# US 10,122,701 B2 · Cross-domain single login > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,122,701 B2 - Document ID: US10122701B2 - Status: Granted - Kind: B2 - Application number: 14/950,034 - Filed: 2015-11-24 - Published: 2017-05-25 - Granted: 2018-11-06 - Earliest claimed: 2015-11-24 - Assignees: Red Hat, Inc. - Applicants: Red Hat, Inc. - Inventors: Patrick Uiterwijk - Web page: https://patentgrep.com/patent/US10122701B2 ## CPC - H04L 63/0815: {providing single-sign-on or federations} - G06F 21/41: where a single sign-on provides access to a plurality of computers - G06F 21/42: using separate channels for security data - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Cross-domain single login is disclosed. In an example system, a first application server hosts a first application that has a first user-visible page. The first application server is configured to serve, the first user-visible page on a user device. The first application server is also configured to request a first hidden page. An authentication server is configured to receive a first hidden authentication request from the user device, to obtain a first authentication result, and send a first message to the user device. The first message may include the first authentication result obtained by the authentication server based on the first hidden authentication request. The user device is configured to send, a second message to the first user-visible page based on the first message. ## Claims ### Claim 1 A system comprising: a first application server hosting a first application having a first user-visible page, the first application server configured to: serve the first user-visible page, of the first application, on a user device, wherein the first application is configured to operate on a first domain, and the first user-visible page includes first user-specific content and first general content, and request a first hidden page of the first application; and an authentication server configured to: receive a first hidden authentication request from the user device, obtain a first authentication result, wherein the first authentication result includes one of a positive authentication result and a negative authentication result, send a first message to the user device, wherein the first message includes the first authentication result obtained by the authentication server based on the first hidden authentication request, and the user device is configured to send a second message to the first user-visible page based on the first message. ### Claim 2 (depends on 1) The system of claim 1, wherein the first application server is further configured to receive, a third message from the user device, wherein the third message is based on the first authentication result. ### Claim 3 (depends on 2) The system of claim 2, wherein the first application server is further configured to send a response based on the first authentication result to the user device. ### Claim 4 (depends on 1) The system of claim 1, wherein the user device is configured to update the first user-specific content of the first user-visible page upon receiving the first message based on the first authentication request having a positive authentication result, while the first general content remains unchanged. ### Claim 5 (depends on 4) The system of claim 4, wherein the first user-specific content is a least one of a user name and a user permission set. ### Claim 6 A method for providing cross-domain single login comprising: serving, by a first application server to a user device, a first user-visible page of a first application, wherein the first application is configured to operate on a first domain, and the first user-visible page includes first user-specific content and first general content; responsive to serving the first user-visible page of the first application, requesting, by the first application server, a first hidden page of the first application, wherein the user device is configured to: send a first hidden authentication request to an authentication server, and responsive to sending the first hidden authentication request, receive a first message from the authentication server, the first message including a first authentication result; and responsive to the user device sending the first hidden authentication request, receiving, by the first application server, a second message from the user device, wherein the second message is based on the first authentication result obtained by the authentication server based on the first hidden authentication request, and the first authentication result includes one of a positive authentication result and a negative authentication result. ### Claim 7 (depends on 6) The method of claim 6, further comprising: serving, by a second application server, a second user-visible page, of a second application, on the user device, wherein the second application is configured to operate on a second domain, wherein the second domain is different than the first domain, and the second user-visible page includes second user-specific content and second general content; responsive to serving the second user-visible page of the second application, requesting, by the second application server, a second hidden page of the second application, wherein the user device is configured to: send a second hidden authentication request to the authentication server, and responsive to sending the second hidden authentication request, receive a third message from the authentication server, the third message including a second authentication result; and responsive to sending the second hidden authentication request, receiving, by the second application server, a fourth message from the user device, wherein the fourth message is based on the second authentication result obtained by the authentication server based on