Access control for federated identities

• US 7,444,519 B2
• Filed: 09/22/2004
• Issued: 10/28/2008
• Est. Priority Date: 09/23/2003
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Mishra, Prateek, Chang, Sharon, Gudipati, Ravi Kumar, Laferriere, Leo
• Primary Examiner(s): Smithers; Matthew B
• Assistant Examiner(s): Fields; Courtney D
• Application Number:
  US10/947,893
• Publication Number:
  US 20050188212A1
• Time in Patent Office: 1,497 Days
• Field of Search: 713/185, 713/168, 726/2, 726/27, 726/9, 726/20, 726/4
• US Class Current: 713/185
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

An authentication process in a network environment provides a remote user with secured access to an enterprise network based on recognition of a third-party security token. The method includes authenticating the user against a plurality of third-party security tokens, wherein the third-party security tokens originate from a range of different partner home sites. The remote user, prior to obtaining secured access to the enterprise network, is not known to the enterprise network, and does not need to be associated with any security tokens previously originating from the enterprise network. The enterprise network is provided with the ability to rely upon third-party security tokens to authenticate the remote user.

Claims

1. In a network environment, a method for providing secured access, comprising:

receiving a request from a user for secured access to an enterprise network;

in response to the request, interacting with the user to provide the user with an offering of a plurality of authentication methods;

forwarding the user to a home site associated with a third-party for the user to obtain a third-party security token;

authenticating the user according to a designated authentication method selected by the user from the plurality of authentication methods, the authentication method performed using the third-party security token issued by a third-party that is administered separately from the enterprise network and presented to the enterprise network by the user; and

providing secured access to the user upon confirmation of authentication.

2. The method of claim 1, wherein receiving a request comprises the user requesting access to a content site within the enterprise network.

3. The method of claim 1, further comprising fulfilling the request including obtaining and using the third-party security token.

4. The method of claim 1, further comprising fulfilling the request without obtaining and using the third-party security token.

5. The method of claim 1, further comprising querying the user as to which of a plurality of authentication methods is to be used for authentication of the user.

6. The method of claim 4, further comprising one of the user and a home site designating a third-party security token authentication method for use in authentication of the user.

7. The method of claim 4, further comprising forwarding the user to a home site to obtain the third-party security token for authentication.

8. The method of claim 1, wherein providing secured access comprises linking the user to the content site upon confirmation of authentication based on a direct mapping method.

9. The method of claim 8, wherein the direct mapping method comprises:

identifying the user by searching and obtaining a key known at a home site and the content site; and

upon verification of the authentication, linking the remote user to a secondary profile hosted at the content site.

10. The method of claim 1, wherein providing secured access comprises linking the user to the content site upon confirmation of authentication based on an indirect mapping method.

11. The method of claim 10, wherein the indirect mapping method comprises:

identifying the user by searching and obtaining a key known at the content site;

receiving at least one user entry corresponding to identification of the user; and

upon verification of the authentication, linking the remote user to a secondary profile hosted at the content site.

12. The method of claim 1, wherein providing secured access comprises linking the user to the content site upon confirmation of authentication based on a user registration method.

14. The method of claim 1, wherein the third-party security token comprises at least one of a SAML assertion, a Passport token, and an alternate third-party security token.

15. The method of claim 1, wherein providing secured access comprises:

mapping the third-party security token presented by the user into a directory entry local to the enterprise network; and

implementing rules-based access control at the enterprise network based upon the content of the third-party security token;

wherein mappings are created based on at least one of a user DN present in the third-party security token and attribute values carried in the third-party security token.

41. The method of claim 1, wherein the user-designated authentication method comprises a user selection of an authentication site.

44. The method of claim 12, wherein the user registration method comprises:

the user presenting the third-party security token to the content site;

processing the third-party security token to verify its source;

mapping the user to a default directory entry;

presenting a form to the user prompting collection of information about the user; and

upon verification of the authentication, linking the remote user to a secondary profile hosted at the content site.

13. In a network environment, a method for providing secured access, comprising:

receiving a request from a user for secured access to an enterprise network;

in response to the request, interacting with the user to provide the user with an offering of a plurality of authentication methods;

authenticating the user according to a designated authentication method selected by the user from the plurality of authentication methods, the authentication method performed using a security token issued by a third-party that is administered separately from the enterprise network; and

providing secured access to the user upon confirmation of authentication;

wherein providing secured access comprises linking the user to the content site upon confirmation of authentication based on a user registration method; and

wherein the user registration method comprises;

the user presenting the third-party security token to the content site;

processing the third-party security token to verify its source;

mapping the user to a default directory entry;

presenting a form to the user prompting collection of information about the user; and

upon verification of the authentication, linking the remote user to a secondary profile hosted at the content site.

