Method and system for providing an open and interoperable system

• US 7,237,256 B2
• Filed: 07/14/2003
• Issued: 06/26/2007
• Est. Priority Date: 07/14/2003
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Sun, Wei, Xu, Hong, Ranganathan, Aravindan, Luo, Ping, Bhat, Shivaram, Cheng, Qingwen, Bhatnagar, Bhavna
• Primary Examiner(s): Song; Hosuk
• Application Number:
  US10/619,657
• Publication Number:
  US 20050015593A1
• Time in Patent Office: 1,443 Days
• Field of Search: 726 1- 6, 726 27- 30, 726/8, 709/223, 709/225, 709/229
• US Class Current: 726/3
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

Embodiments of the present invention provide an open and interoperable single sign-on session in a heterogeneous communication network. The open and interoperable single sign-on system is configured by exchanging an entity identifier, an account mapping, an attribute mapping, a site attribute list, an action mapping and/or the like. The entity identifier, account mapping, attribute mapping, site attribute list, action mapping and the like for each partner entity is stored in a partner list accessable to the particular entity. Thereafter, the open and interoperable single sign-on session may be provided upon receipt of a SAML request or assertion containing an entity identifier. The entity identifier contained in the SAML request or assertion is looked-up in the partner list of the particular entity which received the SAML request or assertion. A record containing a matching entity identifier provides the applicable account mapping, attribute mapping, site attribute list, and/or action mapping. The one or more mappings are then utilized to process the SAML request or assertion.

Claims

1. A method of configuring an open interoperable security assertion markup language (SAML) session comprising:

receiving a first entity identifier of a first entity by a second entity;

receiving a first account mapping between said first entity and said second entity by said second entity;

storing said first entity identifier and said first account mapping as a first record in a first partner list accessible to said second entity;

receiving a second entity identifier of said second entity by said first entity;

receiving a second account mapping between said second entity and said first entity by said first entity;

storing said second entity identifier and said second account mapping as a second record in a second partner list accessible to said first entity;

receiving one or more mappings between said first entity and said second entity by said second entity, wherein the mappings are selected from the group consisting of an attribute mapping, a site attribute list, an account mapping, and an action mapping;

storing said one or more mappings between said first entity and said second entity as a part of said first record in said first partner list accessible to said second entity;

receiving one or more mappings between said second entity and said first entity by said first entity, wherein the mappings are selected from the group consisting of an attribute mapping, a site attribute list, an account mapping, and an action mapping; and

storing said one or more mappings between said second entity and said first entity as part of said second record in said second partner list accessible to said first entity.

2. The method according to claim 1, wherein said attribute mapping, said site attribute list, said account mapping, and said action mapping are implemented as a java class.

3. The method according to claim 1, wherein said attribute mapping defines a mapping of an attribute between said second entity and said first entity.

4. The method according to claim 1, wherein said site attribute list defines a list of one or more attributes to be exchanged between said second entity and said first entity.

5. The method according to claim 1, wherein said action mapping defines a mapping of an authorization of said second entity to an authorization of said first entity.

6. A method of configuring an open interoperable security assertion markup language (SAML) session comprising:

receiving a first entity identifier of a first entity by a second entity;

receiving a first account mapping between said first entity and said second entity by said second entity;

storing said first entity identifier and said first account mapping as a first record in a first partner list accessible to said second entity;

receiving a second entity identifier of said second entity by said first entity;

receiving a second account mapping between said second entity and said first entity by said first entity;

storing said second entity identifier and said second account mapping as a second record in a second partner list accessible to said first entity;

receiving a first client certificate of said first entity by said second entity;

receiving a first network address of said first entity by said second entity;

storing said first client certificate and said first network address as another part of said first record in said first partner list accessible to said second entity;

receiving a second client certificate of said second entity by said first entity;

receiving a second network address of said second entity by said first entity; and

storing said second client certificate and said second network address as another part of said second record in said second partner list accessible to said first entity.

7. A method of providing an open interoperable security assertion markup language (SAML) session comprising:

receiving, by a first entity, a SAML request from a second entity, comprising an entity identifier;

searching a partner list of said first entity for a record containing a matching entity identifier, wherein said record contains an account mapping and an attribute mapping, wherein said account mapping defines a mapping of an account of said second entity to an account of said first entity, and wherein said attribute mapping defines a mapping of an attribute of said second entity to an attribute of said first entity;

processing said SAML request in accordance with said account mapping and said attribute mapping; and

sending a SAML assertion in response to said SAML request.

8. The method according to claim 7, wherein said attribute mapping defines a mapping of an attribute namespace of said second entity to an attribute namespace of said first entity.

9. The method according to claim 7,

wherein said record further contains an action mapping, and wherein said SAML request is processed in accordance with said account mapping, said attribute mapping, and said action mapping.

10. The method according to claim 9, wherein said action mapping defines a mapping of an authorization decision of said second entity to an authorization decision of said first entity.

11. The method according to claim 7,

wherein said record further contains a site attribute list, and wherein said method further comprises:

generating said SAML assertion in accordance with said site attribute list.

