User authentication

• US 7,814,536 B2
• Filed: 10/04/2006
• Issued: 10/12/2010
• Est. Priority Date: 07/10/2000
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Martherus, Robin E., Ramamurthy, Srinivasagopalan
• Primary Examiner(s): JUNG, DAVID YIUK
• Application Number:
  US11/538,705
• Publication Number:
  US 20070174905A1
• Time in Patent Office: 1,469 Days
• Field of Search: 726/28, 726/8, 726/3
• US Class Current: 726/8
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

The present invention authenticates a user for multiple resources distributed across multiple domains through the performance of a single authentication. User access requests for a protected resource in a first domain are received and redirected to a second domain. User authentication is performed at the second domain. In one embodiment, the system transmits an authentication cookie for the second domain to the user after authentication at the second domain. In another embodiment, the system further redirects subsequent resource requests for resources in the first domain or a third domain to the second domain. The second domain confirms the user'"'"'s authentication for applicable portions of the first, second, and third domains using the cookie.

Claims

1. An apparatus for authenticating a user for a plurality of domains in a network-based system, comprising:

a communication interface;

one or more storage devices; and

one or more processors in communication with said one or more storage devices and said communication interface, said one or more processors programmed to perform a method comprising the steps of;

receiving a request for a protected resource, said resource is in a first domain,

determining whether said network-based system protects only said first domain or whether it protects multiple domains;

if said network-based system only protects said first domain, authenticating said user for said first domain at said first domain;

if said network-based system protects multiple domains, determining whether each of said multiple domains are on a single server;

if said multiple domains are on said single server;

determining whether said first domain is a preferred domain of said multiple domains,

authenticating said user for said first domain at said first domain if said first domain is said preferred domain, and

redirecting said request to said preferred domain and authenticating said user for said first domain at said preferred domain if said first domain is not said preferred domain; and

if said multiple domains are not on said single server;

determining whether said first domain is a master domain,

authenticating said first user for said first domain at said first domain if said first domain is said master domain, and

redirecting said request to said master domain and authenticating said user for said first domain at said master domain if said first domain is not said master domain.

2. An apparatus according to claim 1, wherein said method further includes the step of:

determining whether said first and preferred domains reside on a single Web Server.

3. An apparatus according to claim 1, wherein:

said network-based system comprises an Access Management System.

4. An apparatus according to claim 1, wherein:

said network-based system comprises an Access System.

5. An apparatus according to claim 4, wherein:

said Access System includes an access management system and an identity management system.

6. An apparatus according to claim 1, wherein:

said steps of authenticating said user for said first domain at said first domain if said first domain is said preferred domain, and authenticating said first user for said first domain at said first domain if said first domain is said master domain comprises the steps of;

receiving entered user data;

accessing user identity profile information from a Directory Server; and

comparing said entered user data with said user identity profile information.

7. A method for authenticating a user for a plurality of domains in a network-based system, comprising the steps of:

receiving a request for a protected resource, said resource is in a first domain;

determining whether said network-based system protects only said first domain or whether it protects multiple domains;

if said network-based system only protects said first domain, authenticating said user for said first domain at said first domain;

if said network-based system protects multiple domains, determining whether each of said multiple domains are on a single server;

if said multiple domains are on said single server;

determining whether said first domain is a preferred domain of said multiple domains,

authenticating said user for said first domain at said first domain if said first domain is said preferred domain, and

redirecting said request to said preferred domain and authenticating said user for said first domain at said preferred domain if said first domain is not said preferred domain; and

if said multiple domains are not on said single server;

determining whether said first domain is a master domain,

authenticating said first user for said first domain at said first domain if said first domain is said master domain, and

redirecting said request to said master domain and authenticating said user for said first domain at said master domain if said first domain is not said master domain.

8. The method of claim 7, wherein authenticating said user for said first domain at said master domain comprises:

receiving user data at said master domain, said user data is received at said master domain from said user,

accessing user identify profile information for said user from a Directory Server, said user identity profile information including a plurality of attributes having attribute values, wherein at least one of said attribute values includes information other than an authentication certificate, and

comparing said received user data with said user identity profile information, said comparing includes comparing said received user data with said information other than an authentication certificate.

9. The method of claim 7, wherein said redirecting said request to said master domain comprises:

redirecting said user to said master domain.

10. The method of claim 7, wherein:

said network-based system is an Access System including an access management system and an identity management system.