Cross instance user authentication architecture

• US 9,032,488 B2
• Filed: 04/17/2013
• Issued: 05/12/2015
• Est. Priority Date: 04/17/2012
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Lee, Jong
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Zoubair, Noura
• Application Number:
  US13/864,549
• Publication Number:
  US 20130276070A1
• Time in Patent Office: 755 Days
• Field of Search: 726/4, 726/8, 709/217, 709/225, 709/227, 709/240, 380/258, 713/155, 370/389, 370/392
• US Class Current: 726/4
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1021 based on client or server locations

Abstract

In accordance with disclosed embodiments, there are provided methods, systems, and apparatuses for implementing a cross instance user authentication architecture in an on-demand service environment including, for example, means for receiving a login request at a global Virtual Internet Protocol (VIP) address for the host organization from a client device; forwarding the login request received at the global VIP address to one of a plurality of datacenters within the host organization; determining the selected datacenter is a non-home-geo datacenter for a user associated with the login request received from the client device; establishing a back-end link from the non-home-geo datacenter to a home-geo datacenter for the user; forwarding the login request from the non-home-geo datacenter to the home-geo datacenter via the back-end link for authentication of the client device at the home-geo datacenter responsive to the login request received from the computing device; and returning a response to the client device from the non-home-geo datacenter upon successful authentication of the login request at the home-geo datacenter, wherein the response specifies a re-direct to the home-geo datacenter for the user. Other related embodiments are disclosed.

Claims

1. A method at a host organization, the method comprising:

receiving a login request at a global Virtual Internet Protocol (VIP) address for the host organization from a client device;

forwarding the login request received at the global VIP address to one of a plurality of datacenters within the host organization;

determining the selected datacenter is a non-home-geo datacenter for a user associated with the login request received from the client device;

establishing a back-end link from the non-home-geo datacenter to a home-geo datacenter for the user;

forwarding the login request from the non-home-geo datacenter to the home-geo datacenter via the back-end link for authentication of the client device at the home-geo datacenter responsive to the login request received from the computing device; and

returning a response to the client device from the non-home-geo datacenter upon successful authentication of the login request at the home-geo datacenter, wherein the response specifies a re-direct to the home-geo datacenter for the user.

2. The method of claim 1, wherein receiving a login request at a global Virtual Internet Protocol (VIP) address for the host organization from a client device comprises:

receiving the login request at a single URL endpoint servicing login requests for the host organization at the Virtual IP address specified regardless of the home-geo datacenter affiliated with incoming login requests.

3. The method of claim 1:

wherein receiving a login request at a global Virtual Internet Protocol (VIP) address for the host organization from a client device comprises receiving the login request at a global Virtual IP interface and load balancer for the host organization; and

wherein the global Virtual IP interface and load balancer selects the one of the plurality of datacenters within the host organization to process the login request received based on a geographic proximity of the client device making the login request and the selected one of the plurality of datacenters.

4. The method of claim 3, wherein the global Virtual IP interface and load balancer operates at computing hardware of the host organization which resides outside of the selected one of the plurality of datacenters and which resides outside of the home-geo datacenter for the user.

5. The method of claim 3, wherein the global Virtual IP interface and load balancer selects an instance from an application server pool at the selected datacenter to receive the login request for further processing.

6. The method of claim 3, wherein forwarding the login request received at the global VIP address to one of a plurality of datacenters within the host organization, comprises:

forwarding the login request to a local load balancer at the selected one of the plurality of datacenters, wherein the local load balancer selects an instance from an application server pool within the selected datacenter to receive the login request for further processing.

7. The method of claim 1, wherein forwarding the login request from the non-home-geo datacenter to the home-geo datacenter via the back-end link, comprises:

determining a geographic region associated with the client device based on an Internet Protocol (IP) address for the client device; and

performing geographic Internet Protocol (Geo-IP) routing for the client device based on the geographic region associated with the client device to select the one of a plurality of datacenters within the host organization.