16. In a network environment, a system for providing secured access, comprising:

an enterprise network receiver for receiving a request for secured access from a user;

an authenticator operable to;

interact with the user, in response to the receiving the request, to provide the user with an offering of a plurality of authentication methods; and

forward the user to a home site associated with a third-party for the user to obtain a third-party security token;

authenticate the user according to a designated authentication method selected by the user from the plurality of authentication methods, the designated authentication method performed using the third-party security token issued by a third-party that is not the enterprise network and presented to the enterprise network by the user; and

an access provider for providing secured access to the user upon confirmation of authentication.

17. The system of claim 16, wherein the request is directed to access a content site within the enterprise network.

18. The system of claim 16, wherein the system is configured to fulfill the request by including obtaining and using the third-party security token.

19. The system of claim 16, wherein the system is configured to fulfill the request without obtaining and using the third-party security token.

20. The system of claim 16, wherein secured access comprises a link of the user to the content site upon confirmation of authentication based on a direct mapping method.

21. The system of claim 16, wherein secured access comprises a link of the user to the content site upon confirmation of authentication based on an indirect mapping method.

22. The system of claim 16, wherein secured access comprises a link of the user to the content site upon confirmation of authentication based on a user registration method.

23. The system of claim 16, wherein the third-party security token comprises at least one of a SAML assertion, a Passport token, and an alternate third-party security token.

24. The system of claim 16, wherein secured access comprises rules-based access control at the enterprise network based upon the content of the third-party security token.

25. The system of claim 16, wherein mappings are created based on at least one of a user DN present in the third-party security token and attribute values carried in the third-party security token.

42. The system of claim 16, wherein the user-designated authentication method comprises a user selection of an authentication site.

26. A medium for use in a network environment on an electronic device, the medium holding instructions executable using the electronic device for performing a method of providing secured access, the method comprising:

receiving a request from a user for secured access to an enterprise network;

in response to the request, interacting with the user to provide the user with an offering of a plurality of authentication methods;

forwarding the user to a home site associated with a third-party for the user to obtain a third-party security token;

authenticating the user according to a designated authentication method selected by the user from the plurality of authentication methods, the authentication method performed using the third-party security token issued by a third-party that is not the enterprise network and presented to the enterprise network by the user; and

providing secured access to the user upon confirmation of authentication.

27. The medium of claim 26, wherein receiving a request comprises the user requesting access to a content site within the enterprise network.

28. The medium of claim 26, further comprising fulfilling the request including obtaining and using the third-party security token.

29. The medium of claim 26, further comprising fulfilling the request without obtaining and using the third-party security token.

30. The medium of claim 26, further comprising querying the user as to which of a plurality of authentication methods is to be used for authentication of the user.

31. The medium of claim 29, further comprising one of the user and a home site designating a third-party security token authentication method for use in authentication of the user.

32. The medium of claim 29, further comprising forwarding the user to a partner site to obtain the third-party security token for authentication.

33. The medium of claim 26, wherein providing secured access comprises linking the user to the content site upon confirmation of authentication based on a direct mapping method.

34. The medium of claim 33, wherein the direct mapping method comprises:

identifying the user by searching and obtaining a key known at a home site and the content site; and

upon verification of the authentication, linking the remote user to a secondary profile hosted at the content site using the key.

35. The medium of claim 26, wherein providing secured access comprises linking the user to the content site upon confirmation of authentication based on an indirect mapping method.

36. The medium of claim 35, wherein the indirect mapping method comprises:

identifying the user by searching and obtaining a key known at the content site;

receiving at least one user entry corresponding to identification of the user; and

upon verification of the authentication, linking the remote user to a secondary profile hosted at the content site.

37. The medium of claim 26, wherein providing secured access comprises linking the user to the content site upon confirmation of authentication based on a user registration method.

38. The medium of claim 37, wherein the user registration method comprises:

the user presenting the third-party security token to the content site;

processing the third-party security token to verify its source;

mapping the user to a default directory entry;

presenting a form to the user prompting collection of information about the user; and

upon verification of the authentication, linking the remote user to a secondary profile hosted at the content site.

39. The medium of claim 26, wherein the third-party security token comprises at least one of a SAML assertion, a Passport token, and an alternate third-party security token.

40. The medium of claim 26, wherein providing secured access comprises:

mapping the third-party security token presented by the user into a directory entry local to the enterprise network; and

implementing rules-based access control at the enterprise network;

wherein mappings are created based on at least one of a user DN present in the third-party security token and attribute values carried in the third-party security token.

43. The medium of claim 26, wherein the user-designated authentication method comprises a user selection of an authentication site.