BUNDLED AUTHORIZATION REQUESTS

• US 20150089569A1
• Filed: 04/30/2014
• Published: 03/26/2015
• Est. Priority Date: 09/29/2011
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Sondhi, Ajay, Chu, Ching-Wen, Evani, Venkata S.
• Granted Patent: US 9,699,170 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/06 Authentication

Abstract

A framework, which conforms to the OAuth standard, involves a generic OAuth authorization server that can be used by multiple resource servers in order to ensure that access to resources stored on those resource servers is limited to access to which the resource owner consents. Each resource server registers, with the OAuth authorization server, metadata for that resource server, indicating scopes that are recognized by the resource server. The OAuth authorization server refers to this metadata when requesting consent from a resource owner on behalf of a client application, so that the consent will be of an appropriate scope. The OAuth authorization server refers to this metadata when constructing an access token to provide to the client application for use in accessing the resources on the resource server. The OAuth authorization server uses this metadata to map issued access tokens to the scopes to which those access tokens grant access.

Claims

1. A computer-implemented method comprising:

receiving, at an OAuth authorization server, from a client application, a token request that specifies multiple separate services;

in response to receiving the token request, generating, at the OAuth authorization server, a single token that includes scope of access information for each of the multiple separate services; and

sending the single token from the OAuth authorization server to the client application.

2. The computer-implemented method of claim 1, wherein the multiple separate services include (a) a first service that is provided by a first resource server and (b) a second service that is provided by a second resource server that is separate from the first resource server.

3. The computer-implemented method of claim 2, further comprising:

in response to receiving the token request, determining first scope of access information for the client application based on first policy information provided by the first resource server;

storing the first scope of access information in the single token;

in response to receiving the token request, determining second scope of access information for the client application based on second policy information provided by the second resource server; and

storing the second scope of access information in the single token;

wherein the first scope of access information differs from the second scope of access information; and

wherein the first policy information differs from the second policy information.

4. The computer-implemented method of claim 3, wherein determining the first scope of access information comprises:

sending an identity of the client application over a network from the OAuth authorization server to the first resource server;

receiving, over a network, from the first resource server at the OAuth authorization server, first scope of access information that the first resource server determined by applying first policy information stored at the first resource server to attributes associated with the identity of the client application.

5. The computer-implemented method of claim 4, wherein determining the second scope of access information comprises:

sending the identity of the client application over a network from the OAuth authorization server to the second resource server;

receiving, over a network, from the second resource server at the OAuth authorization server, second scope of access information that the second resource server determined by applying second policy information stored at the second resource server to attributes associated with the identity of the client application.

6. The computer-implemented method of claim 3, further comprising:

receiving the first policy information at the OAuth authorization server from the first resource server over a network;

storing the first policy information at the OAuth authorization server in response to receiving the first policy information from the first resource server;

receiving the second policy information at the OAuth authorization server from the second resource server over a network; and

storing the second policy information at the OAuth authorization server in response to receiving the second policy information from the second resource server.

7. The computer-implemented method of claim 6, wherein determining the first scope of access information comprises applying, at the OAuth authorization server, the first policy information stored at the OAuth authorization server to attributes associated with the identity of the client application;

and wherein determining the second scope of access information comprises applying, at the OAuth authorization server, the second policy information stored at the OAuth authorization server to the attributes associated with the identity of the client application.

8. A computer-readable memory comprising instructions which, when executed by one or more processors, cause the one or more processors to perform:

receiving, at an OAuth authorization server, from a client application, a token request that specifies multiple separate services;

in response to receiving the token request, generating, at the OAuth authorization server, a single token that includes scope of access information for each of the multiple separate services; and

sending the single token from the OAuth authorization server to the client application.

9. The computer-readable memory of claim 8, wherein the multiple separate services include (a) a first service that is provided by a first resource server and (b) a second service that is provided by a second resource server that is separate from the first resource server.

