Enabling authentication of OpenID user when requested identity provider is unavailable

• US 8,898,754 B2
• Filed: 04/25/2012
• Issued: 11/25/2014
• Est. Priority Date: 07/13/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Chari, Suresh N., Chen, Gang, Kaplinger, Todd E.
• Primary Examiner(s): DADA, BEEMNET W
• Application Number:
  US13/455,705
• Publication Number:
  US 20120210407A1
• Time in Patent Office: 944 Days
• Field of Search: 726 5- 8, 726/27, 726/28, 713/168, 713/183, 713/184
• US Class Current: 726/5
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A method and computer program product for enabling authentication of an OpenID user when a requested identity provider is unavailable. A relying party receives a login request from the OpenID user, where the login request includes a username. The relying party reads a list of trusted identity providers that are associated with the received username and selects one of those identity providers. The relying party generating an OpenID identifier using an identification (e.g., Uniform Resource Locator) of the selected identity provider and the username. The relying party transmits an authentication request (request to authenticate the OpenID user) to the selected identity provider using the formed OpenID identifier. If the selected identity provider is unavailable, then the relying party selects another identity provider from the list of identity providers that are associated with the received username and repeats the above process.

Claims

1. A method for enabling authentication of an OpenID user when a requested identity provider is unavailable, the method comprising:

receiving a login request from said OpenID user, wherein said login request comprises a username;

reading a list of identity providers associated with said username;

identifying a first available identity provider from said list of identity providers;

generating a first OpenID identifier using an identification of said first identified identity provider and said username; and

transmitting, by a computer processor of a relying party, a request to said first identified identity provider to authenticate said OpenID user using said first OpenID identifier.

2. The method as recited in claim 1 further comprising:

configuring said relying party to contain said list of identity providers associated with said username.

3. The method as recited in claim 1 further comprising:

completing said OpenID authentication with said first identified identity provider if said first identified identity provider is available.

4. A computer program product embodied in a computer readable medium, wherein the medium does not include a propagating signal, for enabling authentication of an OpenID user when a requested identity provider is unavailable, the computer program product comprising the programming instructions for:

receiving a login request from said OpenID user, wherein said login request comprises a username;

reading a list of identity providers associated with said username;

identifying a first available identity provider from said list of identity providers;

generating a first OpenID identifier using an identification of said first identified identity provider and said username; and

transmitting a request to said first identified identity provider to authenticate said OpenID user using said first OpenID identifier.

5. The computer program product as recited in claim 4 further comprising the programming instructions for:

configuring a relying party to contain said list of identity providers associated with said username.

6. The computer program product as recited in claim 4 further comprising the programming instructions for:

completing said OpenID authentication with said first identified identity provider if said first identified identity provider is available.

7. A method for obtaining attribute information for an OpenID user during an authentication phase, the method comprising:

receiving a login request from said OpenID user, wherein said login request comprises a username;

determining user profile attributes to be requested from one or more identity providers;

reading a list of identity providers associated with said username;

identifying a first available identity provider from said list of identity providers;

generating a first OpenID identifier using an identification of said first identified identity provider and said username; and

transmitting, by a computer processor of a relying party, an authentication request to said first identified identity provider to authenticate said OpenID user using said first OpenID identifier.

8. The method as recited in claim 7, wherein said authentication request comprises a request to obtain all of said determined user profile attributes.

9. The method as recited in claim 8 further comprising:

completing said OpenID authentication with said first identified identity provider if said first identified identity provider is available and if said first identified identity provider can provide all of said determined user profile attributes.

10. The method as recited in claim 7, wherein said authentication request comprises a request to obtain one or more user profile attributes not previously obtained.

11. The method as recited in claim 10 further comprising:

obtaining one or more of said one or more user profile attributes not previously obtained from said first identity provider if said first identity provider is available and if said first identity provider can provide said one or more of said one or more user profile attributes not previously obtained.

12. A computer program product embodied in a computer readable medium, wherein the medium does not include a propagating signal, for obtaining attribute information for an OpenID user during an authentication phase, the computer program product comprising the programming instructions for:

receiving a login request from said OpenID user, wherein said login request comprises a username;

determining user profile attributes to be requested from one or more identity providers;

reading a list of identity providers associated with said username;

identifying a first available identity provider from said list of identity providers;

generating a first OpenID identifier using an identification of said first identified identity provider and said username; and

transmitting an authentication request to said first identified identity provider to authenticate said OpenID user using said first OpenID identifier.

13. The computer program product as recited in claim 12, wherein said authentication request comprises a request to obtain all of said determined user profile attributes.

14. The computer program product as recited in claim 13 further comprising the programming instructions for:

completing said OpenID authentication with said first identified identity provider if said first identified identity provider is available and if said first identified identity provider can provide all of said determined user profile attributes.

15. The computer program product as recited in claim 12, wherein said authentication request comprises a request to obtain one or more user profile attributes not previously obtained.

16. The computer program product as recited in claim 15 further comprising the program instructions for:

obtaining one or more of said one or more user profile attributes not previously obtained from said first identity provider if said first identity provider is available and if said first identity provider can provide said one or more of said one or more user profile attributes not previously obtained.