the second hidden authentication request, and the second authentication result includes one of a positive authentication result and a negative authentication result. ### Claim 8 (depends on 6) The method of claim 6, further comprising redirecting, by the first application server, the first application from the first user-visible page to a third user-visible page based upon receiving a negative authentication result. ### Claim 9 (depends on 8) The method of claim 8, wherein the third user-visible page includes at least one login credential entry field. ### Claim 10 (depends on 6) The method of claim 6, wherein the first authentication request includes at least one of an authentication cookie, a kerberos ticket, and a stored device identity. ### Claim 11 A method for providing cross-domain single login comprising: receiving, by an authentication server, a first hidden authentication request from a first hidden page of a first application, wherein the first hidden page is rendered in response to a first application server requesting the first hidden page based on the first application server serving a first user-visible page of the first application, the first application is configured to operate on a first domain, and the first user-visible page includes first user-specific content and first general data; in response to receiving the first hidden authentication request, obtaining, by the authentication server, a first authentication result, wherein the first authentication result includes one of a positive authentication result and a negative authentication result; in response to obtaining the first authentication result, sending, by the authentication server, a first message to the first hidden page, wherein the first hidden page is configured to send a second message to the first user-visible page upon receiving the first message from the authentication server; receiving, by the authentication server, a second hidden authentication request from a second hidden page of a second application, wherein the second hidden page is rendered in response to a second application server requesting the second hidden page based on the second application server serving a second user-visible page of the second application, the second application is configured to operate on a second domain, wherein the second domain is different than the first domain, and the second user-visible page includes second user-specific content and general data; in response to receiving the second hidden authentication request, obtaining, by the authentication server, a second authentication result, wherein the second authentication result includes one of a positive authentication result and a negative authentication result; and in response to obtaining the second authentication result, sending, by the authentication server, a third message to the second hidden page, wherein, the second hidden page is configured to send a fourth message to the second user-visible page upon receiving the third message from the authentication server. ### Claim 12 (depends on 11) The method of claim 11, wherein the first hidden page is rendered in response to the first application server requesting the first hidden page based on the first application server serving a third user-visible page of the first application. ### Claim 13 (depends on 12) The method of claim 12, wherein the first user-visible page is a first uniform reference locator (URL) and the third user-visible page is a second URL. ### Claim 14 (depends on 11) The method of claim 11, wherein sending the first message having a positive authentication result causes the first user-visible page to update the first user-specific content of the first user-visible page. ### Claim 15 (depends on 14) The method of claim 14, wherein the first user-specific content is a least one of a user name and a user permission set. ### Claim 16 (depends on 11) The method of claim 11, wherein sending the first message having a negative authentication result causes the user device to update the first user-specific content of the first user-visible page to include a login button. ### Claim 17 (depends on 11) The method of claim 11, wherein the first authentication request and the second authentication request comprise at least one of an authentication cookie, a kerberos ticket, and a stored device identity. ### Claim 18 A non-transitory machine readable medium storing code, which when executed by a user device, is configured to: render a first user-visible page, of a first application, received from a first application server, wherein the first application is configured to operate on a first domain; receive a request for a first hidden page from the first application server; responsive to receiving the request for the first hidden page, render, the first hidden page, of the first application; send a first authentication request to an authentication server; responsive to sending the first hidden authentication request, receive, a first message, wherein the first message includes a first authentication result obtained by the authentication server based on the first hidden authentication request, wherein the first authentication result includes one of a positive authentication result and a negative authentication result; and responsive to receiving the first message from the authentication server, send, a second message to the first hidden page. ### Claim 19 (depends on 18) The non-transitory machine readable medium of claim 18, further configured to update user-specific content of the first user-visible page upon receiving the first message based on the first authentication request having a positive authentication result. ### Claim 20 (depends on 19) The non-transitory machine readable medium of claim 19, wherein the user-specific content is a least one of a user name and a user permission set.