System for and methods of providing single sign-on (SSO) capability in an application publishing and/or document sharing environment

• US 8,856,907 B1
• Filed: 05/25/2012
• Issued: 10/07/2014
• Est. Priority Date: 05/25/2012
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Hopto Inc.
• Inventors: Tidd, William
• Primary Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US13/481,752
• Time in Patent Office: 865 Days
• Field of Search: 713/155, 726/8, 715/200
• US Class Current: 726/8
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services

Abstract

A client-server computing system includes a computer cluster for hosting certain resources, applications, programs, processes, files, and/or data that are published to users who are accessing the computer cluster remotely. The computer cluster includes a network of one or more host computers, a gateway server, a gateway service database, a user database, and a document database. A single sign-on (SSO) method of the disclosure includes performing a computer cluster authentication process in which a user enters his/her credentials followed by a resource authentication process and/or document sharing process in which there is no need for the user to reenter his/her credentials, having entered them already in the computer cluster authentication process.

Claims

1. A method for providing a document sharing service in combination with remote access to document applications, the method comprising:

receiving, by a gateway service, an access request from a client device;

prompting, by the gateway service, the client device, for credentials;

authenticating, by the gateway service, the client device using the credentials;

responsive to a successful authentication, initially selecting a host computer from a plurality of host computers;

encrypting, by the gateway service, the credentials using a public key associated with the selected host computer;

transmitting, by the gateway service, the encrypted credentials to the host computer;

decrypting, by the host computer, the encrypted credentials;

authenticating, by the host computer, the client device using the decrypted credentials;

responsive to a successful authentication, starting, by the host computer, a document sharing service session for the client device;

providing, by a document sharing service, access to a plurality of other host computers hosting resources capable of processing a document, wherein processing the document includes editing capabilities;

receiving, by the document sharing service, a request from the client device, to view a document, wherein the client device lacks the necessary resources to process the document;

automatically determining, by the document sharing service, which of the other host computers hosts a resource that is capable of processing the type of document received in the client device'"'"'s request based on an access control table stored in memory that maps resources hosted by each of the plurality of host computers; and

selecting, by the document sharing service, the determined other host computer to process the client device'"'"'s request;

moving the documents to the selected other host computer; and

causing the selected other host computer to process the client device'"'"'s request with the client device.

2. The method of claim 1, further comprising registering the host computer with the gateway server.

3. The method of claim 2, wherein registration includes the gateway service generating encryption keys for the host computer, the generated encryption keys including the public key associated with the host computer.

4. The method of claim 3, wherein the generated encryption keys further include a private key associated with the host computer.

5. The method of claim 4, wherein the encrypted credentials can only be decrypted with the private key associated with the host computer.

6. The method of claim 1, further comprising publishing a list of a plurality of available documents.

7. The method of claim 1, wherein another access request is received for a resource on another host computer.

8. The method of claim 7, wherein the gateway service forwards the request to the initially selected host computer.

9. The method of claim 8, wherein the authentication on the initially selected host computer is used to authenticate the request for the other host computer.

10. A system for providing single sign-on (SSO) capability in an application publishing environment, the system comprising:

one or more host computers;

a gateway service that;

receives an access request from a client device;

prompts the client device, for credentials;

authenticates the client device using the credentials;

responsive to a successful authentication, initially selects a host computer;

encrypts the credentials using a public key associated with the selected host computer;

transmits the encrypted credentials to the host computer;

wherein the host computer;

decrypts the encrypted credentials;

authenticates the client device using the decrypted credentials;

responsive to a successful authentication, starts a document sharing service session for the client device; and

a document sharing service that;

provides access to a plurality of other host computers hosting resources capable of processing a document, wherein processing the document includes editing capabilities;

receives a request from the client device, to view a document, wherein said client device lacks the necessary resources to process the document;

automatically determines which of the other host computers hosts a resource that is capable of processing the type of document received in the client device'"'"'s request based on an access control table stored in memory that maps resources hosted by each of the plurality of host computers; and

selects the determined other host computer to process the client device'"'"'s request;

moves the documents to the selected other host computer; and

causes the selected other host computer to process the client device'"'"'s request with the client device.

11. The system of claim 10, wherein the gateway service registers each of the host computers.

12. The system of claim 11, wherein registration includes the gateway service generating encryption keys for the host computer, the generated encryption keys including the public key associated with the host computer.

13. The system of claim 12, wherein the generated encryption keys further include a private key associated with the host computer.

14. The system of claim 13, wherein the encrypted credentials can only be decrypted with the private key associated with the host computer.

15. The system of claim 10, wherein the host computers publish a list of a plurality of available resources.

16. The system of claim 10, wherein the gateway service receives another access request is received for a resource on another host computer of the one or more host computers.

17. The system of claim 16, wherein the gateway service forwards the request to the initially selected host computer.

18. The system of claim 10, wherein the authentication on the initially selected host computer is used to authenticate the request for the other host computer.

19. A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for providing single sign-on (SSO) capability in an application publishing environment, the method comprising:

receiving an access request from a client device;

prompting the client device, for credentials;

authenticating the client device using the credentials;

responsive to a successful authentication, initially selecting a host computer;

encrypting the credentials using a public key associated with the selected host computer;

transmitting the encrypted credentials to the host computer;

decrypting the encrypted credentials;

authenticating the client device using the decrypted credentials;

responsive to a successful authentication, starting a document sharing service session for the client device;

providing access to a plurality of other host computers hosting resources capable of processing a document, wherein processing the document includes editing capabilities;

receiving a request from the client device, to view a document, wherein said client device lacks the necessary resources to process the document;

automatically determining which of the other host computers hosts a resource that is capable of processing the type of document received in the client device'"'"'s request based on an access control table stored in memory that maps resources hosted by each of the plurality of host computers; and

selecting the determined other host computer to process the client device'"'"'s request;

moving the documents to the selected other host computer; and

causing the selected other host computer to process the client device'"'"'s request with the client device.