12. The method according to claim 11, wherein said site attribute list defines an attribute that is to be returned by said first entity to said second entity.

13. A system for configuring an open and interoperable security assertion markup language (SAML) session comprising:

a first entity comprising;

a first administration module for receiving a first entity identifier of a second entity and a first account mapping between said second entity and said first entity; and

a first partner list, accessible by said first administration module, for storing said first entity identifier and said first account mapping; and

said second entity comprising;

a second administration module for receiving a second identifier of said first entity and a second account mapping between said first entity and said second entity; and

a second partner list, accessible by said second administration module, for storing said second entity identifier and said second account mapping;

wherein

said first administration module receives a first attribute mapping between said second entity and said first entity;

said first partner list stores said first attribute mapping;

said second administration module receives a second attribute mapping between said first entity and said second entity; and

said second partner list stores said second attribute mapping.

14. The system according to claim 13, wherein said attribute mapping defines a mapping of an attribute of said second entity to said first entity.

15. A system for configuring an open and interoperable security assertion markup language (SAML) session comprising:

a first entity comprising;

a first administration module for receiving a first entity identifier of a second entity and a first account mapping between said second entity and said first entity; and

a first partner list, accessible by said first administration module, for storing said first entity identifier and said first account mapping; and

said second entity comprising;

a second administration module for receiving a second identifier of said first entity and a second account mapping between said first entity and said second entity; and

a second partner list, accessible by said second administration module, for storing said second entity identifier and said second account mapping;

wherein

said first administration module receives a first site attribute list between said second entity and said first entity;

said first partner list stores said first site attribute list;

said second administration module receives a second site attribute list between said first entity and said second entity; and

said second partner list stores said second site attribute list.

16. The system according to claim 15, wherein said site attribute list defines an attribute that is to be returned by said second entity to said first entity.

17. A system for configuring an open and interoperable security assertion markup language (SAML) session comprising:

a first entity comprising;

a first administration module for receiving a first entity identifier of a second entity and a first account mapping between said second entity and said first entity; and

a first partner list, accessible by said first administration module, for storing said first entity identifier and said first account mapping; and

said second entity comprising;

a second administration module for receiving a second identifier of said first entity and a second account mapping between said first entity and said second entity; and

a second partner list, accessible by said second administration module, for storing said second entity identifier and said second account mapping;

wherein

said first administration module receives a first action mapping between said second entity and said first entity;

said first partner list stores said first action mapping;

said second administration module receives a second action mapping between said first entity and said second entity; and

said second partner list stores said second action mapping.

18. The system according to claim 17, wherein said action mapping defines a mapping of an authorization decision of said second entity to an authorization decision of said first entity.

19. A system for providing an open and interoperable security assertion markup language (SAML) session comprising:

a first entity comprising;

a first session module for generating and sending a SAML request, said SAML request comprising an entity identifier; and

a second entity, communicatively coupled to said first entity, comprising;

a second session module for receiving and processing said SAML request; and

a partner list, accessible by said second session module, comprising a record that contains a matching entity identifier, said record further containing an account mapping and an attribute mapping, wherein said account mapping defines a mapping of an account of said second entity to an account of said first entity, and wherein said attribute mapping defines a mapping of an attribute of said second entity to an attribute of said first entity;

wherein said second session module searches for said record, processes said SAML request in accordance with said account mapping and said attribute mapping, and sends a SAML assertion in response to said SAML request.

20. The system according to claim 19, wherein said record further contains an action mapping between said first entity and said second entity, and wherein said SAML request is further processed according to said action mapping.

21. The system according to claim 19, wherein said record further contains a site attribute list between said first entity and said second entity, and wherein said second session module generates said SAML assertion in accordance with said site attribute list.

22. A computer readable medium comprising one or more instructions which, when executed by one or more processors, cause the one or more processors to implement a method comprising:

receiving, by a first entity, a security assertion markup language (SAML) request from a second entity, wherein the SAML request comprises an entity identifier;

searching a partner list for a record containing a matching entity identifier, wherein said record contains an account mapping and an attribute mapping, wherein said account mapping defines a mapping of an account of said second entity to an account of said first entity, and wherein said attribute mapping defines a mapping of an attribute of said second entity to an attribute of said first entity;

processing said SAML request in accordance with said account mapping and said attribute mapping; and

sending a SAML assertion in response to said SAML request.

23. The computer readable medium of claim 22, wherein said record further contains an action mapping, and wherein said SAML request is processed in accordance with said account mapping, said attribute mapping, and said action mapping.

24. The computer readable medium according to claim 23, wherein said action mapping defines a mapping of an authorization decision of said second entity to an authorization decision of said first entity.

25. The computer readable medium according to claim 22, wherein said record further contains a site attribute list, and wherein said method implemented by said one or more processors further comprises:

generating said SAML assertion in accordance with said site attribute list.

26. The computer readable medium according to claim 25, wherein said site attribute list defines an attribute that is to be returned by said first entity to said second entity.