Method and system for externalized HTTP authentication

• US 20060021004A1
• Filed: 07/21/2004
• Published: 01/26/2006
• Est. Priority Date: 07/21/2004
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hinton, Heather Maria, Moran, Anthony Scott, Harmon, Benjamin B., Eaton, Brian
• Application Number:
  US10/896,314
• Publication Number:
  US 20060021004A1
• Time in Patent Office: Days
• US Class Current: 726/2
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A method is presented for providing an HTTP-based authentication mechanism. A request for a controlled resource is received from a client at a first server, which sends a request for an uncontrolled resource to a second server, which may be an HTTP-based authentication server, e.g., by redirecting a request via the client to the second server or by forwarding a request directly to the second server. The second server then obtains authentication information from the client. The second server returns the authentication credential or the authenticated identify to the first server within a response message, e.g., by storing the authentication credential within one or more HTTP headers. In response to receiving the authentication information, the first server builds a session for the client and processes the original request for the controlled resource, e.g., by sending a redirection for the controlled resource through the client.

Claims

1. A method of performing an authentication operation within a data processing system, the method comprising:

receiving a request message for a controlled resource from a client at a first server;

invoking a second server to generate an authentication credential or an authenticated identity; and

receiving the authentication credential or the authenticated identity from the second server at the first server within a response message.

2. The method of claim 1 wherein the first server and the second server are supported within the same domain.

3. The method of claim 1 wherein the response message is an HTTP (HyperText Transport Protocol) response message.

4. The method of claim 3 further comprising:

in response to receiving the authentication credential or the authenticated identity at the first server, extracting the authentication credential or the authenticated identity from one or more HTTP headers in the HTTP response message.

5. The method of claim 1 further comprising:

in response to receiving the authentication credential or the authenticated identity at the first server, sending a first redirection message to the client from the first server, wherein the redirection message indicates a URI (Uniform Resource Identifier) for the controlled resource as the redirection URI.

6. The method of claim 1 further comprising:

in response to receiving the authentication credential or the authenticated identity at the first server, accessing the controlled resource; and

sending results from accessing the controlled resource to the client from the first server.

7. The method of claim 1 further comprising:

in response to receiving the authentication credential or the authenticated identity at the first server, building a session for the client at the first server.

8. The method of claim 7 further comprising:

receiving a subsequent request for a different controlled resource from the client at the first server; and

responding to the subsequent request without requiring the client to perform another authentication operation.

9. The method of claim 1 further comprising:

in response to a determination that responding to the request message for the controlled resource requires an authentication operation, sending a second redirection message for an uncontrolled resource at the second server to the client by the first server.

10. The method of claim 9 further comprising:

in response to receiving a request message for the uncontrolled resource from the client at the second server as redirected by the first server, sending a prompting response message from the second server to the client, wherein the prompting response message prompts a user of the client to provide authentication information from which to generate the authentication credential or the authenticated identity.

11. The method of claim 10 wherein the prompting response message comprises a web page.

12. The method of claim 10 wherein prompting response message comprises an HTML (HyperText Markup Language) form.

13. The method of claim 9 further comprising:

in response to receiving the authentication information at the second server from the client, generating the authentication credential or the authenticated identity; and

sending the authentication credential or the authenticated identity from the second server to the first server.

14. The method of claim 1 further comprising:

in response to a determination that responding to the request message for the controlled resource requires an authentication operation, sending a request message for an uncontrolled resource to the second server by the first server.

15. The method of claim 14 further comprising:

in response to receiving the request message for the uncontrolled resource from the first server at the second server, sending a prompting response message from the second server to the client, wherein the prompting response message prompts a user of the client to provide authentication information from which to generate the authentication credential or the authenticated identity.

16. An apparatus for performing an authentication operation within a data processing system, the apparatus comprising:

means for receiving a request message for a controlled resource from a client at a first server;

means for invoking a second server to generate an authentication credential or an authenticated identity; and

means for receiving the authentication credential or the authenticated identity from the second server at the first server within a response message.

17. The apparatus of claim 16 wherein the first server and the second server are supported within the same domain.

18. The apparatus of claim 16 wherein the response message is an HTTP (HyperText Transport Protocol) response message.

19. The apparatus of claim 18 further comprising:

means for extracting the authentication credential or the authenticated identity from one or more HTTP headers in the HTTP response message in response to receiving the authentication credential or the authenticated identity at the first server.

20. The apparatus of claim 16 further comprising:

means for sending a first redirection message to the client from the first server, wherein the redirection message indicates a URI (Uniform Resource Identifier) for the controlled resource as the redirection URI in response to receiving the authentication credential or the authenticated identity at the first server.

