US 11,240,226 B2Granted

Synchronous multi-tenant single sign-on configuration

AssigneeInternational Business Machines Corporation

InventorsVinod A. Valecha, Vivek Jain, Deepak Rangnath Thorat

Life of this patent

Estimating the term…

Loading patent…

Abstract

A computer implemented method for synchronizing multi-tenant single sign-on configuration. Utilizing a combination layer that is configured a single time to interact with a trust application at an identity provider. The combination layer is also configured to interact with the service provider and manages the security token and authentication state of the user. The identity provider can create a single long-lived trust application that is only responsible for redirecting to the combination layer, rather than a creating plurality of short-lived applications that redirect to a service provider every time a user login request is received. Thus, resulting in improved utilization of computing resources at the identity provider.

Claims20

Dependent claims

A computer-implemented method for synchronizing multi-tenant single sign-on at an identify provider (IDP), the method comprising:

requesting, by one or more processors, access to a tenant resource at a service provider (SP) by a user via a security protocol;
creating, by the one or more processors, a user state;
storing, by the one or more processors, the user state;
transmitting, by the one or more processors, the user state to a combination layer;
transmitting, by the one or more processors, the user state from the combination layer to a trust application at the IDP;
validating, by the one or more processors, the user state information at the IDP;
responsive to valid user credentials, create, by the one or more processors, a user token at the IDP;
transmitting, by the one or more processors, the user token to the combination layer;
transmitting, by the one or more processors, the user token and the user state to the SP;
validating, by the one or more processors, the user state and the user token at the SP;
retrieving, by the one or more processors, a user profile at the SP that corresponds to the user state;
and
granting, by the one or more processors, access to the requested tenant resource at the SP.

10 more elements

A computer system for synchronizing multi-tenant single sign-on at an identify provider (IDP), the computer system comprising:

one or more computer processors;
one or more non-transitory computer readable storage media;
and
program instructions stored on the one or more non-transitory computer readable storage media for execution by at least one of the one or more computer processors, the program instructions comprising:
program instructions to request access to a tenant resource at a service provider (SP) by a user;
program instructions to create a user state;
program instructions to store the user state;
program instructions to transmit the user state to a combination layer;
program instructions to transmit the user state from combination layer to a trust application at the IDP;
program instructions to validate the user state information at the IDP;
responsive to valid user credentials, program instructions to create a user token at the trust application;
program instructions to transmit the user token to the combination layer;
program instructions to transmit the user token and the user state to the SP;
program instructions to validate the user state and the user token at the SP;
program instructions to retrieve a user profile at the SP that corresponds to the user state;
and
program instructions to grant access to the tenant resource at the SP.

14 more elements

A computer program product for synchronizing multi-tenant single sign-on at an identify provider (IDP), the computer program product comprising:

one or more non-transitory computer readable storage media and program instructions stored on the one or more computer readable storage media, the program instructions comprising:
program instructions to request access to a tenant resource at a service provider (SP) by a user;
program instructions to create a user state;
program instructions to store the user state;
program instructions to transmit the user state to a combination layer;
program instructions to transmit the user state from combination layer to a trust application at the IDP;
program instructions to validate the user state information at the IDP;
responsive to valid user credentials, program instructions to create a user token at the trust application;
program instructions to transmit the user token to the combination layer;
program instructions to transmit the user token and the user state to the SP;
program instructions to validate the user state and the user token at the SP;
program instructions to retrieve a user profile at the SP that corresponds to the user state;
and
program instructions to grant access to the tenant resource at the SP.

11 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/810,177Filed 5 Mar 2020
Published: US 2021/0281559 A19 Sep 2021
Granted: 1 Feb 2022
Term ends: Not estimatedThe source records don’t support an estimate.

Classification8 codes

H04L 63/0815
For authentication of entities: providing single-sign-on or federations
H04L 63/0853
For authentication of entities: using an additional device, e.g. smartcard, SIM or a different communication terminal
H04L 63/0884
For authentication of entities: by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity…
H04W 12/06
Security arrangements; Authentication; Protecting privacy or anonymity: authentication