System and method for single sign-on to resources across a network

• US 8,990,911 B2
• Filed: 03/25/2009
• Issued: 03/24/2015
• Est. Priority Date: 03/30/2008
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Olden, Eric, Platt, Darren C., Royer, Coby, Berg, Keshava, Wallingford, Joseph H. III
• Primary Examiner(s): Davis, Zachary A
• Application Number:
  US12/410,971
• Publication Number:
  US 20090249439A1
• Time in Patent Office: 2,190 Days
• Field of Search: 726/1, 726/8, 726/10, 726 5- 7, 726/27, 726/28
• US Class Current: 726/8
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Systems, methods and apparatus for providing single sign on across a plurality of resources is disclosed. An exemplary method includes receiving a request from a user to access a particular one of the plurality of resources; establishing an SSO session for the user if an SSO session has not been established; determining if the user has been authenticated to the particular resource, and if not, retrieving credentials for the user that are specific to the resource; presenting the credentials to the resource so as to create a session with the resource; and presenting a user interface for a customer to configure which of the plurality of resources can be accessed by users.

Claims

1. A method for providing single sign-on across a plurality of resources, comprising:

receiving a request from a user to access a particular resource of the plurality of resources;

establishing a single sign-on (SSO) session for the user if an SSO session has not been established;

determining if the user has been authenticated to the particular resource, and if not, retrieving credentials for the user that are specific to the particular resource from a credential store, the credential store including a plurality of different credential sets for the user corresponding to different ones of the plurality of resources;

providing a token to a software client of the user;

operatively presenting the credentials retrieved from the credential store to the particular resource so as to create a session with the particular resource;

presenting a first user interface for a customer to configure access policies that define which of the plurality of resources can be accessed by the user;

discovering an authentication subsystem of the particular resource by simulating

a) an end user using a browser, and

b) the browser interacting with the particular resource;

communicating with the authentication subsystem to authenticate the user;

connecting to one or more user stores to retrieve attributes relating to the user;

utilizing the attributes to evaluate the access policies to determine whether or not the user should be granted access to the particular resource;

receiving the request from the user as a proxy address that differs from the actual address of the particular resource;

presenting a second user interface to allow the user to set credentials in the credential store relative to the particular resource;

using characteristics of the request to determine which of a plurality of authentication subsystems to use; and

wherein at least a portion of the characteristics of the request comprises one or more results of a previous authentication attempt for the same request with another one of the plurality of authentication subsystems.

2. The method of claim 1, wherein the second user interface allows the user to set credentials in the credential store relative to the plurality of resources, and wherein the second user interface is different from the first user interface.

3. The method of claim 1, including programmatically setting credentials relative to at least one of the plurality of resources.

4. The method of claim 1, wherein the step of receiving the request from the user as a proxy address that differs from the actual address of the particular resource is performed by a Hypertext Transfer Protocol (HTTP) proxy.

5. The method of claim 4, including creating the session with the particular resource utilizing the security assertion mark-up language (SAML) protocol.

6. The method of claim 1, wherein the simulating of

the browser interacting with the particular resource includes simulating the browser interacting with a website.

7. The method of claim 1, including:

receiving, from a remote resource location, the access policies; and

using the access policies in connecting to the one or more user stores to retrieve the attributes relating to the user.

8. The method of claim 7, further comprising:

interacting with authentication handlers; and

dropping cookies for multiple domains so that subsequent requests from the user are recognized as coming from the user, even if the user requests resources from different domains, so as to allow the session to span multiple domains.

9. The method of claim 1, including name-space-mapping to map the user'"'"'s identity across user stores by:

providing a third-party user store user interface; and

automatically transforming data stored in the third-party user store for use in another resource.