Back to results
US 10,095,860 B1Granted
Validating sign-out implementation for identity federation
AssigneeAmazon Technologies, Inc.
InventorsJon Arron McClintock, David Scott Cleckley, Jr., Robert Ellis Lee, Annabelle Richard Backman
Life of this patent
Estimating the term…
Abstract
Disclosed are various embodiments for validating that relying parties of a federated identity provider have correctly implemented sign-out functionality. In one approach, a network page is received from a network site that is operated by a relying party of a federated identity provider. It is then determined whether the network page includes code that properly implements a sign-out from the federated identity provider. An action is initiated in response to determining that the network page does not include code that properly implements the sign-out from the federated identity provider.
Claims20
A method, comprising:
- crawling, via at least one of one or more computing devices, a network site operated by a relying party of a federated identity provider to identify a uniform resource locator (URL) of a network page;
- receiving, via at least one of the one or more computing devices, the network page at the URL;
- analyzing, via at least one of the one or more computing devices, the network page to determine whether the network page includes code that properly implements a sign-out from the federated identity provider;
- recording, via at least one of the one or more computing devices, sign-in data and sign-out data for the relying party at a service of the federated identity provider;
- determining, via at least one of the one or more computing devices, from the sign-in data and the sign-out data, a quantity of sign-ins and a quantity of sign-outs associated with the relying party;
- determining, via at least one of the one or more computing devices, that the relying party has not properly implemented sign-out functionality for the federated identity provider based at least in part on at least one of:
- the quantity of sign-outs and the quantity of sign-ins associated with the relying party;
- or
- a determination that the network page does not include code that properly implements the sign-out from the federated identity provider;
- and
- initiating, via at least one of the one or more computing devices, an action in response to determining that the relying party has not properly implemented the sign-out functionality, wherein the action comprises at least one of:
- configuring a service of the federated identity provider to disallow sign-ins from the network site;
- configuring the service of the federated identity provider to assign a shorter period of session expiration to a session originating from the network site;
- causing a plurality of users who signed in via the network site to be automatically signed out by the service of the federated identity provider;
- or
- generating a report indicating that the relying party has not properly implemented the sign-out functionality.
13 more elements
A system, comprising:
- at least one computing device;
- and
- at least one application executable in the at least one computing device, wherein when executed the at least one application causes the at least one computing device to at least:
- crawl a network site operated by a relying party of a federated identity provider to identify a uniform resource locator (URL) of a network page;
- receive the network page at the URL;
- analyze the network page to determine whether the network page includes code that properly implements a sign-out from the federated identity provider;
- record sign-in data and sign-out data for the relying party at a service of the federated identity provider;
- determine from the sign-in data and the sign-out data, a quantity of sign-ins and a quantity of sign-outs associated with the relying party;
- determine that the relying party has not properly implemented sign-out functionality for the federated identity provider based at least in part on at least one of:
- the quantity of sign-outs and the quantity of sign-ins associated with the relying party;
- or
- a determination that the network page does not include code that properly implements the sign-out from the federated identity provider;
- and
- initiate an action in response to determining that the relying party has not properly implemented the sign-out functionality, wherein the action comprises at least one of:
- configuring a service of the federated identity provider to disallow sign-ins from the network site;
- configuring the service of the federated identity provider to assign a shorter period of session expiration to a session originating from the network site;
- causing a plurality of users who signed in via the network site to be automatically signed out by the service of the federated identity provider;
- or
- generating a report indicating that the relying party has not properly implemented the sign-out functionality.
16 more elements
A method, comprising:
- crawling, via at least one of one or more computing devices, a network site operated by a particular relying party of a plurality of relying parties of a federated identity provider to identify a uniform resource locator (URL) of a network page;
- receiving, via at least one of the one or more computing devices, the network page at the URL;
- analyzing, via at least one of the one or more computing devices, the network page to determine whether the network page includes code that properly implements a sign-out from the federated identity provider;
- recording, via at least one of the one or more computing devices, sign-out data for individual ones of the plurality of relying parties of the federated identity provider;
- analyzing, via at least one of the one or more computing devices, sign-in data and the sign-out data for the individual ones of the plurality of relying parties to determine a baseline ratio of sign-outs to sign-ins associated with a proper implementation of sign-out functionality for the federated identity provider or a baseline sign-out quantity threshold associated with the proper implementation of the sign-out functionality;
- determining, via at least one of the one or more computing devices, from the sign-out data, a quantity of sign-outs associated with the particular relying party;
- determining, via at least one of the one or more computing devices, that the particular relying party has not properly implemented the sign-out functionality for the federated identity provider based at least in part on at least one of:
- the quantity of sign-outs associated with the particular relying party;
- or
- a determination that the network page does not include code that properly implements the sign-out from the federated identity provider;
- and
- initiating, via at least one of the one or more computing devices, an action in response to determining that the particular relying party has not properly implemented the sign-out functionality, wherein the action comprises at least one of:
- configuring a service of the federated identity provider to disallow sign-ins from the network site;
- configuring the service of the federated identity provider to assign a shorter period of session expiration to a session originating from the network site;
- causing a plurality of users who signed in via the network site to be automatically signed out by the service of the federated identity provider;
- or
- generating a report indicating that the relying party has not properly implemented the sign-out functionality.
14 more elements
Dependencies are inferred from the claim text.