21. The apparatus of claim 16 further comprising:

means for accessing the controlled resource in response to receiving the authentication credential or the authenticated identity at the first server; and

means for sending results from accessing the controlled resource to the client from the first server.

22. The apparatus of claim 16 further comprising:

means for building a session for the client at the first server in response to receiving the authentication credential or the authenticated identity at the first server.

23. The apparatus of claim 22 further comprising:

means for receiving a subsequent request for a different controlled resource from the client at the first server; and

means for responding to the subsequent request without requiring the client to perform another authentication operation.

24. The apparatus of claim 16 further comprising:

means for sending a second redirection message for an uncontrolled resource at the second server to the client by the first server in response to a determination that responding to the request message for the controlled resource requires an authentication operation.

25. The apparatus of claim 24 further comprising:

means for sending a prompting response message from the second server to the client in response to receiving a request message for the uncontrolled resource from the client at the second server as redirected by the first server, wherein the prompting response message prompts a user of the client to provide authentication information from which to generate the authentication credential or the authenticated identity.

26. The apparatus of claim 25 wherein the prompting response message comprises a web page.

27. The apparatus of claim 25 wherein prompting response message comprises an HTML (HyperText Markup Language) form.

28. The apparatus of claim 24 further comprising:

means for generating the authentication credential or the authenticated identity in response to receiving the authentication information at the second server from the client; and

means for sending the authentication credential or the authenticated identity from the second server to the first server.

29. The apparatus of claim 16 further comprising:

means for sending a request message for an uncontrolled resource to the second server by the first server in response to a determination that responding to the request message for the controlled resource requires an authentication operation.

30. The apparatus of claim 29 further comprising:

means for sending a prompting response message from the second server to the client in response to receiving the request message for the uncontrolled resource from the first server at the second server, wherein the prompting response message prompts a user of the client to provide authentication information from which to generate the authentication credential or the authenticated identity.

31. A computer program product on a computer readable medium for use in a data processing system for performing an authentication operation, the computer program product comprising:

means for receiving a request message for a controlled resource from a client at a first server;

means for invoking a second server to generate an authentication credential or an authenticated identity; and

means for receiving the authentication credential or the authenticated identity from the second server at the first server within a response message.

32. The computer program product of claim 31 wherein the first server and the second server are supported within the same domain.

33. The computer program product of claim 31 wherein the response message is an HTTP (HyperText Transport Protocol) response message.

34. The computer program product of claim 33 further comprising:

means for extracting the authentication credential or the authenticated identity from one or more HTTP headers in the HTTP response message in response to receiving the authentication credential or the authenticated identity at the first server.

35. The computer program product of claim 31 further comprising:

means for sending a first redirection message to the client from the first server, wherein the redirection message indicates a URI (Uniform Resource Identifier) for the controlled resource as the redirection URI in response to receiving the authentication credential or the authenticated identity at the first server.

36. The computer program product of claim 31 further comprising:

means for accessing the controlled resource in response to receiving the authentication credential or the authenticated identity at the first server; and

means for sending results from accessing the controlled resource to the client from the first server.

37. The computer program product of claim 31 further comprising:

means for building a session for the client at the first server in response to receiving the authentication credential or the authenticated identity at the first server.

38. The computer program product of claim 37 further comprising:

means for receiving a subsequent request for a different controlled resource from the client at the first server; and

means for responding to the subsequent request without requiring the client to perform another authentication operation.

39. The computer program product of claim 31 further comprising:

means for sending a second redirection message for an uncontrolled resource at the second server to the client by the first server in response to a determination that responding to the request message for the controlled resource requires an authentication operation.

40. The computer program product of claim 39 further comprising:

means for sending a prompting response message from the second server to the client in response to receiving a request message for the uncontrolled resource from the client at the second server as redirected by the first server, wherein the prompting response message prompts a user of the client to provide authentication information from which to generate the authentication credential or the authenticated identity.

41. The computer program product of claim 40 wherein the prompting response message comprises a web page.

42. The computer program product of claim 40 wherein prompting response message comprises an HTML (HyperText Markup Language) form.

43. The computer program product of claim 39 further comprising:

means for generating the authentication credential or the authenticated identity in response to receiving the authentication information at the second server from the client; and

means for sending the authentication credential or the authenticated identity from the second server to the first server.

44. The computer program product of claim 31 further comprising:

means for sending a request message for an uncontrolled resource to the second server by the first server in response to a determination that responding to the request message for the controlled resource requires an authentication operation.

45. The computer program product of claim 44 further comprising:

means for sending a prompting response message from the second server to the client in response to receiving the request message for the uncontrolled resource from the first server at the second server, wherein the prompting response message prompts a user of the client to provide authentication information from which to generate the authentication credential or the authenticated identity.