Identity provider instance discovery

• US 8,832,271 B2
• Filed: 12/03/2010
• Issued: 09/09/2014
• Est. Priority Date: 12/03/2010
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: McCarty, Richard James
• Primary Examiner(s): Pham, Chi
• Assistant Examiner(s): CHOWDHURY, FAHMIDA S
• Application Number:
  US12/959,413
• Publication Number:
  US 20120144034A1
• Time in Patent Office: 1,376 Days
• Field of Search: 709/225
• US Class Current: 709/225
• CPC Class Codes: G06F 9/505 considering the load
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services

Abstract

An identity provider instance is discovered upon receipt from a service provider (or from a discovery service to which the service provider redirects the user) of a request for an IdP instance. Preferably, the request for an IdP instance is received as a Web services request following receipt at the service provider of an end user client request to access an application. In response to receiving the request, an IdP instance is selected, preferably using one or more criteria, such as user proximity, instance load, instance availability, the existence of a prior IdP binding, or the like. Following the selection, a response to the request is generated and returned to the requesting service provider. Preferably, the response is a redirect to the selected IdP instance.

Claims

1. Apparatus, comprising:

a processor;

computer memory holding computer program instructions that when executed by the processor perform an automated method to discover an identity provider instance (IdP), the identity provider instance being one of a plurality of identity provider instances that comprise a logical IdP service, the method comprising;

receiving a request for an identity provider instance, the request being issued to the logical IdP service automatically by a service provider in response to receipt at the service provider of an end user request to obtain a service from an application associated with the service provider;

in response to receiving the request for the identity provider instance, selecting a particular one of the plurality of identity provider instances according to a selection criteria; and

returning to the service provider a response to the request for the identity provider instance, the response identifying the selected identity provider instance.

2. The apparatus as described in claim 1 wherein the selection criteria is a capability associated with one or more identity provider instances.

3. The apparatus as described in claim 1 wherein the selection criteria is one of:

a network proximity between an computing entity and one or more of the identity provider instances, a geographic proximity between a computing entity and one or more of the identity provider instances, a load associated with one or more of the identity provider instances, availability of one or more identity provider instances, a performance metric associated with one or more identity provider instances, and an existing binding associated with one or more identity provider instances.

4. The apparatus as described in claim 1 wherein the request for an identity provider instance is a Web service request that is generated by the service provider.

5. The apparatus as described in claim 1 wherein the request for an identity provider instance is received following selection of an identity provider associated with the plurality of identity provider instances.

6. The apparatus as described in claim 1 wherein the plurality of identity provider instances include at least one cluster of identity provider instances that are co-located with one another.

7. The apparatus as described in claim 1 wherein the plurality of identity provider instances includes at least first and second clusters of identity provider instances, the first cluster being located remote from the second cluster.

8. The apparatus as described in claim 1 wherein the method further includes maintaining at least first and second identity provider instances in a synchronized state.

9. The apparatus as described in claim 1 wherein the logical IdP service is a logical enterprise IdP service.

10. A computer program product in a non-transitory computer readable medium for use in a data processing system for automated discovery of an identity provider instance (IdP), the identity provider instance being one of a plurality of identity provider instances that comprise a logical IdP service, the computer program product holding computer program instructions which, when executed by the data processing system, perform a method comprising:

receiving a request for an identity provider instance, the request being issued to the logical IdP service automatically by a service provider in response to receipt at the service provider of an end user request to obtain a service from an application associated with the service provider;

in response to receiving the request for the identity provider instance, selecting a particular one of the plurality of identity provider instances according to a selection criteria; and

returning to the service provider a response to the request for the identity provider instance, the response identifying the selected identity provider instance.

11. The computer program product as described in claim 10 wherein the selection criteria is a capability associated with one or more identity provider instances.

12. The computer program product as described in claim 10 wherein the selection criteria is one of:

a network proximity between an computing entity and one or more of the identity provider instances, a geographic proximity between a computing entity and one or more of the identity provider instances, a load associated with one or more of the identity provider instances, availability of one or more identity provider instances, a performance metric associated with one or more identity provider instances, and an existing binding associated with one or more identity provider instances.

13. The computer program product as described in claim 10 wherein the request for an identity provider instance is a Web service request that is generated by the service provider.

14. The computer program product as described in claim 10 wherein the request for an identity provider instance is received following selection of an identity provider associated with the plurality of identity provider instances.

15. The computer program product as described in claim 10 wherein the plurality of identity provider instances include at least one cluster of identity provider instances that are co-located with one another.

16. The computer program product as described in claim 10 wherein the plurality of identity provider instances includes at least first and second clusters of identity provider instances, the first cluster being located remote from the second cluster.

17. The computer program product as described in claim 10 wherein the method further includes maintaining at least first and second identity provider instances in a synchronized state.

18. The computer program product as described in claim 10 wherein the logical IdP service is a logical enterprise IdP service.