10. The computer-readable memory of claim 9, wherein the instructions, when executed by the one of more processors, further cause the one or more processors to perform:

in response to receiving the token request, determining first scope of access information for the client application based on first policy information provided by the first resource server;

storing the first scope of access information in the single token;

in response to receiving the token request, determining second scope of access information for the client application based on second policy information provided by the second resource server; and

storing the second scope of access information in the single token;

wherein the first scope of access information differs from the second scope of access information; and

wherein the first policy information differs from the second policy information.

11. The computer-readable memory of claim 10, wherein determining the first scope of access information comprises:

sending an identity of the client application over a network from the OAuth authorization server to the first resource server;

receiving, over a network, from the first resource server at the OAuth authorization server, first scope of access information that the first resource server determined by applying first policy information stored at the first resource server to attributes associated with the identity of the client application.

12. The computer-readable memory of claim 11, wherein determining the second scope of access information comprises:

sending the identity of the client application over a network from the OAuth authorization server to the second resource server;

receiving, over a network, from the second resource server at the OAuth authorization server, second scope of access information that the second resource server determined by applying second policy information stored at the second resource server to attributes associated with the identity of the client application.

13. The computer-readable memory of claim 10, wherein the instructions, when executed by the one of more processors, further cause the one or more processors to perform:

receiving the first policy information at the OAuth authorization server from the first resource server over a network;

storing the first policy information at the OAuth authorization server in response to receiving the first policy information from the first resource server;

receiving the second policy information at the OAuth authorization server from the second resource server over a network; and

storing the second policy information at the OAuth authorization server in response to receiving the second policy information from the second resource server.

14. The computer-readable memory of claim 13, wherein determining the first scope of access information comprises applying, at the OAuth authorization server, the first policy information stored at the OAuth authorization server to attributes associated with the identity of the client application;

and wherein determining the second scope of access information comprises applying, at the OAuth authorization server, the second policy information stored at the OAuth authorization server to the attributes associated with the identity of the client application.

15. A system comprising:

a first machine that stores a client application;

a second machine that stores an OAuth authorization server that is configured to;

receive, from the client application, a token request that specifies multiple separate services;

generate, in response to receiving the token request, a single token that includes scope of access information for each of the multiple separate services; and

sending the single token to the client application.

16. The system of claim 15, wherein the system further comprises:

a third machine that executes a first resource server; and

a fourth machine that executes a second resource server;

wherein the multiple separate services include a first service that is provided by the first resource server;

wherein the multiple separate services include a second service that is provided by the second resource server.

17. The system of claim 16, wherein the OAuth authorization server is configured to:

determine, in response to receiving the token request, first scope of access information for the client application based on first policy information provided by the first resource server;

store the first scope of access information in the single token;

determine, in response to receiving the token request, second scope of access information for the client application based on second policy information provided by the second resource server; and

store the second scope of access information in the single token;

wherein the first scope of access information differs from the second scope of access information; and

wherein the first policy information differs from the second policy information.

18. The system of claim 17, wherein, to determine the first scope of access information, the OAuth authorization server is configured to:

send an identity of the client application over a network to the first resource server; and

receive, over a network, from the first resource server, first scope of access information that the first resource server determined by applying first policy information stored at the first resource server to attributes associated with the identity of the client application.

19. The system of claim 17, wherein the OAuth authorization server is configured to:

receive the first policy information from the first resource server over a network;

store the first policy information in response to receiving the first policy information from the first resource server;

receive the second policy information from the second resource server over a network; and

store the second policy information in response to receiving the second policy information from the second resource server.

20. The system of claim 19, wherein, to determine the first scope of access information and the second scope of access information, the OAuth authorization server is configured to:

apply the first policy information stored at the OAuth authorization server to attributes associated with the identity of the client application; and

apply the second policy information stored at the OAuth authorization server to the attributes associated with the identity of the client application.