Delegated authentication using a generic application-layer network protocol

• US 7,412,720 B1
• Filed: 11/02/2001
• Issued: 08/12/2008
• Est. Priority Date: 11/02/2001
• Status: Expired due to Term

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: BEA Systems Incorporated (Oracle Corporation)
• Inventors: Young, Michael Wei-Chin, Frey, Bridget J.
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): Cervetti; David Garcia
• Application Number:
  US10/004,301
• Time in Patent Office: 2,475 Days
• Field of Search: 713/201, 709/225, 726/27, 726/28, 726/3, 726/4, 726/8
• US Class Current: 726/8
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A method, apparatus, and computer-readable media include receiving a signal representing a request from a remote user for a secure resource residing on a network employing a generic application-layer network protocol; determining, without the intervention of the user, the type of security credential required to access the secure resource; and sending a signal representing a second request to the secure resource, the second request including a security credential for the user of the type required to access the secure resource.

Claims

1. A computer-implemented method for use in a network environment including an enterprise server, comprising:

storing at the enterprise server multiple security credentials for a remote user to access respective secure resources residing on a network employing a generic application layer network protocol;

maintaining a map between a plurality of resource servers and a type of security credential required to access each resource server, including maintaining a true/false flag and storing a path/domain for each of the plurality of resource servers;

receiving at the enterprise server a signal representing a request from the remote user for a first of the secure resources, wherein the request includes a logon credential for the remote user;

determining, by referring to the map and without the intervention of the user, that the type of security credential for the remote user that is required to access the first secure resource comprises a first of the security credentials corresponding to a first path/domain for a first of the resource servers for which the map indicates a true flag, and wherein the determining includes matching the first path/domain with a stored path/domain corresponding to said first of the resource servers;

sending from the enterprise server a signal representing a second request to retrieve the first secure resource, the second request including a first of the security credentials for the user of the type required to access the first secure resource;

receiving at the enterprise server a signal representing a first single-sign-on (SSO) credential generated by a first SSO provider based on the logon credential;

sending from the enterprise server a signal representing the first SSO credential to retrieve the first secure resource when the type of credential required to access the first secure resource includes the first SSO credential; and

sending from the enterprise server a signal representing the first SSO credential to retrieve the first secure resource when the type of credential required to access the first secure resource includes a second SSO credential corresponding to a second SSO provider having a trust relationship with the first SSO provider.

2. The method of claim 1, further comprising:

authenticating the user before sending the signal representing the second request.

3. The method of claim 1, further comprising:

receiving at the enterprise server a signal representing a response to the second request; and

sending from the enterprise server a signal representing a result to the remote user, the result based on the response to the second request.

4. The method of claim 1, wherein the request includes a logon credential for the remote user, the method further comprising:

authenticating the remote user based on the logon credential before sending the second request.

5. The method of claim 1, wherein the request includes a logon credential for the remote user and the type of security credential required to access the first secure resource includes the logon credential, the method further comprising:

sending the signal representing the second request to retrieve the first secure resource, the second request including the logon credential.

6. The method of claim 1, wherein the generic application-layer network protocol is hypertext transfer protocol.

7. The method of claim 6, further comprising:

receiving at the enterprise server a signal representing data in response to the second request; and

sending from the enterprise server a signal representing at least a portion of the data to the remote user.

8. The method of claim 7, wherein the first secure resource includes a Web site, and the data is hypertext mark-up language.

9. A computer-implemented method for use in a network environment including an enterprise server, comprising:

storing at the enterprise server multiple security credentials for a remote user to access respective secure resources residing on a network employing a generic application layer network protocol;

maintaining a map between a plurality of resource servers and a type of security credential required to access each resource server, including maintaining a true/false flag and storing a path/domain for each of the plurality of resource servers;

receiving at the enterprise server a signal representing a request from the remote user for a first of the secure resources, wherein the request includes a logon credential for the remote user;

determining, by referring to the map and without the intervention of the user, that the type of security credential for the remote user that is required to access the first secure resource comprises a first of the security credentials corresponding to a first path/domain for a first of the resource servers for which the map indicates a true flag, and wherein the determining includes matching the first path/domain with a stored path/domain corresponding to said first of the resource servers;

sending from the enterprise server a signal representing a second request to retrieve the first secure resource, the second request including a first of the security credentials for the user of the type required to access the first secure resource;

receiving at the enterprise server a signal representing a first single-sign-on (SSO) credential generated by a first SSO provider based on the logon credential;

sending from the enterprise server a signal representing the first SSO credential to retrieve the first secure resource when the type of credential required to access the first secure resource includes the first SSO credential;

receiving at the enterprise server a signal representing a second SSO credential generated by a second SSO provider based on the first SSO credential; and

sending from the enterprise server a signal representing the second SSO credential to retrieve the first secure resource when the type of credential required to access the first secure resource includes the second SSO credential.

