Access system interface

• US 7,185,364 B2
• Filed: 03/21/2001
• Issued: 02/27/2007
• Est. Priority Date: 03/21/2001
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Gupta, Minoo, Knouse, Charles W.
• Primary Examiner(s): Vu; Kim
• Assistant Examiner(s): Dada; Beemnet W
• Application Number:
  US09/814,091
• Publication Number:
  US 20030074580A1
• Time in Patent Office: 2,169 Days
• Field of Search: 713/200, 713/201, 713/151, 713/202, 713/168, 173/153, 726 4- 8, 726 17- 19, 709/225, 709/226, 709/229
• US Class Current: 726/8
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/142 Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding

Abstract

An access system provides identity management and/or access management services for a network. An application program interface for the access system enables an application without a web agent front end to read and use contents of an existing encrypted cookie to bypass authentication and proceed to authorization. A web agent is a component (usually software, but can be hardware or a combination of hardware and software) that plugs into (or otherwise integrates with) a web server (or equivalent) in order to participate in providing access services.

Claims

1. A method for providing access services, comprising:

receiving user session state information for a first user at an application program interface for an access system, said user session state information is from an application without a web agent front end, said user session state information is from a cookie stored on a client for said first user, said user session state information is encrypted, and said step of receiving user session state information includes decrypting said user session state information;

receiving, at said application program interface, a request to authorize said first user to access a first resource, said request to authorize is from said application without a web agent front end;

providing authorization services of said access system to said application without a web agent front end using said application program interface in an attempt to authorize said first user to access said first resource without requiring said first user to re-submit authentication credentials;

receiving a request from said application without a web agent front end for unencrypted data from said user session state information; and

providing said unencrypted data from said user session state information to said application without a web agent front end, said application without a web agent front end does not have access to a key to decrypt said user session state information.

2. A method according to claim 1, wherein:

said unencrypted data includes an identity for said first user.

3. A method according to claim 1, wherein:

said session state information was created by an access system; and

said access system performs said step of attempting to authorize.

4. A method according to claim 1, wherein:

said user session state information was created by an access system and provided to said application without a web agent front end by said access system;

said application without a web agent front end caused said session token to be stored in said cookie; and

said access system attempts to authorize said first user.

5. A method according to claim 1, wherein said user session state information includes:

an identity for said first user;

an authentication level for said first user; and

a session start time for said first user.

6. A method according to claim 1, wherein said resource request information includes:

an identification of a resource type;

an identification of a resource; and

an identification of an operation.

7. A method according to claim 1, wherein said resource request information includes:

an identification of a resource type;

an identification of a resource;

an identification of an operation; and

query string information.

8. A method according to claim 1, wherein said resource request information includes:

an identification of a resource type;

an identification of a resource;

an identification of an operation; and

post data information.

9. A method according to claim 1, wherein:

said web agent front end is a Web Gate.

10. A method according to claim 1, wherein:

said attempt to authorize is based on said user session state information and said resource request information.

11. A method according to claim 1, further comprising the steps of:

creating a resource request object, said resource request object represents a request to access said first resource; and

creating a user session object, said user session object represents said first user after said first user has been authenticated.

12. A method according to claim 1, further comprising the steps of:

determining whether said first resource is protected;

determining an authentication scheme for said first resource; and

determining whether said authentication scheme is satisfied based on said user session state information.

13. A method according to claim 12, further comprising the steps of:

making available to said application without a web agent front end an indication of whether said first resource is protected; and

making available to said application without a web agent front end an indication of said authentication scheme.

14. A method according to claim 1, further comprising the step of:

determining one or more authentication actions for said first resource.

15. A method according to claim 14, further comprising the step of:

making available to said application without a web agent front end an indication of said one or more authentication actions for said first resource.

16. A method according to claim 14, further comprising the step of:

performing at least one of said authentication actions for said first resource.

17. A method according to claim 1, further comprising the step of:

determining one or more authorization actions for said first resource.

18. A method according to claim 17, further comprising the step of:

making available to said application without a web agent front end an indication of said one or more authorization actions for said first resource.

19. A method according to claim 17, further comprising the step of:

performing at least one of said authorization actions for said first resource.

20. A method according to claim 1, further comprising the step of:

determining one or more audit rules for said first resource.

