System and method for delegating a user authentication process for a networked application to an authentication agent

• US 20040168090A1
• Filed: 02/26/2004
• Published: 08/26/2004
• Est. Priority Date: 10/12/1999
• Status: Active Grant

• Current Assignee: WebMD Health Corporation
• Original Assignee: WebMD Health Corporation
• Inventors: Speeter, Tom, Chawla, Rajeev, Framba, Marco, Talla, Venky
• Granted Patent: US 7,877,492 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/0281 Proxies

Abstract

A system and method for delegating a user authentication process for a networked application to an authentication proxy. A networked application may request a user to provide authentication information in order to access the application. Upon receiving this authentication information from the user, the client side of the networked application sends the information to the server side of the networked application. The server side of the application may then determine an appropriate authentication agent associated with the user to delegate the authentication process to. For example, for each application user, the server side of the application may maintain information associated with the user, such as the user'"'"'s employer. The application may then match this employer information to an authentication agent running in the employer'"'"'s network domain, and the authentication process may then be delegated to this authentication agent.

Claims

1. A method for authenticating a user of a networked application, wherein the networked application has a client side and a server side, the method comprising:

the server side of the networked application receiving authentication information for the user from the client side of the networked application;

the server side of the networked application determining an appropriate authentication agent to contact for authenticating the user;

the server side of the networked application passing the authentication information to the authentication agent;

the authentication agent using the authentication information to attempt to authenticate the user;

the authentication agent communicating the results of the authentication attempt to the server side of the networked application;

the server side of the networked application authorizing the user to access the networked application if the authentication attempt was successful.

2. The method of claim 1,

wherein the authentication information passed to the authentication agent comprises account information for the user,

wherein said authentication agent using the authentication information to attempt to authenticate the user comprises the authentication agent passing the account information to a network computer system with which the authentication agent is associated;

wherein, in response to receiving the account information from the authentication agent, the network computer system uses the account information to verify that the network computer system has a user account matching the account information.

3. The method of claim 2,

wherein the account information for the user comprises a username and password.

4. The method of claim 2,

wherein the server side of the networked application stores information associated with the user;

wherein the server side of the networked application uses the authentication information received from the client side of the networked application to access the information associated with the user,

wherein the information associated with the user comprises information regarding a group of which the user is a member;

wherein the server side of the networked application stores information regarding an authentication agent associated with the group of which the user is a member;

wherein the server side of the networked application passes the authentication information to the authentication agent associated with the group of which the user is a member.

5. The method of claim 4,

wherein the group of which the user is a member is the user'"'"'s employer.

6. The method of claim 2,

wherein the network computer system is a network computer system from the group consisting of:

a Windows NT system and a Unix system.

7. The method of claim 1, further comprising:

the server side of the networked application determining whether the server side of the networked application stores authentication credentials for the user;

the server side of the networked application attempting to authenticate the user using the user'"'"'s stored authentication credentials if authentication credentials for the user are stored by the server side of the networked application;

the server side of the networked application passing the authentication information to the authentication agent in order to authenticate the user if authentication credentials for the user are not stored by the server side of the networked application.

8. A system for authenticating a user of a networked application, the system comprising:

a first computer system running software associated with a client side of a networked application;

a second computer system connected to the first computer system via a network, wherein the second computer system runs software associated with a server side of the detworked application;

a third computer system connected to the second computer system via a network, wherein the third computer system runs an authentication agent;

wherein the software associated with the server side of the networked application is operable to;

receive authentication information for the user from the software, associated with the client side of the networked application;

determine that the authentication agent running on the third computer system should be contacted in order to authenticate the user;

pass the authentication information to the authentication agent;

wherein the authentication agent is operable to;

use the authentication information to attempt to authenticate the user;

communicate the results of the authentication attempt to the software associated with the server side of the networked application;

wherein the software associated with the server side of the networked application is operable to authorize the user to access the networked application if the authentication attempt was successful.

9. The system of claim 8,

wherein the authentication information passed to the authentication agent comprises account information for the user;

wherein said authentication agent using the authentication information to attempt to authenticate the user comprises the authentication agent passing the account information to a network computer system with which the authentication agent is associated;

wherein, in response to receiving the account information from the authentication agent, the network computer system is operable to use the account information to verify that the network computer system has a user account matching the account information.

10. The system of claim 9,

wherein the account information for the user comprises a username and password.

11. The system of claim 9,

wherein the second computer system includes a memory storing information associated with the user;

wherein the software associated with the server side of the networked application is operable to use the authentication information received from the software associated with the client side of the networked application in order to access the information associated with the user;

wherein the information associated with the user comprises information regarding a group of which the user is a member,

wherein the memory of the second computer system also stores information specifying an authentication agent associated with the group of which the user is a member;

wherein the software associated with the server side of the networked application is operable to access the memory to determine the authentication agent associated with the group of which the user is a member and is operable to pass the authentication information to the authentication agent associated with the group of which the user is a member.

12. The system of claim 11,

wherein the group of which the user is a member is the user'"'"'s employer.

13. The system of claim 9,

wherein the network computer system is a network computer system from the group consisting of:

a Windows NT system and a Unix system.

14. The system of claim 8,

wherein the second computer system includes a memory storing authentication credentials for a plurality of users;

wherein the software associated with the server side of the networked application is operable to;

access the memory in order to determine whether the memory stores authentication credentials for the user;

attempt to authenticate the user using the stored authentication credentials for the user if authentication credentials for the user are stored on the memory;

pass the authentication information to the authentication agent in order to authenticate the user if authentication credentials for the user are not stored on the memory.