8. The method of claim 1, wherein determining the selected datacenter is a non-home-geo datacenter for a user associated with the login request received from the client device, comprises:

receiving the login request at an application server within a first computing pod of the selected datacenter;

checking a database within the first computing pod for a username passed with the login request;

performing a fan-out operation to a second one or more computing pods within the selected datacenter requesting application servers in the respective second one or more computing pods check databases within the respective second one or more computing pods for the username passed with the login request when the username is not located in the database of the first computing pod; and

performing a fan-out operation to a second one or more datacenters of the host organization distinct from the selected datacenter requesting application servers in the respective second one or more datacenters check databases within the respective second one or more datacenters for the username passed with the login request when the username is not located in any of the computing pods of the selected datacenter.

9. The method of claim 8, further comprising:

returning an error code to the computing device making the login request when the username is not identified within any datacenter of the host organization indicating the user is unknown or invalid;

maintaining a count of invalid requests associated with computing device making the login request; and

discarding further login requests from the computing device to protect against denial of service (DOS) attacks when the count of invalid requests from the computing device exceeds a threshold.

10. The method of claim 1, further comprising one of:

replicating a users table across all pods within individual datacenters of the host organization but not across multiple datacenters of the host organization, wherein the users table specifies all users affiliated with the respective datacenter as their home-geo datacenter;

or alternatively

replicating a master users table across all datacenters of the host organization, wherein the master users table specifies all users known to the host organization and the home-geo datacenter for each of the users known.

11. The method of claim 1, further comprising:

replicating a master users table across all datacenters of the host organization, wherein the master users table specifies users associated with the host organization and the affiliated home-geo datacenter for each user; and

wherein the method further comprises;

determining a user associated with the login request received from the client device is unknown to the host organization after querying a single database at the selected datacenter when replication of the master users table is up-to-date, and

determining the user associated with the login request received from the client device is unknown to the host organization after querying multiple databases within the selected datacenter and after querying all other datacenters of the host organization via fan-out operations when replication of the master users table is not up-to-date.

12. The method of claim 1, further comprising:

replicating a users table within the selected datacenter of the host organization, wherein the users table specifies all users associated with the selected datacenter as their affiliated home-geo datacenter; and

wherein the method further comprises;

determining the selected datacenter is a non-home-geo datacenter for the user associated with the login request received from the client device after querying a single database at the selected datacenter when replication of the users table is up-to-date, and

performing a fan-out operation to other datacenters of the host organization to determine which of the plurality of datacenters is the home-geo for the user associated with the login request received.

13. The method of claim 1:

wherein receiving a login request at a global Virtual Internet Protocol (VIP) address for the host organization from a client device comprises receiving the login request from a web-browser at the client device;

wherein establishing a back-end link from the non-home-geo datacenter to a home-geo datacenter for the user further comprises communicating with the home-geo datacenter over the back-end link using a temporary session; and

wherein returning a response to the client device from the non-home-geo datacenter upon successful authentication of the login request at the home-geo datacenter further comprises returning a valid session cookie for an authenticated session between the client device and the home-geo datacenter specified via the re-direct.

14. The method of claim 1:

wherein receiving a login request at a global Virtual Internet Protocol (VIP) address for the host organization from a client device comprises receiving an API based login request from the client device;

wherein the method further comprises establishing a session for the API based login request;

wherein establishing a back-end link from the non-home-geo datacenter to a home-geo datacenter for the user further comprises communicating with the home-geo datacenter over the back-end link using the session for the API based login request; and

wherein returning a response to the client device from the non-home-geo datacenter upon successful authentication of the login request at the home-geo datacenter further comprises authenticating the session for the API based login request and returning a valid session cookie for the authenticated session for use between the client device and the home-geo datacenter specified via the re-direct.

15. The method of claim 1, wherein authentication of the client device at the home-geo datacenter responsive to the login request received from the computing device comprises:

validating a username and password passed with the login request.

16. The method of claim 15, wherein authentication of the client device further comprises:

validating an Internet Protocol (IP) address associated with the user'"'"'s login request;

validating the user against permissible login hours for the username specified; and

validating a challenge response to a further authentication challenge issued by the host organization responsive to the login request.

17. The method of claim 1, wherein establishing a back-end link from the non-home-geo datacenter to a home-geo datacenter for the user comprises opening a secure HTTP compatible tunnel between an application server instance of the non-home-geo datacenter and an application server instance at the home-geo datacenter.

