System and method for multi-tenant SSO with dynamic attribute retrieval

• US 10,749,856 B2
• Filed: 11/22/2017
• Issued: 08/18/2020
• Est. Priority Date: 11/23/2016
• Status: Active Grant

• Current Assignee: Cloudblue LLC
• Original Assignee: Ingram Micro Incorporated (HNA Technology Co. Ltd.)
• Inventors: Kostyukov, Andrey, Kuzkin, Maxim
• Primary Examiner(s): Lwin, Maung T
• Application Number:
  US15/821,375
• Publication Number:
  US 20180167378A1
• Time in Patent Office: 1,000 Days
• Field of Search: None
• CPC Class Codes: G06F 9/44526 Plug-ins; Add-ons
• CPC Class Codes: G06F 9/547 Remote procedure calls [RPC]; Web services
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A system and method for multi-tenant single sign-on (SSO) identity management with dynamic attribute retrieval, the system includes at least one service provider, at least one service provider plug-in, and a service automation platform. A method for multi-tenant SSO identity management with dynamic attribute retrieval, includes the steps of receiving a link to a service provider at an SSO dispatcher, the SSO dispatcher identifying a service, requesting at the SSO dispatcher, user attributes for the at least one service provider, assembling at a service provider handler implementation, a response query, retrieving identity provider credentials from the service automation platform, signing at the SSO dispatcher, a package for a user'"'"'s authentication, and redirecting the package to the service provider.

Claims

1. A method for multi-tenant SSO identity management with dynamic attribute retrieval, the method utilizing a system comprising at least one service provider, at least one service provider plug-in, and a service automation platform, the at least one service provider plug-in further comprising a service provider handler implementation, and the service automation platform further comprising a single sign-on (SSO) dispatcher, the method comprising the steps:

a. activating, by a user, a link to a service provided by the at least one service provider;

b. receiving at an SSO dispatcher, the link activated by the user;

c. identifying by the SSO dispatcher the service provided by the at least one service provider;

d. requesting at the SSO dispatcher, user attributes for the at least one service provider from a service provider handler;

e. assembling at a service provider handler implementation, a response query with the user attributes, the user attributes assembled according to a user attributes schema and service provider settings;

f. checking at the SSO dispatcher, whether the response query is a success, and if successful, proceeding to the next step, and if unsuccessful, displaying a message;

g. checking at the SSO dispatcher, whether the response query includes identification of an identity provider, and if the response query does not include identification of an identity provider, retrieving public identity provider credentials from the service automation platform, and if the response query is successful, proceeding to the next step;

h. determining at the SSO dispatcher, whether the response query identifies a managed identity provider, or an exclusive identity provider, and requesting the respective identity provider'"'"'s credentials identified herein;

i. signing at the SSO dispatcher, a package for a user'"'"'s authentication with the credentials;

j. redirecting at the SSO dispatcher, the package to the service provider.

2. The method of claim 1, wherein the user attributes is selected from a group consisting of a username, email address, address, subscription id, tenant id, and zip-code.

3. The method of claim 1, wherein the service provider settings are set by the service provider and stored in a user data storage.

4. The method of claim 1, wherein the service provider settings comprises information about a virtualized identity provider selected from a group consisting of a virtualized public identity provider, virtualized managed identity provider, or virtualized exclusive identity provider.

5. The method of claim 3, wherein the service provider settings further comprises of information about an SSO protocol.

6. The method of claim 1 further comprising the step allowing a user to log in to the service provider, using the package.