WEB-BASED SINGLE SIGN-ON WITH FORM-FILL PROXY APPLICATION

• US 20150089579A1
• Filed: 09/22/2014
• Published: 03/26/2015
• Est. Priority Date: 09/20/2013
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Manza, Marc B., Sorial, Ayman, Kolli, Ashish, Uchil, Mrudul, Brunaugh, Josh, Singh, Dharmvir, Cornwell, Smith William, Kuppala, Siva Sundeep, Jain, Swati, Raote, Paresh
• Granted Patent: US 9,628,468 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Web-based single sign-on can enable a user to log in to a single interface (such as through a web browser or thin client) and then provide SSO services to the user for one or more web applications. The web-based SSO system can be extended to support one or more different access control methods, such as form-fill, Federated (OIF), SSO Protected (OAM), and other policies. The web-based SSO system can include a user interface through which the user can access different web applications, systems, etc. and manage their credentials. Each SSO service can be associated with a web interface allowing the SSO services to be accessed over the web. The web interfaces can provide CRUD (create, read, update, delete) functionality for each SSO service. To support different access policy types, the web-based SSO system can include an extensible data manager that can manage data access to different types of repositories transparently.

Claims

1. A method comprising:

receiving, at a server, a request from a client device to access a web application;

passing the request to the web application;

receiving a response from the web application;

augmenting the response with policy data and a single sign-on application to create an augmented response; and

returning the augmented response to the client device.

2. The method of claim 1, wherein the single sign-on application executes in a client browser and is configured to:

request a policy associated with the web application;

match a page received from the web application to the policy;

request credentials associated with a user to access the web application;

inject the credentials into one or more fields on the page based on the policy; and

submit the credentials to the web application.

3. The method of claim 1, wherein the single sign-on application is a Javascript application.

4. The method of claim 1, further comprising:

receiving a request from the single sign-on application for a policy associated with the web application;

sending a request to a data manager for the policy;

sending a response to the single sign-on application including the policy.

5. The method of claim 1, further comprising:

receiving a request from the single sign-on application for a credential associated with a user to access the web application;

sending a request to a data manager for the credential;

sending a response to the single sign-on application including the credential.

6. The method of claim 1, wherein the single sign-on application is configured to:

identify a platform associated with the client device; and

execute one or more platform-specific operations.

7. The method of claim 6, wherein the platform includes one or more of a client device type and a browser application type.

8. A non-transitory computer readable storage medium including instructions stored thereon which when executed by a processor cause the processor to perform the steps of:

receiving a request to access a web application;

passing the request to the web application;

receiving a response from the web application;

augmenting the response with policy data and a single sign-on application to create an augmented response; and

returning the augmented response.

9. The non-transitory computer readable storage medium of claim 8, wherein the single sign-on application executes in a client browser and is configured to:

request a policy associated with the web application;

match a page received from the web application to the policy;

request credentials associated with a user to access the web application;

inject the credentials into one or more fields on the page based on the policy; and

submit the credentials to the web application.

10. The non-transitory computer readable storage medium of claim 8, wherein the single sign-on application is a Javascript application.

11. The non-transitory computer readable storage medium of claim 8, further including instructions stored thereon which when executed by a processor cause the processor to perform the steps of:

receiving a request from the single sign-on application for a policy associated with the web application;

sending a request to a data manager for the policy;

sending a response to the single sign-on application including the policy.

12. The non-transitory computer readable storage medium of claim 8, further including instructions stored thereon which when executed by a processor cause the processor to perform the steps of:

receiving a request from the single sign-on application for a credential associated with a user to access the web application;

sending a request to a data manager for the credential;

sending a response to the single sign-on application including the credential.

13. The non-transitory computer readable storage medium of claim 8, wherein the single sign-on application is configured to:

identify a platform associated with the client device; and

execute one or more platform-specific operations.

14. The non-transitory computer readable storage medium of claim 8, wherein the platform includes one or more of a client device type and a browser application type.

15. A system comprising:

a computer, including a computer readable storage medium and processor; and

a single sign-on proxy, executing on the computer, wherein the single sign-on proxy is configured to receive requests for web applications from clients and return augmented responses from the web applications to the clients;

wherein when a request to access a web application is received from a client, the single sign-on proxy is configured to

pass the request to the web application;

receive a response from the web application;

augment the response with policy data and a single sign-on application to create an augmented response; and

return the augmented response.

16. The system of claim 15, wherein the single sign-on application executes in a client browser and is configured to:

request a policy associated with the web application;

match a page received from the web application to the policy;

request credentials associated with a user to access the web application;

inject the credentials into one or more fields on the page based on the policy; and

submit the credentials to the web application.

17. The system of claim 15, wherein the single sign-on application is a Javascript application.

18. The system of claim 15, wherein the single sign-on proxy is further configured to:

receiving a request from the single sign-on application for a policy associated with the web application;

sending a request to a data manager for the policy;

sending a response to the single sign-on application including the policy.

19. The system of claim 15, wherein the single sign-on proxy is further configured to:

receiving a request from the single sign-on application for a credential associated with a user to access the web application;

sending a request to a data manager for the credential;

sending a response to the single sign-on application including the credential.

20. The system of claim 15, wherein the single sign-on application is configured to:

identify a platform associated with the client device; and

execute one or more platform-specific operations.