Web-based single sign-on with form-fill proxy application

• US 9,628,468 B2
• Filed: 09/22/2014
• Issued: 04/18/2017
• Est. Priority Date: 09/20/2013
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Valenti, Anthony Robert, Weiser, Yitzchak, Folkins, Andrew Bennett, Manza, Marc B., Sorial, Ayman
• Primary Examiner(s): ZAIDI, SYED A
• Application Number:
  US14/493,218
• Publication Number:
  US 20150089579A1
• Time in Patent Office: 939 Days
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Web-based single sign-on can enable a user to log in to a single interface (such as through a web browser or thin client) and then provide SSO services to the user for one or more web applications. The web-based SSO system can be extended to support one or more different access control methods, such as form-fill, Federated (OIF), SSO Protected (OAM), and other policies. The web-based SSO system can include a user interface through which the user can access different web applications, systems, etc. and manage their credentials. Each SSO service can be associated with a web interface allowing the SSO services to be accessed over the web. The web interfaces can provide CRUD (create, read, update, delete) functionality for each SSO service. To support different access policy types, the web-based SSO system can include an extensible data manager that can manage data access to different types of repositories transparently.

Claims

1. A method comprising:

receiving, at a server, a request from a client device to access a web application;

passing the request to the web application;

receiving a response from the web application;

augmenting the response with policy data and a single sign-on application to create an augmented response; and

returning the augmented response to the client device;

wherein the single sign-on application is configured to;

identify a platform associated with the client device; and

execute one or more operations that are specific to the associated platform;

wherein the single sign-on application executes in a client browser and is further configured to;

request a policy associated with the web application;

match a page received from the web application to the policy;

request, from the server, credentials associated with a user to access the web application;

receive one or more credentials from the server and inject the received credentials into one or more fields on the page based on the policy; and

submit the received credentials to the web application; and

wherein the single sign-on application is further configured to invoke an automated logon chooser process that submits the received credentials to the single sign-on application such that, upon the single sign-on application detecting a successful logon with one of the received credentials, the single sign-on application sends an update request to the server to update the credentials associated with the user for the web application using the received credentials associated with the successful logon.

2. The method of claim 1, wherein the single sign-on application is a Javascript application.

3. The method of claim 1, further comprising:

receiving a second request from the single sign-on application for the policy associated with the web application;

sending a third request to a data manager for the policy;

sending a second response to the single sign-on application including the policy.

4. The method of claim 1, further comprising:

receiving a second request from the single sign-on application for a credential associated with the user to access the web application;

sending a third request to a data manager for the credential;

sending a second response to the single sign-on application including the credential.

5. The method of claim 1, wherein the associated platform includes one or more of a client device type and a browser application type.

6. A non-transitory computer readable storage medium including instructions stored thereon which when executed by a processor cause the processor to perform the steps of:

receiving a request to access a web application;

passing the request to the web application;

receiving a response from the web application;

augmenting the response with policy data and a single sign-on application to create an augmented response; and

returning the augmented response;

wherein the single sign-on application is configured to;

identify a platform associated with a client device; and

execute one or more operations that are specific to the associated platform;

wherein the single sign-on application executes in a client browser and is further configured to;

request a policy associated with the web application;

match a page received from the web application to the policy;

request, from the server, credentials associated with a user to access the web application;

receive one or more credentials from the server and inject the received credentials into one or more fields on the page based on the policy; and

submit the received credentials to the web application; and

wherein the single sign-on application is further configured to invoke an automated logon chooser process that submits the received credentials to the single sign-on application such that, upon the single sign-on application detecting a successful logon with one of the received credentials, the single sign-on application sends an update request to the server to update the credentials associated with the user for the web application using the received credentials associated with the successful logon.

7. The non-transitory computer readable storage medium of claim 6, wherein the single sign-on application is a Javascript application.

8. The non-transitory computer readable storage medium of claim 6, further including instructions stored thereon which when executed by the processor cause the processor to perform the steps of:

receiving a second request from the single sign-on application for the policy associated with the web application;

sending a third request to a data manager for the policy;

sending a second response to the single sign-on application including the policy.

9. The non-transitory computer readable storage medium of claim 6, further including instructions stored thereon which when executed by the processor cause the processor to perform the steps of:

receiving a second request from the single sign-on application for a credential associated with the user to access the web application;

sending a third request to a data manager for the credential;

sending a second response to the single sign-on application including the credential.

10. The non-transitory computer readable storage medium of claim 6, wherein the associated platform includes one or more of a client device type and a browser application type.

11. A system comprising:

a computer, including a computer readable storage medium and processor; and

a single sign-on proxy, executing on the computer, wherein the single sign-on proxy is configured to receive requests for web applications from clients and return augmented responses from the web applications to the clients;

wherein when a request to access a web application is received from a client, the single sign-on proxy is configured to

pass the request to the web application;

receive a response from the web application;

augment the response with policy data and a single sign-on application to create an augmented response; and

return the augmented response;

wherein the single sign-on application is configured to;

identify a platform associated with the client device; and

execute one or more operations that are specific to the associated platform;

wherein the single sign-on application executes in a client browser and is further configured to;

request a policy associated with the web application;

match a page received from the web application to the policy;

request, from a server, credentials associated with a user to access the web application;

receive one or more credentials from the server and inject the received credentials into one or more fields on the page based on the policy; and

submit the received credentials to the web application; and

wherein the single sign-on application is further configured to invoke an automated logon chooser process that submits the received credentials to the single sign-on application such that, upon the single sign-on application detecting a successful logon with one of the received credentials, the single sign-on application sends an update request to the server to update the credentials associated with the user for the web application using the received credentials associated with the successful logon.

12. The system of claim 11, wherein the single sign-on application is a Javascript application.

13. The system of claim 11, wherein the single sign-on proxy is further configured to:

receiving a request from the single sign-on application for the policy associated with the web application;

sending a third request to a data manager for the policy;

sending a second response to the single sign-on application including the policy.

14. The system of claim 11, wherein the single sign-on proxy is further configured to:

receiving a second request from the single sign-on application for a credential associated with the user to access the web application;

sending a third request to a data manager for the credential;

sending a second response to the single sign-on application including the credential.