Method and apparatus for authenticating users

• US 20010037469A1
• Filed: 04/18/2001
• Published: 11/01/2001
• Est. Priority Date: 05/11/1999
• Status: Active Grant

• Current Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Gupta, Abhay, Ferris, Chris, Abdelnur, Alejandro
• Granted Patent: US 6,763,468 B2
• Time in Patent Office: Days
• US Class Current: 713/202
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A method and apparatus for authenticating users. Prior art mechanisms require each individual application (running on an “application server”) that the user is accessing to provide for the ability to use the various authentication mechanisms. One or more embodiments of the invention externalize the authentication mechanism from the application in the form of a login server. Only the login server needs to be configured to handle authentication mechanisms. The application server checks if a request has an active and valid session (e.g., a valid session may exist when there is active communication between a client and server that has not expired). If there is not a valid session, the application server redirects the user to the login server. The login server attempts to authenticate the user using any desired authentication mechanism. Once authenticated, the login server redirects the user back to the application server. The application server verifies the authentication directly with the login server. Once verified, the application server processes the user'"'"'s request and responds accordingly. One or more embodiments of the invention may utilize cookies to aid in the authentication process. Thus, applications on the application server need not be concerned about authenticating a given user. The application server merely knows how to work with the login server to authenticate the user. Further, communications between the application server and login server are transparent (or without any interaction from) the user (although the user may see the browser communicating with each server).

Claims

1. A method of authenticating requests:

a requester transmitting a request to a first server;

said first server redirecting said request to a second server;

said second server authenticating said requester; and

said second server redirecting said request to said first server.

2. The method of

claim 1

further comprising creating a session if said authenticating is successful.

3. The method of

claim 2

wherein said first server redirects said request to a second server when a valid session does not exist.

4. The method of

claim 1

further comprising:

said first server redirecting said request to a second server with a temporary identifier;

said second server storing said temporary identifier; and

said first server verifying authentication with said second server utilizing said temporary identifier.

5. The method of

claim 1

wherein said second server authenticating said requestor comprises:

obtaining a cookie from said requester; and

indicating a successful authentication if said cookie is valid.

6. The method of

claim 1

wherein said second server authenticates said requester using a username and password mechanism.

7. The method of

claim 1

wherein said second server authenticates said requester using a challenge-response mechanism.

8. The method of

claim 1

wherein said second server authenticates said requestor using a smartcard mechanism.

9. The method of

claim 1

wherein said step of said second server authenticating said requester comprises:

obtaining authentication information from said requester; and

determining if said authentication information is valid.

10. The method of

claim 1

further comprising said first server transmitting a response to said requester.

11. The method of

claim 2

further comprising:

said requestor transmitting a request to logout and a cookie to said first server; and

said first server invalidating said session if said cookie is valid.

12. A system comprising

a requester;

a first server configured to process a request from said requester and redirect said requestor to a second server; and

said second server configured to authenticate said requester and redirect said requestor to said first server.

13. The system of

claim 12

further comprising a session service configured to create a session if said authentication by said second server is successful.

14. The system of

claim 13

wherein said first server redirects said request to a second session when a valid session does not exist.

15. The system of

claim 12

further comprising:

said first server configured to transmit a temporary identifier with said redirection to a second server;

said second server configured to store said temporary identifier; and

said first server further configured to verify authentication with said second server utilizing said temporary identifier.

16. The system of

claim 12

wherein said second server is configured to:

obtain a cookie from said requester; and

indicate a successful authentication if said cookie is valid.

17. The system of

claim 12

wherein said second server authenticates said requestor using a username and password mechanism.

18. The system of

claim 12

wherein said second server authenticates said requester challenge-response mechanism.

19. The system of

claim 12

wherein said second server authenticates said requestor using a smartcard mechanism.

20. The system of

claim 12

wherein said second server is configured to:

obtain authentication information from said requester; and

determine if said authentication information is valid.

21. The system of

claim 13

further comprising:

said requestor configured to transmit a request to logout and a cookie to said first server; and

said session service configured to invalidate said session if said cookie is valid.

22. A computer program product comprising:

a computer usable medium having computer readable program code embodied therein configured to authenticate requests, said computer program product comprising;

computer readable program code configured to cause a computer to request information from a first server;

computer readable program code configured to cause said first server to redirect said request to a second server;

computer readable program code configured to cause said second server to authenticate a requester of said information; and

computer readable program code configured to cause said second server to redirect said request to said first server.

23. The computer program product of

claim 22

further comprising computer readable program code configured to cause a computer to create a session if said authentication by said second server is successful.

24. The computer program product of

claim 23

wherein said computer readable program code configured to cause said first server to redirect said request to a second server comprises computer readable program code configured to cause said first server to redirect said request to a second server when a valid session does not exist.

25. The computer program product of

claim 22

further comprising:

computer readable program code configured to cause said first server to transmit a temporary identifier to said second server;

computer readable program code configured to cause said second server to store said temporary identifier; and

computer readable program code configured to cause said first server to verify authentication with said second server utilizing said temporary identifier.

26. The computer program product of

claim 22

wherein said computer readable program code configured to cause said second server to authenticate said requestor comprises:

computer readable program code configured to cause said second server to obtain a cookie from said requester; and

computer readable program code configured to cause a computer to indicate a successful authentication if said cookie is valid.

27. The computer program product of

claim 22

wherein said computer readable program code configured to cause said second server to authenticate said requestor comprises computer readable program code configured to utilize a username and password mechanism to authenticate said requestor.

28. The computer program product of

claim 22

wherein said computer readable program code configured to cause said second server to authenticate said requestor comprises computer readable program code configured to utilize a challenge-response mechanism to authenticate said requester.

29. The computer program product of

claim 22

wherein said computer readable program code configured to cause said second server to authenticate said requester comprises computer readable program code configured to utilize a smartcard mechanism to authenticate said requester.

30. The computer program product of

claim 22

wherein said computer readable program code configured to cause said second server to authenticate said requestor comprises:

computer readable program code configured to cause a computer to obtain authentication information from said requester; and

computer readable program code configured to cause a computer to determine if said authentication information is valid.

31. The computer program product of

claim 22

further comprising computer readable program code configured to cause said first server to transmit a response to a requestor of said information.

32. The computer program product of

claim 23

further comprising:

computer readable program code configured to cause a computer to transmit a request to logout and a cookie to said first server; and

computer readable program code configured to cause a computer to invalidate said session if said cookie is valid.

33. A system for authenticating requests comprising:

a first means for processing a request from a requester;

said first means redirecting said request to a second means;

said second means authenticating said requestor; and

said second means redirecting said request to said first means.