Application identity design

• US 8,108,919 B2
• Filed: 04/02/2010
• Issued: 01/31/2012
• Est. Priority Date: 10/01/2004
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Boulos, Thomas Nabiel, Behera, Prasanta Kumar
• Primary Examiner(s): Cervetti, David Garcia
• Assistant Examiner(s): McNally, Michael S
• Application Number:
  US12/753,495
• Publication Number:
  US 20100192204A1
• Time in Patent Office: 669 Days
• Field of Search: 726/6
• US Class Current: 726/6
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

Methods and apparatus, including computer program products, implementing and using techniques for providing user credentials over a network to a remote computer application. User credentials for the remote computer application are stored in a central repository that is accessible through the network. A request is sent to a service to perform, on behalf of a user, a particular task involving the remote computer application. It is determined whether the service has been granted permission to act on behalf of the user with respect to the remote computer application. When the service has permission to act on behalf of the user, the service is used to retrieve the user'"'"'s credentials for the remote computer application from the central repository and to supply the retrieved user credentials to the remote computer application.

Claims

1. An interoperability network configured to facilitate messaging and mediate policy differences among a plurality of independent service providers and users having associated client machines, the interoperability network comprising one or more computing devices configured to:

receive a request for a first service to perform a particular task involving a second service on behalf of a first user, wherein the first and second services are in communication with the interoperability network and are provided by first and second ones of the independent service providers, respectively;

determine whether the first user has provided first set of credentials that defines access information for the second service, the first set of credentials being included among a plurality of sets of credentials stored on one or more storage media accessible through the interoperability network;

determine whether the first service provider is authorized to act on behalf of the first user with respect to the second service with reference to one or more of a plurality of permissions stored on the one or more storage media; and

where the first user has provided the first set of credentials, and where the first service provider is authorized to act on behalf of the first user with respect to the second service, retrieve the first set of credentials from the one or more storage media, and provide the first set of credentials to the second service for authentication to facilitate performance of the particular task.

2. The network of claim 1, wherein each of the plurality of sets of credentials defines access information for a corresponding user for a corresponding service in communication with the interoperability network.

3. The network of claim 1, wherein each of the plurality of sets of credentials is of a type that is specified by the respective service, and at least two of the plurality of sets of credentials correspond to different authentication protocols.

4. The network of claim 1, wherein determining whether the first service provider has been granted permission to act on behalf of the first user with respect to the second service comprises:

retrieving a first policy from a plurality of policies stored on the one or more storage media, the first policy defining first conditions under which the first service provider is authorized to act on behalf of the first user with respect to the second service; and

determining whether the particular task complies with the first policy.

5. The network of claim 4, wherein the first policy further defines one or more or more security requirements governing use of the first set of credentials, and wherein providing the first set of credentials to the second service comprises transmitting the first set of credentials in compliance with the security requirements defined by the first policy.

6. The network of claim 1, wherein first set of credentials is stored in a first user'"'"'s credential storage area on the one or more storage media, the first user'"'"'s credential storage area storing a plurality of sets of credentials for the first user that each defines access information for the first user for one or more services accessible via the interoperability network.

7. The network of claim 6, wherein the plurality of permissions includes a read permission granted to the first application service provider allowing the first service provider to read one or more of the plurality of sets of credentials from the first user'"'"'s credential storage area.

8. The network of claim 7, wherein determining whether the first service provider is authorized to act on behalf of the first user with respect to the second service comprises determining whether the first service provider has been granted the read permission.

9. The network of claim 1, wherein the first user is either an individual user or an organization representing one or more users.

10. The network of claim 1, wherein at least some of the independent service providers communicate with the interoperability network via different access points on a public network.