10. The method of claim 9, further comprising:

authenticating the user before sending the signal representing the second request.

11. The method of claim 9, further comprising:

receiving at the enterprise server a signal representing a response to the second request; and

sending from the enterprise server a signal representing a result to the remote user, the result based on the response to the second request.

12. The method of claim 9, wherein the request includes a logon credential for the remote user, the method further comprising:

authenticating the remote user based on the logon credential before sending the second request.

13. The method of claim 9, wherein the request includes a logon credential for the remote user and the type of security credential required to access the first secure resource includes the logon credential, the method further comprising:

sending the signal representing the second request to retrieve the first secure resource, the second request including the logon credential.

14. The method of claim 9, wherein the generic application-layer network protocol is hypertext transfer protocol.

15. The method of claim 14, further comprising:

receiving at the enterprise server a signal representing data in response to the second request; and

sending from the enterprise server a signal representing at least a portion of the data to the remote user.

16. The method of claim 15, wherein the first secure resource includes a Web site, and the data is hypertext mark-up language.

17. A computer-implemented method for use in a network environment including an enterprise server, comprising:

storing at the enterprise server multiple security credentials for a remote user to access respective secure resources residing on a network employing a generic application layer network protocol;

maintaining a map between a plurality of resource servers and a type of security credential required to access each resource server, including maintaining a true/false flag and storing a path/domain for each of the plurality of resource servers;

receiving at the enterprise server a signal representing a request from the remote user for a first of the secure resources, wherein the request includes a logon credential for the remote user;

determining, by referring to the map and without the intervention of the user, that the type of security credential for the remote user that is required to access the first secure resource comprises a first of the security credentials corresponding to a first path/domain for a first of the resource servers for which the map indicates a true flag, and wherein the determining includes matching the first path/domain with a stored path/domain corresponding to said first of the resource servers;

sending from the enterprise server a signal representing a second request to retrieve the first secure resource, the second request including a first of the security credentials for the user of the type required to access the first secure resource, wherein the receiving includes receiving at the enterprise server a signal representing a third request from the remote user for a second of the secure resources residing on the network,

determining, without the intervention of the user, the type of security credential for the remote user that is required to access the second secure resource; and

sending from the enterprise server a signal representing a fourth request for retrieving the second secure resource, the fourth request including a second of the security credentials for the user of the type required to access the second secure resource; and

wherein the signals representing the second and fourth requests are sent concurrently.

18. The method of claim 17, wherein the types of security credentials included in the second and fourth requests differ.

19. The method of claim 17, wherein the types of security credentials included in the second and fourth requests are the same.

20. The method of claim 17, wherein the generic application-layer network protocol is hypertext transfer protocol.

21. The method of claim 20, further comprising:

receiving at the enterprise server a signal representing data in response to the second request; and

sending from the enterprise server a signal representing at least a portion of the data to the remote user.

22. The method of claim 21, wherein the first secure resource includes a Web site, and the data is hypertext mark-up language.

23. An apparatus for use in a network environment including an enterprise server, comprising:

means for storing at the enterprise server multiple security credentials for a remote user to access respective secure resources residing on a network employing a generic application layer network protocol;

means for maintaining a map between a plurality of resource servers and a type of security credential required to access each resource server, including maintaining a true/false flag and storing a path/domain for each of the plurality of resource servers;

means for receiving at the enterprise server a signal representing a request from the remote user for a first of the secure resources;

means for determining, by referring to the map and without the intervention of the user, that the type of security credential for the remote user that is required to access the first secure resource comprises a first of the security credentials corresponding to a first path/domain for a first of the resource servers for which the map indicates a true flag, and wherein the determining includes matching the first path/domain with a stored path/domain corresponding to said first of the resource servers;

means for sending from the enterprise server a signal representing a second request to retrieve the first secure resource, the second request including a first of the security credentials for the user of the type required to access the first secure resource, wherein the request includes a logon credential for the remote user;

means for receiving at the enterprise server a signal representing a first single-sign-on (SSO) credential generated by a first SSO provider based on the logon credential;

means for sending from the enterprise server a signal representing the first SSO credential to retrieve the first secure resource when the type of credential required to access the first secure resource includes the first SSO credential; and

means for sending from the enterprise server a signal representing the first SSO credential to retrieve the first secure resource when the type of credential required to access the first secure resource includes a second SSO credential corresponding to a second SSO provider having a trust relationship with a first SSO provider.

