# US 11,308,193 B2 · System and method for translating custom entitlements

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,308,193 B2
- Document ID: US11308193B2
- Status: Granted
- Kind: B2
- Application number: 16/557,051
- Filed: 2019-08-30
- Published: 2021-03-04
- Granted: 2022-04-19
- Earliest claimed: 2019-08-30
- Assignees: JPMorgan Chase Bank, N.A.
- Applicants: JPMorgan Chase Bank, N.A.
- Inventors: Brooke Koskinen; Imamuddin H. Syed; William Loughery
- Web page: https://patentgrep.com/patent/US11308193B2

## CPC

- G06F 21/41: where a single sign-on provides access to a plurality of computers
- G06F 21/335: {for accessing specific resources, e.g. using Kerberos tickets}
- G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

An embodiment of the present invention is directed to a translation layer that intercepts a token and converts new group names into old entitlement verbiage based on data loaded at start-up (e.g., hash map, etc.) from a configuration file. The old entitlement verbiage may be loaded into the User Session just as it would have been if the entitlements had come from within the old application authorization structure. The remainder of the application is unaware that the authorization source has changed.

## Claims

### Claim 1

A system that implements a translation layer that converts source groups into custom entitlements known by the application, the system comprising:
a computer processor configured to perform the steps of:
reading, via the computer processor, an inbound single sign-on token wherein the single sign-on token references one or more groups; and
translating, via a library component of the computer processor, the one or more groups to a corresponding entitlement based on injected mappings loaded at start-up;
storing, via the library component, the corresponding entitlements in a User Session; and
enabling, via the library component, the application to access the corresponding entitlements;
wherein the library component and the injected mappings are supported by a user interface that executes the application, and further wherein the library component uses a group name to return a corresponding entitlement to a main process to be loaded into a session object.

### Claim 2 (depends on 1)

The system of claim 1, wherein the single sign-on token comprises Active Directory Federation Services (ADFS) token and the one or more groups comprise Active Directory (AD) groups.

### Claim 3 (depends on 1)

The system of claim 1, further comprising a plug and play communication layer that enables the application to communicate with a central service.

### Claim 4 (depends on 3)

The system of claim 3, wherein the plug and play communication layer comprises a Java filter.

### Claim 5 (depends on 1)

The system of claim 1, wherein the corresponding entitlements comprise roles.

### Claim 6 (depends on 1)

The system of claim 1, wherein the corresponding entitlements comprise access permissions.

### Claim 7 (depends on 1)

The system of claim 1, wherein the library component supports session management.

### Claim 8 (depends on 1)

The system of claim 1, wherein the library component maintains session privileges.

### Claim 9 (depends on 1)

The system of claim 1, wherein the library component maintains session attributes.

### Claim 10

A method that implements a translation layer that converts source groups into custom entitlements known by the application, the method comprising the steps of:
receiving, via an input, an inbound single sign-on token wherein the single sign-on token references one or more groups;
translating, via a library component, the one or more groups to a corresponding entitlement based on injected mappings loaded at start-up;
storing the corresponding entitlements in a User Session; and
enabling the application to access the corresponding entitlements;
wherein the library component and the injected mappings are supported by a user interface that executes the application, and further wherein the library component uses a group name to return a corresponding entitlement to a main process to be loaded into a session object.

### Claim 11 (depends on 10)

The method of claim 10, wherein the single sign-on token comprises Active Directory Federation Services (ADFS) token and the one or more groups comprise Active Directory (AD) groups.

### Claim 12 (depends on 10)

The method of claim 10, further comprising the step of:
implementing a plug and play communication layer that enables the application to communicate with a central service.

### Claim 13 (depends on 12)

The method of claim 12, wherein the plug and play communication layer comprises a Java filter.

### Claim 14 (depends on 10)

The method of claim 10, wherein the corresponding entitlements comprise roles.

### Claim 15 (depends on 10)

The method of claim 10, wherein the corresponding entitlements comprise access permissions.

### Claim 16 (depends on 10)

The method of claim 10, wherein the library component supports session management.

### Claim 17 (depends on 10)

The method of claim 10, wherein the library component maintains session privileges.

### Claim 18 (depends on 10)

The method of claim 10, wherein the library component maintains session attributes.