Authentication to a second application using credentials authenticated to a first application

• US 7,647,628 B2
• Filed: 03/09/2004
• Issued: 01/12/2010
• Est. Priority Date: 03/09/2004
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Goodman, Brian D., Lagarde, Konrad C., Kebinger, James K.
• Primary Examiner(s): Pich; Ponnoreay
• Application Number:
  US10/796,372
• Publication Number:
  US 20050204146A1
• Time in Patent Office: 2,135 Days
• Field of Search: 726 2- 6, 726 16- 19, 726/21, 713182-183, 715/742
• US Class Current: 726/17
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

Systems, methods, and program products are provided for switching identity of a user that has a first username associated with a first class of users. According to the method, login information is received from the user, with the login information including the first username, an alternate class, and a password. The user is authenticated based on the first username and the password, and access to the computer system is provided as the alternate class, with the alternate class being different than the first class. In one preferred embodiment, the login information further includes a second username, and access to the computer system is provided with the rights and privileges of the second username.

Claims

1. A method for switching identify of a user that has a first username associated with a first class of users, the method comprising the steps of:

receiving, by a computer system, login information from the user, the login information including the first username, an alternate class, and a password associated with the first username, the first username and the alternate class being received as part of a user identification input of the login information entered by the user, the first username and alternate class being entered by the user as a single data field entry, the first username being associated with a class of users granted a first set of rights and privileges associated with the computer system, and the alternate class being granted a second set of rights and privileges associated with the computer system;

authenticating, by the computer system, the user based on the first username and the password; and

providing, by the computer system, access to the computer system as the alternate class,

wherein the alternate class is different than the first class.

2. The method of claim 1,

wherein the login information further includes a second username entered by the user as part of the user identification input in addition to the first username and the alternate class, and

in the providing step, access to the computer system is provided with the rights and privileges of the second username.

3. The method of claim 1, further comprising the step of:

verifying that the user is authorized to be provided access to the computer system as the alternate class,

wherein the providing step is only performed if the user'"'"'s authorization is verified.

4. The method of claim 3, wherein the verifying step includes the sub-step of looking up the first username in an identity switching authorization table.

5. The method of claim 1, wherein the providing step includes the sub-step of presenting the user with a user interface of the alternate class after login.

6. The method of claim 1, wherein in the providing step, the user is provided with the experience of a user in the alternate class.

7. The method of claim 1, wherein in the receiving step, the first username and alternate class are entered in the single data field entry as a single character string so that identity switching that gives the user access to the computer system with the set of rights and privileges granted to the alternate class is accomplished in only one user step that comprises the user logging into the computer system using only the first username, the alternate class, and the password.

8. The method of claim 1, further comprising the step of recording an audit trail that includes at least some of the actions performed by the user, the audit trail including the first username.

9. A computer storage medium encoded with a computer program for switching identity of a user that has a first username associated with a first class of users, the computer program containing instructions for performing the steps of:

receiving, by a computer system, login information from the user, the login information including the first username, an alternate class, and a password associated with the first username, the first username and the alternate class being received as part of a user identification input of the login information entered by the user, the first username and alternate class being entered by the user as a single data field entry, the first username being associated with a class of users granted a first set of rights and privileges associated with the computer system, and the alternate class being granted a second set of rights and privileges associated with the computer system;

authenticating, by the computer system, the user based on the first username and the password; and

providing, by the computer system, access to the computer system as the alternate class,

wherein the alternate class is different than the first class.

10. The computer storage medium of claim 9,

wherein the login information further includes a second username entered by the user as part of the user identification input in addition to the first username and the alternate class, and

in the providing step, access to the computer system is provided with the rights and privileges of the second username.

11. The computer storage medium of claim 9, wherein the computer program further contains instructions for performing the step of:

verifying that the user is authorized to be provided access to the computer system as the alternate class,

wherein the providing step is only performed if the user'"'"'s authorization is verified.

12. The computer storage medium of claim 9, wherein the providing step includes the sub-step of presenting the user with a user interface of the alternate class after login.

13. The computer storage medium of claim 9, wherein in the providing step, the user is provided with the experience of a user in the alternate class.

14. The computer storage medium of claim 9, wherein in the receiving step, the first username and alternate class are entered in the single data field entry as a single character string so that identity switching that gives the user access to the computer system with the set of rights and privileges granted to the alternate class is accomplished in only one user step that comprises the user logging into the computer system using only the first username, the alternate class, and the password.

15. A system for switching identify of a user that has a first username associated with a first class of users, the system comprising:

an interface of a computer system receiving login information from the user, the login information including the first username, an alternate class, and a password associated with the first username, the first username and the alternate class being received as part of a user identification input of the login information entered by the user, the first username and alternate class being entered by the user as a single data field entry, the first username being associated with a class of users granted a first set of rights and privileges associated with the computer system, and the alternate class being granted a second set of rights and privileges associated with the computer system;

a processor authenticating the user based on the first username and the password, and providing access to the computer system as the alternate class,

wherein the alternate class is different than the first class.

16. The system of claim 15,

wherein the login information further includes a second username entered by the user as part of the user identification input in addition to the first username and the alternate class, and

the processor provides access to the computer system with the rights and privileges of the second username.

17. The system of claim 15, wherein the processor verifies that the user is authorized to be provided access to the computer system as the alternate class, and provides access to the computer system as the alternate class only if the user'"'"'s authorization is verified.

18. The system of claim 15, wherein the processor presents the user with a user interface of the alternate class after login.

19. The system of claim 15, wherein the processor provides the user with the experience of a user in the alternate class.

20. The system of claim 15, wherein the interface receives entry of the first username and alternate class in the single data field entry as a single character string so that identity switching that gives the user access to the computer system with the set of rights and privileges granted to the alternate class is accomplished in only one user step that comprises the user logging in to the computer system using only the first username, the alternate class, and the password.