System and method for unified sign-on

• US 7,392,536 B2
• Filed: 06/18/2003
• Issued: 06/24/2008
• Est. Priority Date: 06/18/2003
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Torres, Rex George, Sharp, Joseph W., Balakrishnan, Anil, Houser, Christopher Robert, Elien, Jean-Emile, Al-Hilali, Hilal, Jamieson, Steve
• Primary Examiner(s): Barron, Jr.; Gilberto
• Assistant Examiner(s): LEMMA, SAMSON B
• Application Number:
  US10/464,648
• Publication Number:
  US 20050005094A1
• Time in Patent Office: 1,833 Days
• Field of Search: 713/155, 713/156, 726/8, 726/5, 726/10
• US Class Current: 726/8
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213

Abstract

A mechanism is provided for signing on a user of a first domain into an affiliate application in a second domain. When the user needs access to the affiliate application, the request for access causes a ticket to be generated. The ticket identifies the user and is passed to an adapter. The adapter, which ultimately will perform the sign on in the affiliate application, redeems the ticket for the user'"'"'s credentials (e.g., a valid userID/password combination for the affiliate application), and then presents the credentials to the affiliate application. A service is provided that issues tickets, redeems tickets, manages the registration and de-registration of affiliate applications, manages the correlation between a user and the user'"'"'s credentials with an affiliate application, and manages encryption of stored records.

Claims

1. A method for signing a first user of a first domain onto an affiliate application comprising:

receiving a request to sign the first user onto the affiliate application ,wherein;

the affiliate application is one of a plurality of affiliate applications; and

the affiliate application and the first domain are in environments having different operating systems;

receiving a ticket indicative of the first user;

providing the ticket to an adapter respectively associated with the affiliate application;

redeeming the ticket to obtain a set of credentials associated with the first user;

using the credentials to sign the first user onto the affiliate application; and

running the adapter as a second user different from the first user, said second user having privileges to redeem tickets but not having privileges to add affiliate applications to, or delete affiliate applications from, said plurality of affiliate applications.

2. The method of claim 1, wherein the ticket comprises a user-identifier associated with the first user in the first domain.

3. The method of claim 1, wherein the ticket comprises an identifier of the first domain.

4. The method of claim 1, wherein the ticket comprises an expiration time.

5. The method of claim 1, wherein the ticket is encrypted.

6. The method of claim 1, wherein the affiliate application comprises a second domain different from the first domain.

7. The method of claim 1, wherein the affiliate application comprises software to which access is limited to users who possess valid credentials.

8. The method of claim 1, further comprising:

using a process to request the ticket, the process running as a second user different from the first user, the process impersonating the first user when requesting the ticket.

9. The method of claim 1, wherein the set of credentials comprises a first user-identifier and a first password.

10. The method of claim 9, wherein the set of credentials further comprises a second user-identifier and a second password.

11. The method of claim 1, wherein the set of credentials is further associated with the affiliate application.

12. A system comprising:

a component that receives a request from a user in a domain to sign onto a first affiliate application, and that requests a ticket for the user in response to receiving the request;

a service that receives a request for the ticket and that issues the ticket in response to the request, the tickets identifying the user; and

a plurality of adapters, each of the adapters being respectively associated with one of a plurality of affiliate applications, a first of the adapters being associated with said first affiliate application, the first adapter receiving the ticket from the component, communicating with the service to redeem the ticket for a set of credentials associated with the user, and using the credentials to sign the user onto the first affiliate application; and

a database server that stores the identity of one or more users who are permitted to add or delete affiliate applications from the plurality of affiliate applications; and

for each of the plurality affiliate applications, the identity of one or more users who are permitted to add, delete, or modify credentials associated with the affiliate application, there being at least one user who is permitted to add, delete, or modify credentials associated with at least one of the plurality of affiliate applications but whom is not permitted to add or delete affiliate applications from the plurality of affiliate applications.

13. The system of claim 12, wherein the service comprises or communicates with a database that stores the credentials.

14. The system of claim 13, wherein credentials stored in the database are indexed based the particular user and the particular affiliate application with which the credentials are associated.

15. The system of claim 12, wherein the credentials are encrypted, and wherein the service manages the decryption of credentials when redeeming tickets.

16. The system of claim 12, wherein the service manages encryption and decryption using a key and does not have persistent storage of the key, the key being persistently stored in a server with which the service communicates.

17. The system of claim 12, wherein the service causes the ticket to be encrypted when the ticket is issued, and wherein the service further causes the ticket to be decrypted when the ticket is redeemed.

18. The system of claim 12, wherein the service comprises:

a cache, which stores credentials that have been redeemed, the service recurrently consulting a database in which the credentials are stored to determine whether the credentials stored in the cache are valid.

19. A computer-readable storage medium having computer-executable instructions to perform acts comprising:

receiving a first request to issue a ticket;

issuing the ticket in response to the first request, the first request identifying a first user in whose name the first request was made;

receiving a second request to redeem a ticket;

determining that a respective issuer of the second request is authorized to redeem tickets;

locating a set of credentials associated with the first user and further associated with the issuer of the second request;

providing the set of credentials to the issuer of the second request; and

encrypting a plurality of sets of credentials using a first key, the first key having a first identifier associated therewith;

decrypting plurality of sets of credentials using the first key, and re-encrypting the plurality of sets of credentials with a second key having a second identifier associated therewith, the second key being different from the first key, and the second identifier being different from the first identifier, whereby at some point in time some of the plurality of sets of credentials are encrypted with the first key and some of the plurality of sets of credentials are encrypted with the second key;

when decrypting data, checking which of the first and second identifiers is associated with the data and using either the first or second key to decrypt the data according to which identifier is associated with the data.

20. The computer-readable medium of claim 19, wherein a process that makes the first request is running under as a second user different from the first user, and wherein the process impersonates the first user when making the first request.

21. The computer-readable medium of claim 19, wherein the acts performable by the computer-executable further comprise:

causing the ticket to be encrypted prior to issuing the ticket; and

causing the ticket to be decrypted in response to receiving the second request to redeem the ticket.

22. The computer-readable medium of claim 21, wherein the acts performable by the computer-executable further comprise:

contacting a server to obtain a key needed to decrypt the ticket.

23. The computer-readable medium of claim 19, wherein the acts performable by the computer-executable further comprise:

checking the identity of the issuer of the second request against a list of users who are authorized to redeem tickets.

24. The computer-readable medium of claim 19, wherein the acts performable by the computer-executable farther comprise:

persistently storing the first key;

performing encryption and decryption of data using said first key;

wherein the instructions to persistently store the first key can be either activated or not activated depending upon whether an instance of the computer-executable instructions is initiated as a master secret server.