Identity provider discovery service using a publish-subscribe model

• US 20130227140A1
• Filed: 03/01/2013
• Published: 08/29/2013
• Est. Priority Date: 12/03/2010
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hinton, Heather Maria, McCarty, Richard James, Looney, Clifton Steve
• Granted Patent: US 9,596,123 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/563 Data redirection of data network streams
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching

Abstract

A proxy is integrated within an F-SSO environment and interacts with an external identity provider (IdP) instance discovery service. The proxy proxies IdP instance requests to the discovery service and receives responses that include the IdP instance assignments. The proxy maintains a cache of the instance assignment(s). As new instance requests are received, the cached assignment data is used to provide appropriate responses in lieu of proxying these requests to the discovery service, thereby reducing the time needed to identify the required IdP instance. The proxy dynamically maintains and manages its cache by subscribing to updates from the discovery service. The updates identify IdP instance changes (such as servers being taken offline for maintenance, new services being added, etc.) occurring within the set of geographically-distributed instances that comprise the IdP service. The updates are provided via a publication-subscription model such that the proxy receives change notifications proactively.

Claims

1. A method for providing identity provider services using an identity provider instance discovery service, comprising:

as requests for identity provider instances are processed by the discovery service, receiving and storing data identifying the identity provider instances;

receiving an update concerning a resource associated with the directory service, the update received via a publish-subscribe notification service supported on a hardware element;

based on the update, modifying the data; and

upon receipt a new request for an identity provider instance, using the modified data to identify an identity provider instance for use in responding to the new request.

2. The method as described in claim 1 wherein the data is assignment data that associates a request and an identity provider instance selected by the discovery service to service the request.

3. The method as described in claim 1 wherein the update is receiving periodically or asynchronously.

4. The method as described in claim 1 wherein the notification service is a Web service provided by the identity provider instance discovery service.

5. The method as described in claim 1 further including subscribing to the update.

6. The method as described in claim 1 wherein the update includes one of:

a load associated with one or more of the identity provider instances, availability of one or more identity provider instances, a performance metric associated with one or more identity provider instances, and an existing binding associated with one or more identity provider instances.

7. The method as described in claim 1 wherein the data is modified according to a policy or business logic.