CONSOLIDATED AUTHENTICATION

• US 20160191500A1
• Filed: 03/03/2016
• Published: 06/30/2016
• Est. Priority Date: 05/07/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Doleh, Yaser K., Kalamaras, Christopher G., Marzorati, Mauro
• Granted Patent: US 9,762,568 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/1012 to domains
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A method and system for authenticating a user at a first computer to first and second applications installed in a second computer. The second computer receives from the user a first request to access the first application, and in response, the second computer redirects the first request to a third computer, and in response, the third computer determines that the user was previously authenticated and so notifies the second computer, and in response, the second computer returns a first session key to the third computer. The first session key enables a session with the first application but not with the second application. A second session key was sent by the third computer to the first computer after the third computer received the first session key from the second computer. The second session key enables a session with both the first application and the second application.

Claims

1. A method for authenticating a user at a first compute first and second applications installed in a second computer, the method comprising:

said second computer receiving from the user a first request to access the first application, and in response, the second computer redirecting the first request to a third computer, and in response, the third compute determining that the user was previously authenticated and notifying the second computer that the user is authentic, and in response, the second computer returning a first session key to the third computer, said first session key enabling a session with the first application but not with the second application; and

wherein a second session key was sent by the third computer to the first computer after the third computer received the first session key from the second computer, and

wherein the second session key enables a session with both the first application and the second application.

2. The method of claim 1, said method further comprising:

said second computer receiving from the user a second request with the second session key to access the first application, the second application, or both the first application and the second application, and in response the second computer determining that the user is authentic and notifying the first application, the second application, or both the first application and the second application that the user is authentic so that the first application, the second application, or both the first application and the second application can send, to the first computer, a response to the second request

3. The method of claim 2, said method further comprising:

said second computer receiving from the user the second request with the second session key to access the first application, and in response the second computer determining that the user is authentic and notifying the first application that the user is authentic so that the first application can send, to the first computer, a response to the second request.

4. The method of claim 2, said method further comprising:

said second computer receiving from the user the second request with the second session key to access the second application, and in response the second computer determining that the user is authentic and notifying the second application that the user is authentic so that the second application can send, to the first computer, a response to the second request.

5. The method of claim 2, wherein the second session key also enables a session with a third application in a fourth computer, and where in method further comprises:

said fourth computer receiving a third request including the second session key from the user to access the third application, and in response the fourth computer determining that the user is authentic and notifying the third application that the user is authentic so the third application can send, to the first computer, a response to the third request.

6. The method of claim 1, wherein the user was previously authenticated to the third computer during registration of the user with the third computer.

7. A computer program product, comprising one or more computer readable hardware storage devices having computer readable program code stored therein, said program code containing instructions executable by one or more processors of a computer system to implement a method for authenticating a user at a first computer to first and second applications installed in a second computer, said method comprising:

said second computer receiving from the user a first request to access the first application, and in response, the second computer redirecting the first request to a third computer, and in response, the third computer determining that the user was previously authenticated and notifying the second computer that the user is authentic, and in response, the second compute returning a first session key to the third computer, said first session key enabling a session with the first application but not with the second application,

wherein a second session key was sent by the third computer to the first computer after the third computer received the first session key from the second computer, and

wherein the second session key enables a session with both the first application and the second application.

8. The computer program product of claim 7, said method further comprising:

said second computer receiving from the user a second request with the second session key to access the first application, the second application, or both the first application and the second application, and in response the second computer determining that the user is authentic and notifying the first application, the second application, or both the first application and the second application that the user is authentic so that the first application, the second application, or both the first application and the second application can send, to the first computer, a response to the second request

9. The computer program product of claim 8, said method further comprising:

said second computer receiving from the user the second request with the second session key to access the first application, and in response the second computer determining that the user is authentic and notifying the first application that the user is authentic so that the first application can send, to the first computer, a response to the second request.

10. The computer program product of claim 8, said further comprising:

said second computer receiving from the user the second request with the second session key to access the second application, and in response the second computer determining that the user is authentic and notifying the second application that the user is authentic so that the second application can send, to the first computer, a response to the second request.

11. The computer program product of claim 8, wherein the second session key also enables a session with a third application in a fourth computer, and where in method further comprises:

said fourth computer receiving a third request including the second session key from the user to access the third application, and in response the fourth computer determining that the user is authentic and notifying the third application that the user is authentic so the third application can send, to the first computer, a response to the third request.

12. The computer program product of claim 7, wherein the user was previously authenticated to the third computer during registration of the user with the third computer.

13. A computer system, comprising one or more processors, one or more memories, and one or more computer readable hardware storage devices, said one or more hardware storage device containing program code executable by the one or more processors via the one or more memories to implement a method for authenticating a user at a first computer to first and second applications installed in a second computer, said method comprising:

said second computer receiving from the user a first request to access the first application, and in response, the second computer directing the first request to a third computer, and in response, the third computer determining that the user was previously authenticated and notifying the second computer that the user is authentic, and in response, the second compute returning a first session key to the third computer, said first session key enabling a session with the first application but not with the second application,

wherein a second session key was sent by the third computer to the first computer after the third computer received the first session key from the second computer, and

wherein the second session key enables a session with both the first application and the second application.

14. The computer system of claim 13, said method further comprising:

said second computer receiving from the user a second request with the second session key to access the first application, the second application, both the first application and the second application, and in response the second computer determining that the user is authentic and notifying the first application, the second application, or both the first application and the second application that the user is authentic so that the first application, the second application, or both the first application and the second application can send, to the first computer, a response to the second request

15. The computer system of claim 14, said method further comprising:

said second computer receiving from the user the second request with the second session key to access the first application, and in response the second computer determining that the user is authentic and notifying the first application that the user is authentic so that the first application can send, to the first computer, a response to the second request.

16. The computer system of claim 14, said method further comprising:

said second computer receiving from the user the second request with the second session key to access the second application, and in response the second computer determining that the user is authentic and notifying the second application that the user is authentic so that the second application can send, to the first computer, a response to the second request.

17. The computer system of claim 14, wherein the second session key also enables a session with a third application in a fourth computer, and where in method further comprises:

said fourth computer receiving a third request including the second session key from the user to access the third application, and in response the fourth computer determining that the user is authentic and notifying the third application that the user is authentic so the third application can send, to the first computer, a response to the third request.

18. The computer system of claim 13, wherein the user was previously authenticated to the third computer during registration of the user with the third computer.