18. The method of claim 1, wherein forwarding the login request from the non-home-geo datacenter to the home-geo datacenter via the back-end link comprises communicating cross-instance calls between the non-home-geo datacenter and the home-geo datacenter, wherein each of the cross-instance calls are secured by one or more of the following:

a temporary session ID created uniquely for the communications between the non-home-geo datacenter and the home-geo datacenter in fulfillment of the login request;

a header specifying a hash of the MAC address of the instance at the non-home-geo datacenter to protect against modification to the cross-instance calls en-route; and

IP restriction applied to the cross-instance calls on the back-end link to prevent external parties from accessing or modifying the cross-instance calls being communicated.

19. The method of claim 1, further comprising:

receiving the login request at the host organization as one of a plurality of requests received from a plurality of customer organizations, wherein each customer organization is an entity selected from the group consisting of;

a separate and distinct remote organization, an organizational group within the host organization, a business partner of the host organization, or a customer organization that subscribes to cloud computing services provided by the host organization.

20. The method of claim 19, wherein the host organization implements a multi-tenant database system having therein elements of hardware and software that are shared by a plurality of separate and distinct customer organizations, each of the separate and distinct customer organizations being remotely located from the datacenters of the host organization and wherein the customer organizations communicate with the host organization over a public Internet.

21. Non-transitory computer readable storage medium having instructions stored thereon that, when executed by a computing hardware of a host organization including one or more processors and memories, the instructions cause the host organization to perform operations comprising:

receiving a login request at a global Virtual Internet Protocol (VIP) address for the host organization from a client device;

forwarding the login request received at the global VIP address to one of a plurality of datacenters within the host organization;

determining the selected datacenter is a non-home-geo datacenter for a user associated with the login request received from the client device;

establishing a back-end link from the non-home-geo datacenter to a home-geo datacenter for the user;

forwarding the login request from the non-home-geo datacenter to the home-geo datacenter via the back-end link for authentication of the client device at the home-geo datacenter responsive to the login request received from the computing device; and

returning a response to the client device from the non-home-geo datacenter upon successful authentication of the login request at the home-geo datacenter, wherein the response specifies a re-direct to the home-geo datacenter for the user.

22. The non-transitory computer readable storage medium of claim 21, wherein receiving a login request at a global Virtual Internet Protocol (VIP) address for the host organization from a client device comprises:

receiving the login request at a single URL endpoint servicing login requests for the host organization at the Virtual IP address specified regardless of the home-geo datacenter affiliated with incoming login requests.

23. The non-transitory computer readable storage medium of claim 21, wherein forwarding the login request from the non-home-geo datacenter to the home-geo datacenter via the back-end link, comprises:

determining a geographic region associated with the client device based on an Internet Protocol (IP) address for the client device; and

performing geographic Internet Protocol (Geo-IP) routing for the client device based on the geographic region associated with the client device to select the one of a plurality of datacenters within the host organization.

24. A computing architecture within a host organization, the computing architecture comprising:

one or more processors and memories to execute instructions;

a plurality of datacenters geographically separated from one another, each of the plurality of datacenters having a plurality of computing pods therein including a database and a pool of application servers to perform workload processing on behalf of the host organization;

a global virtual IP address interface and load balancer servicing a single URL endpoint for the host organization to receive login requests on behalf of the host organization;

wherein the global virtual IP address interface and load balancer is to receive a login request from a client device and forward the login request to one of the plurality of datacenters within the host organization;

wherein an application server at the selected datacenter determines the selected datacenter is a non-home-geo datacenter for a user associated with the login request received from the client device;

wherein the application server establishes a back-end link from the non-home-geo datacenter to another application server at a home-geo datacenter for the user and forwards the login request from the non-home-geo datacenter to the home-geo datacenter via the back-end link for authentication of the client device at the home-geo datacenter responsive to the login request received from the computing device; and

wherein the application server at the non-home-geo datacenter returns a response to the client device upon successful authentication of the login request by the other application server at the home-geo datacenter, wherein the response specifies a re-direct to the home-geo datacenter for the user.

25. The computing architecture of claim 24, wherein each of the plurality of datacenters further comprises a local load balancer to distribute workload amongst the plurality of computing pods application servers within each of the respective plurality of datacenters.