Identity provider instance discovery

• US 20130179573A1
• Filed: 02/28/2013
• Published: 07/11/2013
• Est. Priority Date: 12/03/2010
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: McCarty, Richard James
• Granted Patent: US 8,838,792 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: G06F 9/505 considering the load
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services

Abstract

A method of discovering an identity provider instance according to this disclosure begins upon receipt from a service provider (or from a discovery service to which the service provider redirects the user) of a request for an IdP instance. Preferably, the request for an IdP instance is received as a Web services request following receipt at the service provider of an end user client request to access an application. In response to receiving the request, an IdP instance is selected, preferably using one or more criteria, such as user proximity, instance load, instance availability, the existence of a prior IdP binding, or the like. Following the selection, a response to the request is generated and returned to the requesting service provider. Preferably, the response is a redirect to the selected IdP instance.

Claims

1. A method of discovering an identity provider instance, the identity provider instance being one of a plurality of identity provider instances that comprise a logical IdP service, comprising:

receiving a request for an identity provider instance, the request being associated with a service provider;

in response to receiving the request, selecting a particular one of the plurality of identity provider instances according to a selection criteria; and

returning a response to the request identifying the selected identity provider instance.

2. The method as described in claim 1 wherein the selection criteria is a capability associated with one or more identity provider instances.

3. The method as described in claim 1 wherein the selection criteria is one of:

a network proximity between an computing entity and one or more of the identity provider instances, a geographic proximity between a computing entity and one or more of the identity provider instances, a load associated with one or more of the identity provider instances, availability of one or more identity provider instances, a performance metric associated with one or more identity provider instances, and an existing binding associated with one or more identity provider instances.

4. The method as described in claim 1 wherein the request for an identity provider instance is a Web service request that is generated by the service provider.

5. The method as described in claim 1 wherein the request for an identity provider instance is received following selection of an identity provider associated with the plurality of identity provider instances.

6. The method as described in claim 1 wherein the plurality of identity provider instances include at least one cluster of identity provider instances that are co-located with one another.

7. The method as described in claim 1 wherein the plurality of identity provider instances includes at least first and second clusters of identity provider instances, the first cluster being located remote from the second cluster.

8. The method as described in claim 1 further including maintaining at least first and second identity provider instances in a synchronized state.

9. The method as described in claim 1 wherein the logical IdP service is a logical enterprise IdP service.

10. A method to automatically select an identity provider (IdP) instance from among a set of identity provider instances comprising an enterprise IdP service, comprising:

clustering a plurality of identity provider instances at distributed locations to provide IdP discovery for a plurality of federated applications, each cluster comprising a plurality of identity provider instances;

responsive to receipt at a cluster of a request for an identity provider instance, determining whether the request should be processed at the cluster;

if it is determined that the request should be processed at the cluster, determining an appropriate cluster instance and returning a response to the request; and

if it is determined that the request should not be processed at the cluster, redirecting the request to another cluster for servicing.

11. The method as described in claim 10 further including maintaining a synchronized state across the distributed locations.

12. The method as described in claim 10 wherein a determination that the request should not be processed at the cluster is made if an identity provider instance is unavailable, if an identity provider instance does not provide a given capability, or for load balancing purposes.