Authorization services with external authentication

• US 7,231,661 B1
• Filed: 06/21/2001
• Issued: 06/12/2007
• Est. Priority Date: 06/21/2001
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Villavicencio, Francisco J., Knouse, Charles W.
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): Baum; Ronald
• Application Number:
  US09/886,515
• Time in Patent Office: 2,182 Days
• Field of Search: 713155-202, 705/67, 709219-229
• US Class Current: 726/4
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

An Access System can provide identity management and/or access management services. Examples of access management services include authentication and authorization services. In some implementations, users of an Access System want to use the authorization services of the Access System but do not want to use the authentication services of the Access System. The present invention allows some or all of the resources protected by the Access System to use the authentication services of the Access System and some or all of the resources protected by the Access System to use external authentication services.

Claims

1. A method for providing access to resources, comprising the steps of:

receiving, at an access system, configuration information for a first resource, said access system provides for using of one or more internal authentication systems and said access system provides for reliance on one or more external authentication systems, said configuration information provides an indication to said access system to rely on a first external authentication system for said first resource;

receiving a first request from a first user for said first resource;

relying on said first external authentication system for authenticating said first user; and

performing, at said authorization system, authorization services for said first request;

wherein said authorization services comprise determining whether said first user is authorized to access said first resource; and

wherein authenticating said first user comprises verifying an identity of said first user.

2. A method according to claim 1, wherein said one or more external authentication systems include:

a default web server authentication system;

an authentication plug-in; and

a third party authentication system.

3. A method according to claim 1, wherein:

said access system protects a plurality of resources, said plurality of resources includes said first resource, a second resource and a third resource;

said first resource uses said first authentication system for authentication services;

said second resource uses a second authentication system for authentication services, said second authentication system is separate from said access system; and

said third resource uses a third authentication system for authentication services, said third authentication system is separate from said access system.

4. A method according to claim 3, wherein:

said first authentication system is a default web server authentication system;

said second authentication system is a authentication plug-in; and

said third authentication system is a third party authentication system.

5. A method according to claim 1, wherein said step of relying includes:

accessing a pre-designated variable having a value; and

storing said value as an identification of an authenticated user.

6. A method according to claim 5, wherein said step of performing authorization services includes the steps of:

accessing one or more authorization rules for said first resource;

using said identification to access an identity profile; and

evaluating one or more attributes from said identity profile against said one or more authorization rules for said first resource to determine whether to authorize access to said first resource.

7. An access system, comprising:

a communication interface;

one or more storage devices; and

one or more processors in communication with said one or more storage devices and said communication interface, said one or more processors programmed to perform a method comprising the steps of;

acquiring user identification information from a first authentication system external to said access system, said user identification information is associated with a request from a first user to access a first resource,

relying on said first authentication system for authenticating said first user,

using said user identification information to access an identity profile associated with said user identification information, and

performing authorization services for said request to access said first resource based on said identity profile associated with said user identification information;

wherein said authorization services comprise determining whether said first user is authorized to access said first resource; and

wherein authenticating said first user comprises verifying an identity of said first user.

8. An access system according to claim 7, wherein:

said access system protects a plurality of resources, said access system provides for use of one or more internal authentication systems and said access system provides for reliance on one or more external authentication systems, said one or more external authentication systems include said first authentication system.

9. An access system according to claim 7, wherein said method further comprises the steps of:

using said user identification information to create information for a cookie;

causing said cookie to be transmitted for storage on a client associated with said request;

receiving a request to access a second resource, said request to access said second resource includes contents of said cookie; and

using said cookie to authorize access to said second resource without authenticating.

10. An access system according to claim 7, wherein-relying on said first authentication system comprises the steps of:

receiving information about said request;

determining whether said first resource is protected; and

determining that authentication for said first resource is to be performed by said first authentication system.

11. An access system, comprising:

a communication interface;

one or more storage devices; and

one or more processors in communication with said one or more storage devices and said communication interface, said one or more processors programmed to perform a method comprising the steps of;

acquiring a plurality of variables from a first authentication system external to said access system, said variables are associated with a first request from a first user to access a first resource,

relying on said first authentication system for authenticating said first user, and

performing authorization services for said request to access said first resource based on said plurality of variables;

wherein said authorization services comprise determining whether said first user is authorized to access said first resource; and

wherein authenticating said first user comprises verifying an identity of said first user.

12. An access system according to claim 11, wherein-relying on said first authentication system comprises the steps of:

receiving information from said first request;

determining whether said first resource is protected; and

determining that authentication for said first resource is to be performed by said first authentication system.

13. An access system according to claim 11, wherein:

said access system protects a plurality of resources, said access system provides for use of one or more internal authentication systems and said access system provides for reliance on one or more external authentication systems, said one or more external authentication systems include said first authentication system.

