Facilitating token request troubleshooting

• US 8,869,258 B2
• Filed: 03/12/2010
• Issued: 10/21/2014
• Est. Priority Date: 03/12/2010
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Wu, Wei, Azhagiyapandiapuram, Balaji
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): ZHAO, DON GORDON
• Application Number:
  US12/722,539
• Publication Number:
  US 20110225641A1
• Time in Patent Office: 1,684 Days
• Field of Search: 713/159, 713/172, 713/183, 713/185, 726/17, 726/9, 726/20, 705 65- 66
• US Class Current: 726/9
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

A system and method for troubleshooting errors that occur during token requests. An identity provider generates a session ID and uses the session ID when logging events that occur during handling of the request. Multiple servers, processes, or threads may use the same session ID. The session ID may be sent with an error message to the requester. An ID of one or more servers that processed the request may also be sent to the requester. Upon receiving the error message, the requester may provide the error information to an administrator, who uses the information to retrieve associated logged events.

Claims

1. A computer-based method of processing a request for a security token, the method comprising:

a) receiving, at an identity provider system, the request from a requester;

b) generating, at the identity provider system, a session ID, the session ID associated with processing of the request;

c) logging one or more events associated with the processing of the request, the logging including associating the session ID with each of the one or more events; and

d) sending, from the identity provider system, a markup language page that includes an error message to the requester, the error message including the session ID and enabling retrieval of the one or more events, the markup language page enabling display of the error message, including the session ID, at a client computing device.

2. The computer-based method of claim 1, the identity provider system comprising a first server and a second server, the method further comprising:

a) generating the session ID at the first server; and

b) sending the session ID from the first server to the second server;

wherein logging the one or more events is performed by the second server.

3. The computer-based method of claim 1, the identity provider system comprising a first server and a second server, the method further comprising sending the session ID from the first server to the second server, and logging the one or more events comprises logging at least one event from the first server and logging at least one other event from the second server.

4. The computer-based method of claim 1, further comprising sending to the requester an identifier of at least one server of the identity provider system, the at least one server performing the logging of the one or more events.

5. The computer-based method of claim 1, the identity provider system comprising at least one proxy server and at least one security token server, the method further comprising generating the session ID at the at least one proxy server, sending the session ID from the at least one proxy server to a security token server of the at least one security token server, returning an error status from the security token server, and logging the at least one event by the security token server.

6. The computer-based method of claim 1, further comprising, after the error message is received by the requester:

a) at the requester, providing the session ID to an administrator;

b) receiving the session ID from the requester; and

c) employing the session ID received from the requester to retrieve the one or more events associated with the processing of the request.

7. The computer-based method of claim 1, the error message further including at least one identifier of at least one server of the identity provider system, the at least one server performing the logging of the one or more events, the method further comprising after sending the error message to the requester, receiving the session ID from the requester out of band and employing the session ID and the at least one identifier to retrieve the logged one or more events.

8. The computer-based method of claim 1, the identity provider system comprising at least one proxy server and a plurality of security token servers, the method further comprising generating the session ID at the at least one proxy server, sending the session ID from the at least one proxy server to a security token server of the plurality of security token servers, returning an error status from the security token server, logging the one or more events by the security token server, sending the requester a Web page that includes an identifier of the security token server, and employing the identifier of the security token server to retrieve the logged one or more events.

9. The computer-based method of claim 1, logging the one or more events comprising logging a first event from a first thread and logging a second event from a second thread, the session ID associated with the first event and the second event.

10. A computer-based system for processing a request for a token, the system comprising:

a) a first server that receives the request for the token from a requester;

b) a second server that selectively provides the requested token;

the first server configured to perform actions including;

c) generating a session ID;

d) sending the session ID and a request for the token to the second server; and

e) in response to receiving an error status from the second server, sending an error message to the requester, the error message including the session ID and an identifier associated with the second server, wherein sending the error message to the requester comprises sending a Web page that comprises the session ID and the identifier associated with the second server; and

the second server configured to perform actions including logging one or more events associated with the request, logging including associating each of the one or more events with the session ID.

11. The computer-based system of claim 10, the second server configured to perform actions including:

a) in response to receiving the request for the token, selectively providing the requested token;

b) sending the identifier associated with the second server to the first server.

12. The computer-based system of claim 10, the second server configured to perform actions including:

a) employing two or more threads to process the request for the token; and

b) logging one or more events from each of the two or more threads, the logging including associating each of the logged events with the session ID.

13. The computer-based system of claim 10, further comprising generating, at a proxy server, the Web page including the error message, wherein sending, to the requester, the error message comprises sending, from the proxy server to the requester, the Web page.

14. The computer-based system of claim 10, further comprising an interface that enables retrieving one or more of the logged events based on the session ID and the identifier associated with the second server.

15. The computer-based system of claim 10, wherein the identifier associated with the second server obfuscates the identity of the second server.

16. A computer-readable hardware storage medium comprising computer program instructions for processing a request for a token from a requester, the program instructions executable by one or more processors to perform actions including:

a) receiving, at first server, the request;

b) generating a session ID for association with the request;

c) sending the session ID from the first server to a second server;

d) at the second server, selectively providing the token;

e) logging information associated with processing of the request;

f) if an error has occurred, sending a Web page including an error message to the requester, the Web page including the session ID; and

g) enabling subsequent retrieval of the logged information based on the session ID included in the Web page.

17. The computer-readable hardware storage medium of claim 16, wherein the actions further include if an error occurs at the first server, logging error information associated with the processing of the request at the first server;

and if an error occurs at the second server, logging the error information associated with the processing of the request at the second server; and

wherein the subsequent retrieval of the logged information includes the error information.

18. The computer-readable hardware medium of claim 16, wherein the token is a security token, and wherein selectively providing the token comprises determining whether the requester is authorized to receive the security token.

19. The computer-readable hardware storage medium of claim 16, wherein the first server is a proxy server and the second server is a security token server, the error message including an identifier of the security token server and an identifier of the proxy server.

20. The computer-readable hardware storage medium of claim 16, wherein the error message further includes an identifier of the first server or the second server, the identifier facilitating the subsequent retrieval of the logged information.