11. A method for facilitating communications via an interoperability network configured to facilitate messaging and mediate policy differences among a plurality of independent service providers and users having associated client machines, the method comprising:

receiving a request for a first service to perform a particular task involving a second service on behalf of a first user, wherein the first and second services are in communication with the interoperability network and are provided by first and second ones of the independent service providers, respectively;

determining whether the first user has provided first set of credentials that defines access information for the second service, the first set of credentials being included among a plurality of sets of credentials stored on one or more storage media accessible through the interoperability network;

determining whether the first service provider is authorized to act on behalf of the first user with respect to the second service with reference to one or more of a plurality of permissions stored on the one or more storage media; and

where the first user has provided the first set of credentials, and where the first service provider is authorized to act on behalf of the first user with respect to the second service, retrieving the first set of credentials from the one or more storage media, and providing the first set of credentials to the second service for authentication to facilitate performance of the particular task.

12. The method of claim 11, wherein each of the plurality of sets of credentials defines access information for a corresponding user for a corresponding service in communication with the interoperability network.

13. The method of claim 11, wherein each of the plurality of sets of credentials is of a type that is specified by the respective service, and at least two of the plurality of sets of credentials correspond to different authentication protocols.

14. The method of claim 11, wherein determining whether the first service provider has been granted permission to act on behalf of the first user with respect to the second service comprises:

retrieving a first policy from a plurality of policies stored on the one or more storage media, the first policy defining first conditions under which the first service provider is authorized to act on behalf of the first user with respect to second service; and

determining whether the particular task complies with the first policy.

15. The method of claim 14, wherein the first policy further defines one or more or more security requirements governing use of the first set of credentials, and wherein providing the first set of credentials to the second service comprises transmitting the first set of credentials in compliance with the security requirements defined by the first policy.

16. The method of claim 11, wherein first set of credentials is stored in a first user'"'"'s credential storage area on the one or more storage media, the first user'"'"'s credential storage area storing a plurality of sets of credentials for the first user that each defines access information for the first user for one or more services accessible via the interoperability network.

17. The method of claim 16, wherein the plurality of permissions includes a read permission granted to the first application service provider allowing the first service provider to read one or more of the plurality of sets of credentials from the first user'"'"'s credential storage area.

18. The method of claim 17, wherein determining whether the first service provider is authorized to act on behalf of the first user with respect to the second service comprises determining whether the first service provider has been granted the read permission.

19. The method of claim 11, wherein the first user is either an individual user or an organization representing one or more users.

20. The method of claim 11, wherein at least some of the independent service providers communicate with the interoperability network via different access points on a public network.

21. A computer readable storage medium storing instructions for facilitating communications via an interoperability network configured to facilitate messaging and mediate policy differences among a plurality of independent service providers and users having associated client machines, the instructions comprising:

first instructions for receiving a request for a first service to perform a particular task involving a second service on behalf of a first user, wherein the first and second services are in communication with the interoperability network and are provided by first and second ones of the independent service providers, respectively;

second instructions for determining whether the first user has provided first set of credentials that defines access information for the second service, the first set of credentials being included among a plurality of sets of credentials stored on one or more storage media accessible through the interoperability network;

third instructions for determining whether the first service provider is authorized to act on behalf of the first user with respect to the second service with reference to one or more of a plurality of permissions stored on the one or more storage media; and

fourth instructions for, where the first user has provided the first set of credentials, and where the first service provider is authorized to act on behalf of the first user with respect to the second service, retrieving the first set of credentials from the one or more storage media, and providing the first set of credentials to the second service for authentication to facilitate performance of the particular task.

22. The computer readable medium of claim 21 wherein each of the plurality of sets of credentials defines access information for a corresponding user for a corresponding service in communication with the interoperability network.

23. The computer readable medium of claim 21, wherein each of the plurality of sets of credentials is of a type that is specified by the respective service, and at least two of the plurality of sets of credentials correspond to different authentication protocols.

24. The computer readable medium of claim 21, wherein determining whether the first service provider has been granted permission to act on behalf of the first user with respect to the second service comprises:

retrieving a first policy from a plurality of policies stored on the one or more storage media, the first policy defining first conditions under which the first service provider is authorized to act on behalf of the first user with respect to the second service; and

determining whether the particular task complies with the first policy.

25. The computer readable medium of claim 24, wherein the first policy further defines one or more or more security requirements governing use of the first set of credentials, and wherein providing the first set of credentials to the second service comprises transmitting the first set of credentials in compliance with the security requirements defined by the first policy.