System, method and program product for consolidated authentication

• US 8,880,872 B2
• Filed: 05/24/2012
• Issued: 11/04/2014
• Est. Priority Date: 05/07/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Doleh, Yaser K., Kalamaras, Christopher G., Marzorati, Mauro
• Primary Examiner(s): Rahman, Mahfuzur
• Assistant Examiner(s): LANE, GREGORY A
• Application Number:
  US13/480,038
• Publication Number:
  US 20120291141A1
• Time in Patent Office: 894 Days
• Field of Search: 713/155, 713/171, 726/8
• US Class Current: 713/155
• CPC Class Codes: G06F 21/1012 to domains
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A first computer sends a request to the second computer to access the application. The second computer determines that the user has not yet been authenticated to the application. The second computer redirects the request to a third computer. The third computer determines that the user has been authenticated to the third computer. The third computer authenticates the user to the application. The second computer returns a session key to the third computer for a session between the application and the user. The session has a scope of the second computer or the application but not a scope of a domain. The third computer generates another session key with a scope of the domain and sends the domain-scope session key to the first computer.

Claims

1. A method for authenticating a user at a first computer to first and second applications installed in a second computer, the method comprising the steps of:

the second computer receiving from the user a request to access the first application, and in response, the second computer redirecting the request to a third computer, and in response, the third computer determining that the user was previously authenticated based on a userID and password and notifying the second computer that the user is authentic, and in response, the second computer returning a session key to the third computer, the session key enabling a session with the first application but not with the second application, the first, second, and third computers being three different computers, the first and second applications installed in the second computer being different applications; and

in response to the third computer receiving the session key the third computer generating another session key which enables a session with both the first and second applications and sending the other session key to the first computer; and

the second computer receiving from the user another request with the other session key to access the first application, and in response the second computer determining that the user is authentic and notifying the first application that the user is authentic so that the first application can respond to the first computer to the other request; and

the second computer receiving from the user another request with the other session key to access the second application, and in response the second computer determining that the user is authentic and notifying the second application that the user is authentic so the second application can respond to the first computer to the other request to the second application.

2. The method of claim 1 wherein the user was previously authenticated to the third computer during registration of the user with the third computer.

3. The method of claim 1 wherein the other session key also enables a session with a third application in a fourth computer, and further comprising the steps of:

the fourth computer receiving a request including the other session key from the user to access the third application, and in response the fourth computer determining that the user is authentic and notifying the third application that the user is authentic so the third application can respond to the first computer to the request to the third application.

4. A computer program product for authenticating a user at a first computer to first and second applications installed in a second computer, the computer program product comprising:

one or more computer-readable tangible storage devices and program instructions stored on at least one of the one or more storage devices, the program instructions comprising;

first program instructions for execution in the second computer to receive from the user a request to access the first application, and in response, redirect the request to a third computer;

second program instructions for execution in the third computer, responsive to the redirected request, to determine that the user was previously authenticated based on a userID and password and notify the second computer that the user is authentic, and in response, the first program instructions return a session key to the third computer, the session key enabling a session with the first application but not with the second application, the first, second, and third computers being three different computers, the first and second applications installed in the second computer being different applications; and

wherein

the second program instructions, responsive to the third computer receiving the session key, to generate another session key which enables a session with both the first and second applications and send the other session key to the first computer;

the first program instructions receive from the user another request with the other session key to access the first application, and in response determine that the user is authentic and notify the first application that the user is authentic so that the first application can respond to the first computer to the other request; and

the first program instructions receive from the user another request with the other session key to access the second application, and in response determine that the user is authentic and notify the second application that the user is authentic so the second application can respond to the first computer to the other request to the second application.

5. The computer program product of claim 4 wherein the second program instructions receive from the user the valid combination of userID and password during a registration of the user with the third computer.

6. The computer program product of claim 4 wherein the other session key also enables a session with a third application in a fourth computer, and further comprising:

third program instructions, stored on at least one of the one or more storage devices, for execution in the fourth computer, to receive a request including the other session key from the user to access the third application, and in response determine that the user is authentic and notify the third application that the user is authentic so the third application can respond to the first computer to the request to the third application.

7. A computer system for authenticating a user at a first computer to first and second applications installed in a second computer, the computer system comprising:

one or more processors, one or more computer-readable memories and one or more computer-readable tangible storage devices in the second computer and a third computer, and program instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, the program instructions comprising;

first program instructions for execution in the second computer to receive from the user a request to access the first application, and in response, redirect the request to the third computer;

second program instructions for execution in the third computer, responsive to the redirected request, to determine that the user was previously authenticated based on a userID and password and notify the second computer that the user is authentic, and in response, the first program instructions return a session key to the third computer, the session key enabling a session with the first application but not with the second application, the first, second, and third computers being three different computers, the first and second applications installed in the second computer being different applications; and

wherein

the second program instructions, responsive to the third computer receiving the session key, to generate another session key which enables a session with both the first and second applications and send the other session key to the first computer;

the first program instructions receive from the user another request with the other session key to access the first application, and in response determine that the user is authentic and notify the first application that the user is authentic so that the first application can respond to the first computer to the other request; and

the first program instructions receive from the user another request with the other session key to access the second application, and in response determine that the user is authentic and notify the second application that the user is authentic so the second application can respond to the first computer to the other request to the second application.

8. The computer system of claim 7 wherein the second program instructions receive from the user the valid combination of userID and password during a registration of the user with the third computer.

9. The computer system of claim 7 wherein the other session key also enables a session with a third application in a fourth computer, and further comprising:

third program instructions, stored on at least one of the one or more storage devices, for execution in the fourth computer, to receive a request including the other session key from the user to access the third application, and in response determine that the user is authentic and notify the third application that the user is authentic so the third application can respond to the first computer to the request to the third application.