Flexible authentication for online services with unreliable identity providers

A flexible authentication system for authenticating a user in the event of an unreliable identity provider, the system comprising:

• a processor and memory configured to execute software instructions embodied within the following components;
• a user login component that receives requests to authenticate users to use one or more online services provided by a relying party;
• an outage detection component that detects an event that causes an identity provider that provides authentication services to the relying party to be unavailable for handling one or more received authentication requests;
• a federated authentication component that sends to an identity provider authentication requests on behalf of the relying party that offloads authentication handling to the identity provider and receives an authentication response that verifies the user's digital identity;
• a token generation component that generates a temporary token that validates the user's digital identity, has a limited lifetime, and allows the user in possession of the token to access one or more online services of the relying party without authenticating with an identity provider and without the relying party storing local security credentials on behalf of the user;
• a token communication component that accesses information about a contact point associated with the user and communicates the generated temporary token to at least one contact point based on the accessed information;
• a token receiving component that receives a request from a user to access an online service of the relying party, wherein the request includes the token previously generated and communicated to the user at the one or more contact points;
• a token validation component that validates a received temporary token by determining the user identity associated with the token and verifying that the token is being used during the token's valid lifetime;
• and
• a user access component that provides one or more users access to the online services of the relying party based on a received and validated temporary token.

A computer-readable storage medium comprising instructions for controlling a computer system to authenticate a user to access a service while an identity provider for the user is unavailable, wherein the instructions, upon execution, cause a processor to perform actions comprising:

• receiving a temporary token from a user the token previously issued by a relying party operating an online service that normally relies upon a third-party identity provider to provide authentication services;
• retrieving user identity information from the received temporary token that identifies a user profile stored by the relying party that is associated with the user providing the token;
• determining that the token is a token validly issued by the relying party;
• determining a valid lifetime of the received temporary token and that the token is not expired;
• and
• allowing the user to access the online service based on the user's access rights and the user's authenticated identity verified by the user's possession of the temporary token and without the relying party separately storing security credentials for the user.