14. An access system according to claim 11, wherein said method further comprises the steps of:

using said plurality of variables to create information for a cookie;

causing said cookie to be transmitted for storage on a client associated with said request;

receiving a request to access a second resource, said request to access said second resource includes contents of said cookie; and

using said cookie to authorize access to said second resource without authenticating.

15. An access system, comprising:

a communication interface;

one or more storage devices; and

one or more processors in communication with said one or more storage devices and said communication interface, said one or more processors programmed to perform a method comprising the steps of;

acquiring user identification information from an external authentication system separate from said access system, said user identification information is associated with a request from a first user to access a first resource,

relying on said authentication system for authenticating said first user,

using said user identification information to create information for a cookie,

causing said cookie to be transmitted for storage on a client associated with said request to access said first resource, and

performing authorization services for said request to access said first resource;

wherein said authorization services comprise determining whether said first user is authorized to access said first resource; and

wherein authenticating said first user comprises verifying an identity of said first user.

16. An access system according to claim 15, wherein:

said access system protects a plurality of resources, said access system provides for use of one or more internal authentication systems and said access system provides for reliance on one or more external authentication systems, said one or more external authentication systems include said first authentication system.

17. An access system according to claim 15, wherein said method further comprises the step of:

performing single sign-on services based on said cookie.

18. An access system according to claim 15, wherein said method further comprises the step of:

receiving a request to access a second resource, said request to access said second resource includes contents of said cookie; and

using said cookie to authorize access to said second resource without authenticating.

19. An access system according to claim 15, wherein said method further comprises the step of:

receiving a request to access a second resource at a second server, said request to access said first resource was received at a first server but not at said second server, said first authentication system does include said first server and does not include said second server, said step of receiving said request to access said second resource includes receiving contents of said cookie; and

using said cookie at said second server to authorize access to said second resource without authenticating.

20. One or more processor readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors to perform a method comprising the steps of:

receiving, at an access system, configuration information for a first resource, said access system provides for using one or more internal authentication systems and said access system provides for reliance on one or more external authentication systems, said configuration information provides an indication to said access system to rely on a first external authentication system for said first resource;

receiving information for a first request from a first user for said first resource;

relying on said first external authentication system for authenticating said first user; and

performing, at said authorization system, authorization services for said first request;

wherein said authorization services comprise determining whether said first user is authorized to access said first resource;

wherein authenticating said first user comprises verifying an identity of said first user; and

wherein said access system protects a plurality of resources, said plurality of resources includes said first resource, a second resource and a third resource, said first resource uses said first authentication system for authentication services, said second resource uses a second authentication system for authentication services, said second authentication system is separate from said access system, said third resource uses a third authentication system for authentication services, said third authentication system is separate from said access system, said first authentication system is a default web server authentication system, said second authentication system is a authentication plug-in, and said third authentication system is a third party authentication system.

21. One or more processor readable storage devices according to claim 20, wherein:

said step of relying includes accessing a pre-designated variable having a value and storing said value as an identification of an authenticated user; and

said step of performing authorization services includes the steps of;

accessing one or more authorization rules for said first resource,

using said identification to access an identity profile, and

evaluating one or more attributes from said identity profile against said one or more authorization rules for said first resource to determine whether to authorize access to said first resource.

22. An access system, comprising:

a communication interface;

one or more storage devices; and

one or more processors in communication with said one or more storage devices and said communication interface, said one or more processors programmed to perform a method comprising the steps of;

providing for using one or more internal authentication systems,

providing for reliance on one or more external authentication systems,

receiving configuration information for a first resource, said configuration information provides an indication to rely on a first external authentication system for a first resource,

receiving information for a first request from a first user for said first resource,

relying on said first external authentication system for authenticating said first user, and

performing authorization services for said first request;

wherein said authorization services comprise determining whether said first user is authorized to access said first resource;

wherein authenticating said first user comprises verifying an identity of said first user; and

wherein said access system protects a plurality of resources, said plurality of resources includes said first resource, a second resource and a third resource, said first resource uses said first authentication system for authentication services, said second resource uses a second authentication system for authentication services, said second authentication system is separate from said access system, said third resource uses a third authentication system for authentication services, said third authentication system is separate from said access system, said first authentication system is a default web server authentication system, said second authentication system is a authentication plug-in, and said third authentication system is a third party authentication system.

23. An access system according to claim 22, wherein:

said step of relying includes accessing a pre-designated variable having a value and storing said value as an identification of an authenticated user; and

said step of performing authorization services includes the steps of;

accessing one or more authorization rules for said first resource,

using said identification to access an identity profile, and evaluating one or more attributes from said identity profile against said one or more authorization rules for said first resource to determine whether to authorize access to said first resource.