21. A method according to claim 20, further comprising the step of:

making available to said application without a web agent front end an indication of said one or more audit rules for said first resource.

22. A method according to claim 20, further comprising the step of:

performing at least one of said audit rules for said first resource.

23. A method according to claim 1, further comprising the step of:

allowing said first user to access said first resource if said first user is authorized to access said first resource.

46. The method of claim 1, further comprising:

maintaining at a directory server a policy domain, wherein the policy domain comprises;

at least one authorization rule for said first resource;

at least one authentication rule for said first resource; and

at least one audit rule for said first resource.

47. The method of claim 46, wherein the at least one authentication rule is a plurality of authentication rules comprising a first level authentication rule and a second level authentication rule.

48. The method of claim 46, wherein the policy domain comprises at least one URL prefix.

49. The method of claim 46, wherein the policy domain comprises at least one host identifiers.

24. A method for providing access services by an application without a web agent front end, comprising:

receiving, at an application without a web agent front end, an electronic request from a first user to access a first resource, said step of receiving includes receiving information from a cookie wherein said information from said cookie is encrypted;

providing said information from said cookie to an application program interface for an access system; and

with said application without a web agent front end, accessing authorization services of said access system using said application program interface, said accessing includes requesting said access system to authorize said first user to access said first resource based on information from said electronic request from said first user and based on said information from said cookie wherein said application without a web agent front end does not have access to a key for decrypting said information from said cookie;

requesting unencrypted data from said information from said cookie, said request being made to said application program interface; and

receiving said unencrypted data from said application program interface.

25. A method according to claim 24, further comprising the steps of:

requesting data from said information from said cookie, said request being made to said application program interface;

receiving said data from said application program interface; and

using said data for an access system service.

26. A method according to claim 24, wherein:

said information from said cookie was originally provided by a first web agent.

27. A method according to claim 24, wherein:

said information from said cookie was originally provided by said application program interface.

28. A method according to claim 24, further comprising the steps of:

determining whether said first resource is protected;

determining an authentication scheme for said first resource;

determining whether said authentication scheme is satisfied based on said information from said cookie; and

determining whether said first user is authorized to access said first resource.

29. A method according to claim 28, further comprising the step of:

allowing said first user to access said first resource if said first user is authorized to access said first resource.

30. One or more processor readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors to perform a method comprising:

receiving user session state information for a first user at an application program interface for an access system, said user session state information is from an application without a web agent front end, said user session state information is from a cookie stored on a client for said first user, said user session state information is encrypted, and said step of receiving user session state information includes decrypting said user session state information;

receiving, at said application program interface, a request to authorize said first user to access a first resource, said request to authorize is from said application without a web agent front end;

providing authorization services of said access system to said application without a web agent front end using said application program interface in an attempt to authorize said first user to access said first resource without requiring said first user to re-submit authentication credentials;

receiving a request from said application without a web agent front end for unencrypted data from said user session state information; and

providing said unencrypted data from said user session state information to said application without a web agent front end, said application without a web agent front end does not have access to a key to decrypt said user session state information.

31. One or more processor readable storage devices according to claim 30, wherein:

said session state information was created by an access system; and

said access system attempts to authorize said first user.

32. One or more processor readable storage devices according to claim 30, wherein said method further comprises the steps of:

determining whether said first resource is protected;

determining an authentication scheme for said first resource;

determining whether said authentication scheme is satisfied based on said user session state information;

making available to said application without a web agent front end an indication of whether said first resource is protected; and

making available to said application without a web agent front end an indication of said authentication scheme.

33. One or more processor readable storage devices according to claim 30, wherein said method further comprises the steps of:

determining one or more authorization actions for said first resource; and

making available to said application without a web agent front end an indication of said one or more authorization actions for said first resource.

34. One or more processor readable storage devices according to claim 30, further comprising the step of:

allowing said first user to access said first resource if said first user is authorized to access said first resource.

