Single sign on with proxy services

• US 8,327,426 B2
• Filed: 06/01/2006
• Issued: 12/04/2012
• Est. Priority Date: 06/01/2006
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: Novell Intellectual Property Holdings, Inc.
• Inventors: Morris, Cameron Craig, Burch, Lloyd Leon, Kinser, Stephen Hugh
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Durham, Imhotep
• Application Number:
  US11/444,944
• Publication Number:
  US 20070294752A1
• Time in Patent Office: 2,378 Days
• Field of Search: 726/8, 726/12
• US Class Current: 726/8
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

Techniques for proxing services with a single sign on are provided. A principal authenticates to a first identity service. The first identity service is in a trusted relationship with a second identity service. An authentication request is sent to the second identity service and the request includes an authentication response supplied by the first identity service in response to successful authentication of the principal to the first identity service. In response to the authentication request and the accompanying response, the principal is authenticated for access to the second identity service. Furthermore, targeted services accessible to the second identity service are proxied from and to the principal during interactions between the principal and an external service of that principal.

Claims

1. A machine-implemented method to execute on a machine, comprising:

receiving, by the machine, an authentication request from a principal, the request directed by the principal to an external service and intercepted by the method for receipt;

authenticating, by the machine, the principal; and

supplying, by the machine, an authentication message for use by an identity service on behalf of the principal, the authentication message serves as a new authentication request and as a new authentication response for single sign-on access of the principal to the identity service and other services external or internal to the identity service, the identity service acts as a proxy for access sessions to the other services on behalf of the principal, the principal'"'"'s access sessions occur indirectly through the identity service and transparently to the principal, wherein the authentication message includes the new authentication request made on behalf of the principal and the authentication message also includes a new authentication response that satisfies the new authentication request, that response vouches for authentication of the principal to the identity service for the single sign-on access of the principal, the principal believing interactions are with the external service, which is one of the other services that the identity service controls access to, and a determination as to whether to use a single interaction or multiple interactions for authentication of the principal to the other services is automatically communicated in the new authentication response.

2. The method of claim 1 further comprising, making, by the machine, a target service available to interactions between the principal and an external service, the target service is directly accessible from an environment of the identity service.

3. The method of claim 1, wherein supplying further includes redirecting the principal to the identity service and including with the redirection the new authentication request and the new authentication response represented by the authentication message, and the identity service authenticates the principal automatically in response to the new authentication response included with the authentication message.

4. The method of claim 3, wherein supplying further includes representing the new authentication response as a first authentication token that informs the identity service that the principal is currently already properly authenticated to the processing associated with the method.

5. The method of claim 4, wherein supplying further includes adding a second authentication to a second redirection of the principal, wherein the second authentication represents authentication of the principal to the identity service and wherein the second redirection directs the principal to request a target service that is to be proxied on behalf of the principal from the identity service.

6. The method of claim 1, wherein supplying further includes representing the new authentication response as an instruction to the identity service to enforce its own independent authentication with the principal before considering the principal authenticated to the identity service.

7. The method of claim 1 further comprising, interacting, by the machine, with the principal via a World-Wide Web (WWW) browser over the Internet using at least one of a Security Assertion Markup Language (SAML), a Liberty Alliance markup language, and Web Services (WS) Foundation markup language.

8. A machine-implemented method to execute on a machine, comprising:

receiving, by the machine, an authentication request and an authentication response as a single sign-on transaction from a principal, the authentication request and the authentication response are received indirectly from the principal via an original identity service acting as a proxy on behalf of the principal and actions of that original identity service are transparent to the principal and the authentication response produced by that original identity service to authenticate the principal for the single sign-on transaction, the authentication request and the authentication response produced by the original identity service are different from that which was originally provided by the principal to the original identity service and the authentication request and the authentication response are made on behalf of the principal once the principal is authenticated by the original identity service;

detecting, by a machine and from an identity service, an instruction, which is represented in the authentication response, the identity service is different from the original identity service, and the identity service and the original identity service are in a secure relationship with one another; and

taking, by the machine, an action in response to the instruction to authenticate the principal for access to targeted services, access to the target services occur via proxied sessions through the identity service and transparent to the principal, wherein the action taken is dynamic and a real-time evaluation of policies processed by the identity service.

9. The method of claim 8, wherein detecting further includes identifying the instruction as an assertion from the identity service that the principal is currently already authenticated to the identity service.

10. The method of claim 9, wherein taking further includes authenticating the principal, in response to the assertion, and supplying an authentication token to the principal indicating that the principal is authenticated for access to the targeted services.

11. The method of claim 8, wherein detecting further includes identifying the instruction as an identity service request from the identity service to independently authenticate the principal.

12. The method of claim 11, wherein taking further includes interactively authenticating the principal via a challenge and response dialogue in response to the identity service request and supplying an authentication token to the principal that indicates the principal is authenticated for access to the targeted services, if authentication is successful.

13. The method of claim 8 further comprising:

receiving, by the machine, an authentication service token from the identity service or an external service associated with the principal, the authentication service token indicates the principal has been authenticated for access to the targeted services, and the targeted services are external to the identity service; and

using, by the machine, the authentication service token to proxy the targeted services to the identity service or the external service associated with the principal transparent to the principal, access sessions between the principal and the target services are proxied via the identity service or the external service.

14. A machine-implemented method to execute on a machine, comprising:

receiving, by the machine, a request for access from a principal, the request includes a first authentication token, the first authentication token indicating the principal is currently already authenticated to a first identity service and a second authentication token indicating the principal is also currently also already authenticated to a second identity service, the principal authenticates to the second identity service via the first authentication token because the first identity service is in a secure relationship with the second identity service and the second identity service relies on the first authentication token to automatically issue the second authentication token, and the second authentication token identifies the principal indicating that the first identity service can permissibly designate the principal for access to a targeted service controlled by the second identity service;

acquiring, by the machine, a service token for the targeted service that can be made accessible to the first identity service; and

supplying, by the machine, the first identity service with the service token for accessing the targeted service, the first identity service passes the service token to the principal thereby making the targeted service accessible from and to the principal from the first identity service acting as a proxy for features of the target service and using the service token, the first identity service proxies the target service to the principal while the principal believes that the principal is directly interacting with the target service, the target service was originally just accessible from an environment associated with the second identity service but is made available outside that environment by the second identity service providing proxy services to the first identity service and the first identity service provides to the principal.

15. The method of claim 14, wherein receiving further includes receiving the request as a browser redirection forced by the first identity service during interactions with the principal, and wherein the first authentication token is automatically supplied in the request during the redirection.

16. The method of claim 14, wherein acquiring further includes evaluating policy to ensure the targeted service is a type of service, which is permissibly accessible to the principal.

17. The method of claim 14, wherein acquiring further includes determining that the targeted service is authorized for access by the first identity service in response to an identifier associated with the first identity service.