Method for using OpenID connect to manage access to data with rights granted by multiple authentication providers
AssigneeSonitor Technologies AS
InventorsPer Kristian Gjermshus, D{hacek over (z)}iugas Baltrūnas, Tommy Svendsen
Life of this patent
Estimating the term…
Abstract
An approach to allow cloud-based positioning systems to use their own identity provider. An extra field is included in a token that is used to look up the identity provider for token verification for each user. Each access claim of the access token is checked for invalidity. If no invalid claims are found, accepting the authorization request. If an invalid claim is found, rejecting the authorization request.
Claims22
A method of validating an authorization request comprising:
- receiving, from a user, an access token, the access token having been issued by an identity provider and provided to the user;
- extracting an identity provider identifier from the access token;
- validating the access token by using the identity provider identifier as a key in a database to confirm the identity provider is a known identity provider;
- further validating the access token using keys obtained from a JSON Web Token (JWT) key set of the known identity provider;
- checking each access claim of the access token for invalidity;
- and
- if no invalid claims are found, accepting the authorization request.
A computer-implemented method for validating an authorization request, the computer-implemented method comprising:
- receiving, from a user, an access token, the access token having been issued by an identity provider and provided to the user;
- extracting an identity provider identifier from the access token;
- validating the access token by using the identity provider identifier as a key in a database to confirm the identity provider is a known identity provider;
- further validating the access token using keys obtained from a JSON Web Token (JWT) key set of the known identity provider;
- checking each access claim of the access token for invalidity;
- and
- if no invalid claims are found, accepting the authorization request.
A services provision system comprising at least one processor and a memory coupled to the at least one processor, the at least one processor configured to:
- receive, from a user, an access token, the access token having been issued by an identity provider and provided to the user;
- extract an identity provider identifier from the access token;
- validate the access token by using the identity provider identifier as a key in a database to confirm the identity provider is a known identity provider;
- further validate the access token using keys obtained from a JSON Web Token (JWT) key set of the known identity provider;
- check each access claim of the access token for invalidity;
- and
- if no invalid claims are found, accept the authorization request.
Dependencies are inferred from the claim text.