35. An apparatus, comprising:

a communication interface;

one or more storage devices; and

one or more processors in communication with said one or more storage devices and said communication interface, said one or more processors programmed to perform a method comprising;

receiving user session state information for a first user at an application program interface for an access system, said user session state information is from an application without a web agent front end, said user session state information is from a cookie stored on a client for said first user, said user session state information is encrypted, and said step of receiving user session state information includes decrypting said user session state information,

receiving, at said application program interface, a request to authorize said first user to access a first resource, said request to authorize is from said application without a web agent front end,

providing authorization services of said access system to said application without a web agent front end using said application program interface in an attempt to authorize said first user to access said first resource without requiring said first user to re-submit authentication credentials,

receiving a request from said application without a web agent front end for unencrypted data from said user session state information, and

providing said unencrypted data from said user session state information to said application without a web agent front end, said application without a web agent front end does not have access to a key to decrypt said user session state information.

36. An apparatus according to claim 35, wherein:

said session state information was created by an access system; and

said access system attempts to authorize said first user.

37. An apparatus according to claim 35, wherein said method further comprises the steps of:

determining whether said first resource is protected;

determining an authentication scheme for said first resource;

determining whether said authentication scheme is satisfied based on said user session state information;

making available to said application without a web agent front end an indication of whether said first resource is protected; and

making available to said application without a web agent front end an indication of said authentication scheme.

38. An apparatus according to claim 35, wherein said method further comprises the steps of:

determining one or more authorization actions for said first resource; and

making available to said application without a web agent front end an indication of said one or more authorization actions for said first resource.

39. An apparatus according to claim 35, further comprising the step of:

allowing said first user to access said first resource if said first user is authorized to access said first resource.

40. One or more processor readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors to perform a method for providing access services by an application without a web agent front end, the method comprising:

receiving, at the application without a web agent front end, an electronic request from a first user to access a first resource, said step of receiving includes receiving information from a cookie wherein said information from said cookie is encrypted;

providing said information from said cookie to an application program interface for an access system wherein said application without a web agent front end does not have access to a key for decrypting said information from said cookie;

with said application without a web agent front end, accessing authorization services of said access system using said application program interface, said accessing includes requesting said access system to authorize said first user to access said first resource based on information from said request from said first user and based on said information from said cookie;

requesting unencrypted data from said information from said cookie, said request being made to said application program interface;

receiving said unencrypted data from said application program interface; and

using said unencrypted data for an access system service.

41. A method for providing access services, comprising:

authenticating a first user;

causing user session state information to be stored at a client for said first user wherein said user session state information is from a cookie stored on a client for said first user and said user session state information is encrypted;

authorizing said first user to access a first protected resource;

receiving a request from an application without a web agent front end to allow said first user to access a second protected resource, said step of receiving a request includes receiving said user session state information from said application without a web agent front end and includes decrypting said user session state information;

authorizing said first user to access said second protected resource without requiring said first user to re-submit authentication credentials, if said first user is authorized to access said second protected resource;

receiving a request from said application without a web agent front end for unencrypted data from said user session state information; and

providing said unencrypted data from said user session state information to said application without a web agent front end, said application without a web agent front end does not have access to a key to decrypt said unencrypted data from said user session state information.

42. A method according to claim 41, wherein:

said session state information was created by an access system; and

said access system performs said step of allowing.

43. A method according to claim 41, further comprising the steps of:

determining whether said second resource is protected;

determining an authentication scheme for said second resource;

determining whether said authentication scheme is satisfied based on said user session state information;

making available to said application without a web agent front end an indication of whether said first resource is protected; and

making available to said application without a web agent front end an indication of said authentication scheme.

44. A system comprising:

a client;

at least one application without a web agent front end adapted to receive a request from said client for a first user to access a first resource, said request includes information from a cookie wherein said information from said cookie is encrypted and said application without a web agent front end does not have access to a key for decrypting said information from said cookie;

an access server adapted to provide authorization services for requests to access said first resource;

an application program interface for said access server, said application program interface receives said information from said cookie and a request from said at least one application without a web agent front end to authorize said first user to access said first resource, said application program interface provides said authorization services to said at least one application without a web agent front end by attempting to authorize said first user to access said first resource based on information from said request from said first user and based on said information from said cookie;

wherein said application without a web agent front end requests unencrypted data from said information from said cookie, said request being made to said application program interface; and

said application without a web agent front end receives said unencrypted data from said application program interface and uses said unencrypted data for an access system service.

45. The system of claim 44, wherein:

said access system includes an access server; and

said application program interface for said access system is not located at said access server.