Mobile application, identity interface

• US 9,600,652 B2
• Filed: 07/06/2015
• Issued: 03/21/2017
• Est. Priority Date: 09/29/2011
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Sondhi, Ajay, Chu, Ching-Wen, Kim, Beomsuk, Brydon, Sean
• Primary Examiner(s): Chai, Longbit
• Application Number:
  US14/791,733
• Publication Number:
  US 20150310202A1
• Time in Patent Office: 624 Days
• Field of Search: 726/8
• US Class Current: 1/1
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications

Abstract

Techniques for managing identities are provided. In some examples, identity management, authentication, authorization, and token exchange frameworks may be provided for use with mobile devices, mobile applications, cloud applications, and/or other web-based applications. For example a mobile client may request to perform one or more identity management operations associated with an account of a service provider. Based at least in part on the requested operation and/or the particular service provider, an application programming interface (API) may be utilized to generate and/or perform one or more instructions and/or method calls for managing identity information of the service provider.

Claims

1. A system, comprising:

a memory storing a plurality of instructions; and

one or more hardware processors configured to access the memory, wherein the one or more hardware processors are further configured to execute the plurality of instructions to;

receive, from a mobile client application of a mobile device, an access request for requesting access to an access management service provider;

determine, based at least in part on the access request, an access management service call for accessing an access management service corresponding to the access management service provider;

receive, from the access management service provider, a mobile client token and a user token based at least in part on the access request;

provide, to the mobile client application, the mobile client token and the user token;

receive, from the mobile device, an access token request, the access token request identifying the mobile client token, the user token, and a resource to be accessed at an application service provider different from the access management service provider;

provide, to the access management service provider, the access token request;

receive, from the access management service provider, based at least in part on the access token request, an access token for accessing the resource at the application service provider; and

cause the mobile client application to perform a function associated with the application service provider based at least in part on the received access token.

2. The system of claim 1, wherein the mobile client application comprises a software as a service (SaaS) application, or a Rich Internet Application (RIA).

3. The system of claim 1, wherein the access request comprises an authentication request, an authorization request, a user profile management request, a policy management request, or a password management request.

4. The system of claim 3, wherein the authentication request includes a user identifier (ID) associated with a user of the mobile client application, a password associated with the user of the mobile client application, and the mobile client token for indicating that the mobile client application is authenticated, and wherein the user ID and the password are configured for authenticating the user with the access management service.

5. The system of claim 1, wherein the access management service call comprises a method call to implement a token exchange.

6. The system of claim 1, further comprising instructions to determine the access management service call based on an Application Programming Interface (API) of the access management service provider for which the access request is requested.

7. The system of claim 1, wherein the access request further includes an indication of the access management service provider for which access is requested, wherein the mobile client token indicates that the mobile client application is authenticated and the user token indicates that a user of the mobile client application is authenticated.

8. The system of claim 7, wherein the one or more hardware processors are further configured to provide the access token to the mobile client application at least in response to receiving an indication that the user and the client application are granted access to the access management service provider by the access management service.

9. The system of claim 1, wherein a first access management service call corresponding to a first service provider is different from a second access management service call corresponding to a second service provider.

10. The system of claim 1, wherein the access management service to be used is specified by the access management service provider and not indicated to the mobile client application.

11. A computer-implemented method, comprising:

receiving, by a computer system, an access request for accessing a third-party server, the access request received from a mobile client application of a mobile device;

determining, by the computer system, an access management service call corresponding to the third-party server for which access is requested, the determining based at least in part on the access request received from the mobile client application;

receiving, from the third-party server, a mobile client token and a user token based at least in part on the access request;

providing, to the mobile client application, the mobile client token and the user token;

receiving, from the mobile device, an access token request, the access token request identifying the mobile client token, the user token, and a resource to be accessed at an application service provider different from the third-party server;

providing, to the third-party server, the access token request;

receiving, from the third-party server, based at least in part on the access token request, an access token for accessing the resource at the application service provider;

providing, by the computer system, the access token to the mobile client application; and

causing the mobile client application to perform a function associated with the application service provider based at least in part on the received access token.

12. The computer-implemented method of claim 11, wherein the mobile client application comprises a rich Internet application, or a software as a service application.

13. The computer-implemented method of claim 11, wherein the request to access the third-party server is received as a representational state transfer (REST) call independent of an application programming interface (API) of the third-party server for which access is requested.

14. The computer-implemented method of claim 11, further comprising determining, based at least in part on an application programming interface (API) of the third-party server, a predefined manner for providing the access token request.

15. A computer-readable memory storing a plurality of instructions executable by one or more hardware processors, the plurality of instructions comprising:

instructions that cause the one or more hardware processors to receive, from a mobile client application of a mobile device, a first method call for requesting access to a service provider;

instructions that cause the one or more hardware processors to determine, based at least in part on the first method call from the mobile client application, a second method call for utilizing an access management service associated with the service provider;

instructions that cause the one or more hardware processors to receive from the service provider, a mobile client token and a user token based at least in part on the first method call for requesting access;

instructions that cause the one or more hardware processors to provide, to the mobile client application, the mobile client token and the user token;

instructions that cause the one or more hardware processors to receive, from the mobile device, an access token request, the access token request identifying the mobile client token, the user token, and a resource to be accessed at an application service provider different from the service provider;

instructions that cause the one or more hardware processors to provide, to the service provider, the access token request;

instructions that cause the one or more hardware processors to receive, from the service provider, based at least in part on the access token request, an access token for accessing the resource at the application service provider; and

instructions that cause the one or more hardware processors to provide the access token to the mobile client application to enable the mobile client application to perform a function associated with the service provider based at least in part on the access token.

16. The computer-readable memory of claim 15, wherein the first method call for requesting access to the service provider comprises a representational state transfer (REST) call and includes at least a request to authenticate the user of the mobile client application.

17. The computer-readable memory of claim 15, further comprising instructions that cause the one or more hardware processors to determine a format for transmission of the second method call based at least in part on an application programming interface (API) of the access management service.

18. The computer-readable memory of claim 17, wherein a first format of a first set of method calls for a first access management service are different from a second format of a second set of method calls for a second access management service.

19. The computer-readable memory of claim 15, wherein the access management service is configured to receive method calls other than representational state transfer (REST) interface calls.

20. The computer-readable memory of claim 15, wherein the second method call comprises a request to authenticate a user of the mobile client application, a request to authorize the user of the mobile client application, or a request to perform a token exchange for providing user access to the service provider.