24. The apparatus of claim 23, further comprising:

means for authenticating the user before sending the signal representing the second request.

25. The apparatus of claim 23, further comprising:

means for receiving at the enterprise server a signal representing a response to the second request; and

means for sending from the enterprise server a signal representing a result to the remote user, the result based on the response to the second request.

26. The apparatus of claim 23, wherein the request includes a logon credential for the remote user, the apparatus further comprising:

means for authenticating the remote user based on the logon credential before sending the second request.

27. The apparatus of claim 23, wherein the request includes a logon credential for the remote user and the type of security credential required to access the first secure resource includes the logon credential, the apparatus further comprising:

means for sending from the enterprise server the signal representing the second request to retrieve the first secure resource, the second request including the logon credential.

28. The apparatus of claim 23, wherein the generic application-layer network protocol is hypertext transfer protocol.

29. The apparatus of claim 28, further comprising:

means for receiving at the enterprise server a signal representing data in response to the second request; and

means for sending from the enterprise server a signal representing at least a portion of the data to the remote user.

30. The apparatus of claim 29, wherein the first secure resource includes a Web site, and the data is hypertext mark-up language.

31. The apparatus of claim 23, wherein the means for receiving includes means for receiving at the enterprise server a signal representing a third request from the remote user for a second secure resource residing on the network, the apparatus further comprising:

means for determining, without the intervention of the user, the type of security credential for the remote user that is required to access the second secure resource; and

means for sending from the enterprise server a signal representing a fourth request to retrieve the second secure resource, the fourth request including a second of the security credentials for the user of the type required to access the second secure resource; and

wherein the signals representing the second and fourth requests are sent concurrently.

32. The apparatus of claim 31, wherein the types of security credentials included in the second and fourth requests differ.

33. The apparatus of claim 31, wherein the types of security credentials included in the second and fourth requests are the same.

34. The apparatus of claim 23, further comprising:

means for receiving at the enterprise server a signal representing the first security credential from the user before receiving the signal representing the first request.

35. The method of claim 23, wherein the generic application-layer network protocol is hypertext transfer protocol.

36. The method of claim 35, further comprising:

receiving at the enterprise server a signal representing data in response to the second request; and

sending from the enterprise server a signal representing at least a portion of the data to the remote user.

37. The method of claim 36, wherein the first secure resource includes a Web site, and the data is hypertext mark-up language.

47. The media of claim 33, wherein the method further comprises:

authenticating the user before sending the signal representing the second request.

38. An apparatus for use in a network environment including an enterprise server, comprising:

means for storing at the enterprise server multiple security credentials for a remote user to access respective secure resources residing on a network employing a generic application layer network protocol;

means for maintaining a map between a plurality of resource servers and a type of security credential required to access each resource server, including maintaining a true/false flag and storing a path/domain for each of the plurality of resource servers;

means for receiving at the enterprise server a signal representing a request from the remote user for a first of the secure resources;

means for determining, by referring to the map and without the intervention of the user, that the type of security credential for the remote user that is required to access the first secure resource comprises a first of the security credentials corresponding to a first path/domain for a first of the resource servers for which the map indicates a true flag, and wherein the determining includes matching the first path/domain with a stored path/domain corresponding to said first of the resource servers;

means for receiving at the enterprise server a signal representing a first single-sign-on (SSO) credential generated by a first SSO provider based on the logon credential;

means for sending from the enterprise server a signal representing the first SSO credential to retrieve the first secure resource when the type of credential required to access the first secure resource includes the first SSO credential;

means for sending from the enterprise server a signal representing a second request to retrieve the first secure resource, the second request including a first of the security credentials for the user of the type required to access the first secure resource, wherein the request includes a logon credential for the remote user;

means for receiving at the enterprise server a signal representing a second SSO credential generated by a second SSO provider based on a the first SSO credential; and

means for sending from the enterprise server a signal representing the second SSO credential to the secure resource when the type of credential required to access the secure resource includes the second SSO credential.

