Systems and methods for system login and single sign-on

• US 9,189,615 B2
• Filed: 04/28/2011
• Issued: 11/17/2015
• Est. Priority Date: 04/28/2010
• Status: Active Grant

• Current Assignee: OPENLANE, Inc.
• Original Assignee: OPENLANE, Inc.
• Inventors: Tumanyan, Hovhannes
• Primary Examiner(s): Arani, Taghi
• Assistant Examiner(s): LANE, GREGORY A
• Application Number:
  US13/096,389
• Publication Number:
  US 20120023565A1
• Time in Patent Office: 1,664 Days
• Field of Search: 726/1, 726/4, 726/8
• US Class Current: 1/1
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

Systems and methods for system login and single sign-on are described. A first application of a first system receives a request to access a protected application of a second system. An assertion is generated in response to the request. The assertion asserts an identity in the first system of a user generating the request. The assertion is validated and first account information corresponding to the assertion is extracted. The first account information is information of a first account of the user in the first system. Second account information is determined that is information of a second account of the user in the second system. A mapping is generated between the first account and the second account using the first account information and the second account information. The mapping is used to provide access to the protected application by the requestor.

Claims

1. A method comprising:

receiving at a first application of a first system a request to access a protected application of a second system, the first application and the protected application running on at least one hardware processor;

generating in response to the request an assertion that asserts an identity in the first system of a user generating the request;

validating the assertion and extracting first account information corresponding to the assertion, wherein the first account information is information of a first account of the user in the first system, the first account information including a unique identifier of the user in the first system;

determining second account information that is information of a second account of the user in the second system, the determining the second account information including using the first account information to prompt for credentials of the user in the second account and authenticating the credentials in the second system; and

generating a mapping between the first account of the user and the second account of the user using the first account information and the second account information.

2. The method of claim 1, comprising providing access to the protected application by the user via the mapping.

3. The method of claim 1, wherein the second system is remote to the first system.

4. The method of claim 1, wherein the generating of the assertion is performed at the first system.

5. The method of claim 1, wherein the generating of the assertion uses security assertion markup language.

6. The method of claim 1, comprising generating a query string parameter in response to the request, wherein the query string parameter includes the assertion.

7. The method of claim 6, comprising generating the query string parameter to include a uniform resource locator corresponding to an electronic location of the protected application.

8. The method of claim 7, comprising, following the mapping, redirecting the user to the protected application using the uniform resource locator.

9. The method of claim 6, comprising generating the query string parameter at the first system and propagating the query string parameter to the second system.

10. The method of claim 1, wherein the validating is performed at the second system using a key provided by the first system.

11. The method of claim 1, wherein the determining the second account information comprises, in response to the first account information, generating a prompt for the second account information.

12. The method of claim 1, wherein the generating the mapping comprises generating the mapping in response to receipt of the second account information.

13. The method of claim 1, comprising authenticating the second account information prior to the generating of the mapping.

14. The method of claim 13, comprising determining that the second account information is associated with a plurality of organizations and prompting the user to select an organization of the plurality of organizations.

15. The method of claim 14, comprising generating the mapping to include the organization selected.

16. The method of claim 1, wherein the mapping comprises generating a logical link between the first account information and the second account information.

17. The method of claim 1, comprising storing the mapping in the second system.

18. The method of claim 1, wherein the first account information comprises an account name of the first account in the first system.

19. The method of claim 1, wherein the second account information comprises an account name of the second account in the second system.

20. The method of claim 19, wherein the second account information comprises a password corresponding to the second account.

21. The method of claim 20, comprising authenticating the password prior to the generating of the mapping.

22. A method comprising:

receiving at a first application of a first system a request to access a protected application of a second system, the first application and the protected application running on at least one hardware processor;

generating an assertion in response to the request, wherein the assertion asserts an identity in the first system of a user generating the request;

validating the assertion and extracting first account information corresponding to the assertion, wherein the first account information is information of a first account of the user in the first system, the first account information including a unique identifier of the user in the first system;

in response to the first account information, using the first account information to generate a prompt for second account information that is information of a second account of the user in the second system, the second account information including credentials of the user;

authenticating the credentials in the second system; and

generating a mapping between the first account of the user and the second account of the user in response to receipt of the second account information, wherein the mapping uses the first account information and the second account information.

