Push Artifact Binding For Communication In A Federated Identity System

• US 20090187974A1
• Filed: 10/30/2008
• Published: 07/23/2009
• Est. Priority Date: 01/18/2008
• Status: Active Grant

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Rouault, Jason, Tulshibagwale, Atul
• Granted Patent: US 8,302,168 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A data processing system implements push artifact binding for communication in a federated identity system. A federated identity system in the data processing system comprises an initiator that handles a federated action by determining that a user is to be conveyed to a recipient, constructing an appropriate message request or assertion to be sent to the recipient, and sending the message as a push message over a back-channel communication pathway directed to the recipient'"'"'s location. The federated identity system further comprises a recipient that handles the federated action by responding to the message by forming a Uniform Resource Locator (URL) to which the user can be directed. The initiator redirects the user to the URL specified in the recipient response.

Claims

1. A data processing system comprising:

a federated identity system comprising;

an initiator that handles a federated action by determining that a user is to be conveyed to a recipient, constructing an appropriate message request or assertion to be sent to the recipient, and sending the message as a push message over a back-channel communication pathway directed to the recipient'"'"'s location; and

a recipient that handles the federated action by responding to the message by forming a Uniform Resource Locator (URL) to which the user can be directed, the initiator redirecting the user to the URL specified in the recipient response.

2. The system according to claim 1 further comprising:

the federated identity system configured for artifact binding that first uses the back-channel communication pathway for communicating the push message whereby redirection is pushed by the initiator to the recipient, followed by redirecting the user.

3. The system according to claim 1 further comprising:

a web browser for operation by the user;

an identity provider (IDP) for operation as the initiator or the recipient; and

a service provider (SP) for operation as the recipient or the initiator, whereby for an IDP initiator the recipient is SP and for an SP initiator the recipient is IDP.

4. The system according to claim 3 further comprising:

at least one intermediary comprising a federation router, broker, or proxy that for communication from the initiator to the recipient.

5. The system according to claim 1 further comprising:

the recipient that further handles the federated action by combining a unique identifier equivalent to an artifact binding into the Uniform Resource Locator (URL) to which the user can be directed.

6. The system according to claim 1 further comprising:

a first recipient, a second recipient, and an intermediary;

the first recipient configured to handle the federated action by determining that the user is to be conveyed to the second recipient whereby the first recipient is operative as an intermediary, and sending the message over the back-channel communication pathway directed to the second recipient'"'"'s location, whereby a back-channel response from the second recipient that contains a Uniform Resource Locator (URL) is propagated to the initiator; and

the initiator configured to redirect the user with only a single redirect to the URL received in the back-channel response of the second recipient conveyed to the initiator by the intermediary.

7. The system according to claim 6 further comprising:

the intermediary configured to handle the federated action by determining that the user is to be conveyed to an additional recipient, sending the message over the back-channel communication pathway directed to the additional recipient'"'"'s location, and performing the determining and sending actions for at least one additional recipient to a final recipient, whereby a back-channel response from the at least one additional recipient is propagated back to the initiator over the back-channel communication pathway and the initiator then redirects the user with only a single redirect of the user to the URL specified in the response of the final recipient.

8. The system according to claim 1 further comprising:

a final recipient; and

a potentially unlimited number of intermediaries configured for propagating from the final recipient through to the initiator with only a single redirect of the user.

9. The system according to claim 1 wherein:

the back-channel communication pathway conforms to a Simple Object Access Protocol (SOAP).

10. A computer-executed method for communicating in a federated identity system comprising:

handling a federated action at an initiator comprising;

determining that a user Is to be conveyed to a recipient;

constructing an appropriate message request or assertion to be sent to the recipient; and

sending the message over a back-channel communication pathway directed to the recipient'"'"'s location;

handling the federated action at the recipient comprising;

responding to the message by forming a Uniform Resource Locator (URL) to which the user can be directed; and

further handling the federated action at the initiator comprising;

redirecting the user to the URL specified in the recipient response.

11. The method according to claim 10 further comprising:

handling the federated action at the recipient further comprising;

combining a unique identifier equivalent to an artifact binding into the Uniform Resource Locator (URL) to which the user can be directed.

12. The method according to claim 10 further comprising:

handling the federated action at the recipient that is a first recipient further comprising;

determining that the user is to be conveyed to a second recipient whereby the first recipient is operative as an intermediary; and

sending the message over the back-channel communication pathway directed to the second recipient'"'"'s location, whereby a back-channel response from the second recipient is propagated to the initiator.

13. The method according to claim 12 further comprising:

handling the federated action at the intermediary further comprising;

determining that the user is to be conveyed to an additional recipient;

sending the message over the back-channel communication pathway directed to the additional recipient'"'"'s location; and

performing the determining and sending actions for at least one additional recipient to a final recipient, whereby a back-channel response from the at least one additional recipient is propagated to the initiator.

14. The method according to claim 10 wherein:

the user is an end-user acting with a web browser;

the initiator is an identity provider (IDP) or a service provider (SP); and

the recipient is a service provider (SP) or an identity provider (IDP) whereby for an IDP initiator the recipient is SP and for an SP initiator the recipient is IDP.

15. The method according to claim 14 further comprising:

the initiator and the recipient communicate via at least one intermediary that is a federation router, broker, or proxy.

16. The method according to claim 10 further comprising:

propagating from a final recipient through a potentially unlimited number of intermediaries to the initiator with only a single redirect of the user.

17. The method according to claim 10 further comprising:

replacing a plurality of Uniform Resource Locators (URLs) for a corresponding plurality of federation node services by a single address for a back-channel communication service URL whereby the user is redirected to one of the URL plurality as specified in the response by the recipient and redirection URLs are specified dynamically in the response by the recipient of the backchannel communication.

18. The method according to claim 10 wherein:

the back-channel communication pathway conforms to a Simple Object Access Protocol (SOAP).

19. An article of manufacture comprising:

a controller-usable medium having a computer readable program code embodied in a distributed controller executable in an initiator and a recipient for communicating in a federated identity system, the computer readable program code further comprising;

code executable in an initiator causing the controller to determine that a user is to be conveyed to a recipient;

code executable in the initiator causing the controller to construct an appropriate message request or assertion to be sent to the recipient;

code executable in the initiator causing the controller to send the message over a back-channel communication pathway directed to the recipient'"'"'s location;

code executable in the recipient causing the controller to respond to the message by forming a Uniform Resource Locator (URL) to which the user can be directed;

code executable in the recipient causing the controller to combine a unique identifier equivalent to an artifact binding into the Uniform Resource Locator (URL) to which the user can be directed; and

code executable in the initiator causing the controller to redirect the user to the URL specified in the recipient response.

20. The article of manufacture according to claim 19 further comprising:

code in a distributed controller executable in the initiator and at least one recipient;

code executable in a first recipient causing the controller to determine that the user is to be conveyed to a second recipient whereby the first recipient is operative as an intermediary; and

code executable in the first recipient causing the controller to send the message over the back-channel communication pathway directed to the second recipient'"'"'s location, whereby a back-channel response from the second recipient is propagated to the initiator.

21. The article of manufacture according to claim 20 further comprising:

code executable in the intermediary causing the controller to determine that the user is to be conveyed to an additional recipient;

code executable in the intermediary causing the controller to send the message over the back-channel communication pathway directed to the additional recipient'"'"'s location, and

code executable in the intermediary causing the controller to determine conveyance of the user to an additional recipient and send the message for at least one additional recipient to a final recipient, whereby a back-channel response from the at least one additional recipient is propagated to the initiator.