39. The apparatus of claim 38, wherein the generic application-layer network protocol is hypertext transfer protocol.

40. The apparatus of claim 39, further comprising:

means for receiving at the enterprise server a signal representing data in response to the second request; and

means for sending from the enterprise server a signal representing at least a portion of the data to the remote user.

41. The apparatus of claim 40, wherein the first secure resource includes a Web site, and the data is hypertext mark-up language.

42. The apparatus of claim 38, wherein the means for receiving includes means for receiving at the enterprise server a signal representing a third request from the remote user for a second secure resource residing on the network, the apparatus further comprising:

means for determining, without the intervention of the user, the type of security credential for the remote user that is required to access the second secure resource; and

means for sending from the enterprise server a signal representing a fourth request to retrieve the second secure resource, the fourth request including a second of the security credentials for the user of the type required to access the second secure resource; and

wherein the signals representing the second and fourth requests are sent concurrently.

43. The apparatus of claim 42, wherein the types of security credentials included in the second and fourth requests differ.

44. The apparatus of claim 42, wherein the types of security credentials included in the second and fourth requests are the same.

45. The apparatus of claim 38, further comprising:

means for receiving at the enterprise server a signal representing the first security credential from the user before receiving the signal representing the first request.

46. One or more computer-readable media tangibly embodying a program of instructions executable by a computer to perform a method for use in a network environment including an enterprise server, the method comprising:

storing at the enterprise server multiple security credentials for a remote user to access respective secure resources residing on a network employing a generic application layer network protocol;

maintaining a map between a plurality of resource servers and a type of security credential required to access each resource server, including maintaining a true/false flag and storing a path/domain for each of the plurality of resource servers;

receiving at the enterprise server a signal representing a request from the remote user for a first of the secure resources, wherein the request includes a logon credential for the remote user;

determining, by referring to the map and without the intervention of the user, that the type of security credential for the remote user that is required to access the first secure resource comprises a first of the security credentials corresponding to a first path/domain for a first of the resource servers for which the map indicates a true flag, and wherein the determining includes matching the first path/domain with a stored path/domain corresponding to said first of the resource servers;

sending from the enterprise server a signal representing a second request to retrieve the first secure resource, the second request including a first of the security credentials for the user of the type required to access the first secure resource;

receiving at the enterprise server a signal representing a first single-sign-on (SSO) credential generated by a first SSO provider based on the logon credential;

sending from the enterprise server a signal representing the first SSO credential to retrieve the first secure resource when the type of credential required to access the first secure resource includes the first SSO credential; and

sending from the enterprise server a signal representing the first SSO credential to retrieve the first secure resource when the type of credential required to access the first secure resource includes a second SSO credential corresponding to a second SSO provider having a trust relationship with a first SSO provider.

48. The media of claim 46, wherein the method further comprises:

receiving at the enterprise server a signal representing a response to the second request; and

sending from the enterprise server a signal representing a result to the remote user, the result based on the response to the second request.

49. The media of claim 46, wherein the request includes a logon credential for the remote user, wherein the method further comprises:

authenticating the remote user based on the logon credential before sending the second request.

50. The media of claim 46, wherein the request includes a logon credential for the remote user and the type of security credential required to access the first secure resource includes the logon credential, wherein the method further comprises:

sending from the enterprise server the signal representing the second request to retrieve the first secure resource, the second request including the logon credential.

51. The media of claim 46, wherein the generic application-layer network protocol is hypertext transfer protocol.

52. The media of claim 51, wherein the method further comprises:

receiving at the enterprise server a signal representing data in response to the second request; and

sending from the enterprise server a signal representing at least a portion of the data to the remote user.

53. The media of claim 52, wherein the first secure resource includes a Web site, and the data is hypertext mark-up language.