23. A method comprising:

receiving at a partner system a request to access a protected application of a host system, wherein the partner system is remote to the host system, the partner system and the host system comprising one or more applications running on at least one hardware processor, the one or more applications including the protected application and an access application;

generating a query string parameter in response to the request, wherein the query string parameter includes an assertion of an identity in the partner system of a user generating the request;

propagating the query string parameter to the access application and validating the assertion using a key provided by the partner system;

extracting first account information corresponding to the assertion, wherein the first account information is information of a partner system account corresponding to the user;

using the first account information to generate a prompt for second account information that is information of a host system account corresponding to the user, the second account information including credentials of the user;

authenticating the credentials in the second system;

generating a logical link between the first account information and the second account information in response to receipt of the second account information; and

providing access to the protected application by the user via the logical link.

24. A method comprising:

receiving at a first application of a first system a request to access a protected application of a second system, the first system and the second system comprising one or more applications running on at least one hardware processor, the one or more applications including the first application and the protected application;

generating an assertion in response to the request, wherein the assertion asserts an identity in the first system of a user generating the request;

validating the assertion and extracting first account information corresponding to the assertion, wherein the first account information is information of a first account of the user in the first system;

in response to the first account information, using the first account information to generate a prompt for second account information that is information of a second account of the user in the second system, the second account information including credentials of the user;

authenticating the credentials in the second system;

receiving the second account information and determining that the second account information is associated with a plurality of organizations;

determining an organization of the plurality of organizations with which the user is affiliated for purposes of the request; and

generating a mapping between the first account and the second account in response to receipt of the second account information, wherein the mapping uses the first account information and the second account information and includes the organization.

25. A system comprising a first application of a first system coupled to a second application of a second system, the system comprising one or more applications running on at least one hardware processor, the one or more applications including the first application and the second application, wherein the first application receives a request for access to the second application and in response generates an assertion that asserts an identity in the first system of a user corresponding to the request, wherein an access application coupled to the first application and the second application receives and validates the assertion and extracts first account information corresponding to the assertion, wherein the first account information is information of a first account of the user in the first system, wherein the access application determines second account information that is information of a second account of the user in the host system, the determining the second account information including using the first account information to prompt for credentials of the user in the second account and authenticating the credentials in the second system, wherein the access application generates a mapping between the first account and the second account using the first account information and the second account information.

26. The system of claim 25, wherein the access application provides access to the second application by the user via the mapping.

27. The system of claim 25, wherein the second system is remote to the first system.

28. The system of claim 25, wherein the first application generates the assertion using security assertion markup language.

29. The system of claim 25, wherein, in response to the request, the first application generates a query string parameter that includes the assertion.

30. The system of claim 29, wherein the query string parameter includes a uniform resource locator corresponding to an electronic location of the second application.

31. The system of claim 30, wherein the access application, following the mapping, redirects the user to the second application using the uniform resource locator.

32. The system of claim 25, wherein the access application validates the assertion using a key provided by the first system.

33. The system of claim 25, wherein, in response to the first account information, the access application determines the second account information by generating a prompt for the second account information.

34. The system of claim 25, wherein the access application generates the mapping in response to receipt of the second account information.

35. The system of claim 25, wherein the access application authenticates the second account information prior to the generating of the mapping.

36. The system of claim 35, wherein the access application determines that the second account information is associated with a plurality of organizations and prompts the user to select an organization of the plurality of organizations.

37. The system of claim 36, wherein the access application generates the mapping to include the organization selected.

38. The system of claim 25, wherein the access application generates the mapping by generating a logical link between the first account information and the second account information.

39. The system of claim 25, wherein the mapping is stored.

40. The system of claim 25, wherein the first account information comprises an account name of the first account in the first system.

41. The system of claim 25, wherein the second account information comprises an account name of the second account in the second system.

42. The system of claim 41, wherein the second account information comprises a password corresponding to the second account.

43. The system of claim 42, wherein the access application authenticates the password prior to the generating of the mapping.

44. A system comprising a hardware processor running an access application that receives an assertion from a first system, wherein the assertion is generated in response to a request to access a protected component of a second system, wherein the assertion asserts an identity in the first system of a user corresponding to the request, wherein the access application validates the assertion and extracts first account information corresponding to the assertion, wherein the first account information is information of a first account of the user in the first system, wherein the access application determines second account information that is information of a second account of the user in the second system, the determining the second account information including using the first account information to prompt for credentials of the user in the second account and authenticating the credentials in the second system, wherein the application generates a mapping between the first account and the second account using the first account information and the second account information and provides access to the protected component via the mapping.