined user profile attributes.

16. The method as recited in claim 13, wherein said authentication request comprises a request to obtain one or more user profile attributes not previously obtained.

17. The method as recited in claim 16 further comprising:

obtaining one or more of said one or more user profile attributes not previously obtained from said first identity provider if said first identity provider is available and if said first identity provider can provide said one or more of said one or more user profile attributes not previously obtained.

18. A computer program product embodied in a computer readable medium for obtaining attribute information for an OpenID user during an authentication phase, the computer program product comprising the programming instructions for:

receiving a login request from said OpenID user, wherein said login request comprises a username;

determining user profile attributes to be requested from one or more identity providers;

reading a list of identity providers associated with said username;

identifying a first available identity provider from said list of identity providers;

generating a first OpenID identifier using an identification of said first identified identity provider and said username; and

transmitting an authentication request to said first identified identity provider to authenticate said OpenID user using said first OpenID identifier.

19. The computer program product as recited in claim 18, wherein said authentication request comprises a request to obtain all of said determined user profile attributes.

20. The computer program product as recited in claim 19 further comprising the programming instructions for:

completing said OpenID authentication with said first identified identity provider if said first identified identity provider is available and if said first identified identity provider can provide all of said determined user profile attributes.

21. The computer program product as recited in claim 18, wherein said authentication request comprises a request to obtain one or more user profile attributes not previously obtained.

22. The computer program product as recited in claim 21 further comprising the program instructions for:

obtaining one or more of said one or more user profile attributes not previously obtained from said first identity provider if said first identity provider is available and if said first identity provider can provide said one or more of said one or more user profile attributes not previously obtained.