54. One or more computer-readable media tangibly embodying a program of instructions executable by a computer to perform a method for use in a network environment including an enterprise server, the method comprising:

storing at the enterprise server multiple security credentials for a remote user to access respective secure resources residing on a network employing a generic application layer network protocol;

maintaining a map between a plurality of resource servers and a type of security credential required to access each resource server, including maintaining a true/false flag and storing a path/domain for each of the plurality of resource servers;

receiving at the enterprise server a signal representing a request from the remote user for a first of the secure resources, wherein the request includes a logon credential for the remote user;

determining, by referring to the map and without the intervention of the user, that the type of security credential for the remote user that is required to access the first secure resource comprises a first of the security credentials corresponding to a first path/domain for a first of the resource servers for which the map indicates a true flag, and wherein the determining includes matching the first path/domain with a stored path/domain corresponding to said first of the resource servers;

sending from the enterprise server a signal representing a second request to retrieve the first secure resource, the second request including a first of the security credentials for the user of the type required to access the first secure resource;

receiving at the enterprise server a signal representing a first single-sign- on (SSO) credential generated by a SSO provider based on the logon credential;

sending from the enterprise server a signal representing the first SSO credential to retrieve the first secure resource when the type of credential required to access the first secure resource includes the first SSO credential;

receiving at the enterprise server a signal representing a second SSO credential generated by a second SSO provider based on the first SSO credential; and

sending from the enterprise server a signal representing the second SSO credential to retrieve the first secure resource when the type of credential required to access the first secure resource includes the second SSO credential.

55. The media of claim 54, wherein the method further comprises:

authenticating the user before sending the signal representing the second request.

56. The media of claim 54, wherein the method further comprises:

receiving at the enterprise server a signal representing a response to the second request; and

sending from the enterprise server a signal representing a result to the remote user, the result based on the response to the second request.

57. The media of claim 54, wherein the request includes a logon credential for the remote user, wherein the method further comprises:

authenticating the remote user based on the logon credential before sending the second request.

58. The media of claim 54, wherein the request includes a logon credential for the remote user and the type of security credential required to access the first secure resource includes the logon credential, wherein the method further comprises:

sending from the enterprise server the signal representing the second request to retrieve the first secure resource, the second request including the logon credential.

59. The media of claim 54, wherein the generic application-layer network protocol is hypertext transfer protocol.

60. The media of claim 59, wherein the method further comprises:

receiving at the enterprise server a signal representing data in response to the second request; and

sending from the enterprise server a signal representing at least a portion of the data to the remote user.

61. The media of claim 60, wherein the first secure resource includes a Web site, and the data is hypertext mark-up language.

62. One or more computer-readable media tangibly embodying a program of instructions executable by a computer to perform a method for use in a network environment including an enterprise server, the method comprising:

storing at the enterprise server multiple security credentials for a remote user to access respective secure resources residing on a network employing a generic application layer network protocol;

maintaining a map between a plurality of resource servers and a type of security credential required to access each resource server, including maintaining a true/false flag and storing a path/domain for each of the plurality of resource servers;

receiving at the enterprise server a signal representing a request from the remote user for a first of the secure resources, wherein the request includes a logon credential for the remote user;

determining, by referring to the map and without the intervention of the user, that the type of security credential for the remote user that is required to access the first secure resource comprises a first of the security credentials corresponding to a first path/domain for a first of the resource servers for which the map indicates a true flag, and wherein the determining includes matching the first path/domain with a stored path/domain corresponding to said first of the resource servers;

sending from the enterprise server a signal representing a second request to retrieve the first secure resource, the second request including a first of the security credentials for the user of the type required to access the first secure resource, wherein the receiving includes receiving at the enterprise server a signal representing a third request from the remote user for a second secure resource residing on the network,

determining, without the intervention of the user, the type of security credential for the remote user that is required to access the second secure resource; and

sending from the enterprise server a signal representing a fourth request for retrieving the second secure resource, the fourth request including a second security credential for the user of the type required to access the second secure resource; and

wherein the signals representing the second and fourth requests are sent concurrently.

63. The media of claim 62, wherein the types of security credentials included in the second and fourth requests differ.

64. The media of claim 62, wherein the types of security credentials included in the second and fourth requests are the same.

65. The media of claim 62, wherein the generic application-layer network protocol is hypertext transfer protocol.

66. The media of claim 65, wherein the method further comprises:

receiving at the enterprise server a signal representing data in response to the second request; and

sending from the enterprise server a signal representing at least a portion of the data to the remote user.

67. The media of claim 66, wherein the first secure resource includes a Web site, and the data is hypertext mark-up language.