CONFIGURABLE ADAPTIVE ACCESS MANAGER CALLOUTS

• US 20170149837A1
• Filed: 12/06/2016
• Published: 05/25/2017
• Est. Priority Date: 09/29/2011
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Sondhi, Ajay, Bhat, Shivaram, Hingarajiya, Ravi
• Granted Patent: US 10,084,823 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/06 Authentication

Abstract

A framework, which conforms to the OAuth standard, involves a generic OAuth authorization server that can be used by multiple resource servers in order to ensure that access to resources stored on those resource servers is limited to access to which the resource owner consents. Each resource server registers, with the OAuth authorization server, metadata for that resource server, indicating scopes that are recognized by the resource server. The OAuth authorization server refers to this metadata when requesting consent from a resource owner on behalf of a client application, so that the consent will be of an appropriate scope. The OAuth authorization server refers to this metadata when constructing an access token to provide to the client application for use in accessing the resources on the resource server. The OAuth authorization server uses this metadata to map issued access tokens to the scopes to which those access tokens grant access.

Claims

1. A computer-implemented method comprising:

in response to an authentication request for a user associated with an identity domain, determining, by a computer system of an authorization system, based on a mapping between one or more access managers and one or more of a plurality of identity domains, an access manager that is associated with the identity domain with which the user is associated, wherein the access manager is included in the one or more access managers;

applying a policy associated with the identity domain to the authentication request;

determining, based on applying the policy to the authentication request, whether to request, from the access manager, an additional authentication process for authenticating the user for the authentication request, the additional authentication process being different from a standard authentication process;

upon determining to request the additional authentication process from the access manager, sending, by the computer system, a request to the access manager for information defining the additional authentication process for authenticating the user for the authentication request;

receiving, by the computer system, from the access manager, a response to the request, the response including the information defining the additional authentication process; and

performing the additional authentication process to authenticate the user for the authentication request.

2. The computer-implemented method of claim 1, wherein the authentication request includes one or more attributes, the one or more attributes identifying a source by which the authentication request was communicated;

and

wherein the determining the access manager that is associated with the identity domain with which the user is associated is further based on the one or more attributes.

3. The computer-implemented method of claim 2, further comprising:

identifying, based on the one or more attributes, a class of device by which the authentication request was communicated;

wherein the determining the access manager that is associated with the identity domain with which the user is associated is further based on the class of device.

4. The computer-implemented method of claim 2, further comprising:

determining the one or more attributes by examining a message received by the authorization system from the source, wherein the message includes the authentication request.

5. The computer-implemented method of claim 1, wherein the authentication request is based on an OAuth standard.

6. The computer-implemented method of claim 1, wherein the authentication request is received by the authentication system from a device associated with the user.

7. The computer-implemented method of claim 6, wherein the information defining the additional authentication indicates one or more types of authentication operations that are not included in the standard authentication process;

and

wherein performing the additional authentication process includes;

sending, from the authorization system, to the device associated with the user, a request for the device to perform the one or more types of authentication operations;

in response to the sending, receiving a message from the device indicating results of performing the one or more types of authentication operations; and

wherein authenticating the user is based on receiving the message.

8. The computer-implemented method of claim 6, wherein the information defining the additional authentication process includes one or more challenge questions that are not included in the standard authentication process;

and

wherein performing the additional authentication process includes;

sending, from the authorization system, to the device associated with the user, a first message including the one or more challenge questions;

in response to the sending, receiving, from the device, a second message including an answer to the one or more challenge questions; and

wherein authenticating the user is based on the answer in the second message.

9. The computer-implemented method of claim 6, wherein the information defining the additional authentication process includes a request for a code that is not included in the standard authentication process;

and

wherein performing the additional authentication process includes;

sending, from the authorization system, to the device associated with the user, a first message requesting the code from the user;

in response to the sending, receiving, from the device, a second message including the code by the user; and

wherein authenticating the user is based on the code in the second message.

10. The computer-implemented method of claim 1, wherein performing the additional authentication process to authenticate the user for the authentication request includes:

sending, to a device associate with the user, from the authentication system, a request for the device to authenticate the user using the additional authentication process.

11. The computer-implemented method of claim 1, wherein the determining whether to request the additional authentication process is further based on one or more user attributes that identify the user for the authentication request.

12. The computer-implemented method of claim 11, further comprising:

determining the one or more user attributes based on the identity domain with which the user is associated.

13. The computer-implemented method of claim 1, further comprising:

upon determining not to request the additional authentication process from the access manager, performing the standard authentication process for authenticating the user for the authentication request.

14. The computer-implemented method of claim 1, wherein the one or more access managers includes a plurality of access managers, and wherein each of the one or more access managers is associated with a different one of the plurality of identity domains.

15. A computer-readable memory comprising instructions which, when executed by one or more processors, cause the one or more processors to perform:

in response to an authentication request for a user associated with an identity domain, determine, based on a mapping between one or more access managers and one or more of a plurality of identity domains, an access manager that is associated with the identity domain with which the user is associated, wherein the access manager is included in the one or more access managers;

apply a policy associated with the identity domain to the authentication request;

determine, based on applying the policy to the authentication request, whether to request, from the access manager, an additional authentication process for authenticating the user for the authentication request, the additional authentication process being different from a standard authentication process;

upon determining to request the additional authentication process from the access manager, send, by the computer system, a request to the access manager for information defining the additional authentication process for authenticating the user for the authentication request;

receive, from the access manager, a response to the request, the response including the information defining the additional authentication process; and

perform the additional authentication process to authenticate the user for the authentication request.

16. The computer-readable memory of claim 15, wherein the authentication request includes one or more attributes, the one or more attributes identifying a source by which the authentication request was communicated;

and

wherein the determining the access manager that is associated with the identity domain with which the user is associated is further based on the one or more attributes.

17. A system comprising:

one or more processors; and

a memory accessible to the one or more processors, wherein the memory stores one or more instructions which, upon execution by the one or more processors, causes the one or more processors to;

in response to an authentication request for a user associated with an identity domain, determine, based on a mapping between one or more access managers and one or more of a plurality of identity domains, an access manager that is associated with the identity domain with which the user is associated, wherein the access manager is included in the one or more access managers;

apply a policy associated with the identity domain to the authentication request;

determine, based on applying the policy to the authentication request, whether to request, from the access manager, an additional authentication process for authenticating the user for the authentication request, the additional authentication process being different from a standard authentication process;

upon determining to request the additional authentication process from the access manager, send, by the computer system, a request to the access manager for information defining the additional authentication process for authenticating the user for the authentication request;

receive, from the access manager, a response to the request, the response including the information defining the additional authentication process; and

perform the additional authentication process to authenticate the user for the authentication request.

18. The system of claim 17, wherein the memory further stores one or more instructions which, upon execution by the one or more processors, causes the one or more processors to:

determine one or more user attributes that identify the user for the authentication request, the one or more attributes determined based on an identity domain with which the user is associated; and

wherein determining whether to request the additional authentication process is further based on the one or more user attributes.

19. The system of claim 17, wherein the memory, the one or more processors, and the one or more access managers are included in a cloud computing system.

20. The system of claim 17, wherein the memory, the one or more processors, and the one or more access managers are included in an enterprise system.