# US 2014/0208401 A1 · State driven orchestration of authentication components in an access manager > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0208401 A1 - Document ID: US20140208401A1 - Status: Published application - Kind: A1 - Application number: 13/749,534 - Filed: 2013-01-24 - Published: 2014-07-24 - Earliest claimed: 2013-01-24 - Assignees: Oracle International Corporation - Applicants: Oracle International Corporation - Inventors: Aarathi Balakrishnan; Ramya Kukkehali Subramanya; Deepak Ramakrishnan - Web page: https://patentgrep.com/patent/US20140208401A1 ## CPC - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/102: {Entity profiles} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods and systems are described for state driven orchestration of authentication components to access a resource protected by an access manager framework. In response to a client request for a protected resource, relevant authentication components and their respective order are determined. Upon successful authentication of the first authentication component, proper state information of the authentication process is stored by the client indicating the next authentication component. In response to a request for additional credential information for the authentication process from the next authentication component, the client provides the stored state information so that the authentication process continues with the second authentication component according to the determined order of the authentication components within an authentication process. ## Claims ### Claim 1 A method for state driven orchestration of authentication components to access a resource protected by an access manager framework, comprising: receiving a request to access a resource from a client; determining required authentication components for the requested resource and a sequential order of the authentication components based at least in part upon the received access request; requesting a first set of credential information required for a first authentication component to authenticate the client requesting access to the resource; upon successful validation of the received first set of credential information, generating an authentication context including information indicating a second authentication component of the determined sequential order of the required authentication components, the authentication context stored at the client; requesting a second set of credential information required for the second authentication component to authenticate the client requesting access to the resource; receiving the second set of credential information along with the authentication context from the client; determining which authentication component is to receive the second set of credential information based at least in part upon the authentication context received from the client; and sending the second set of credential information to the second authentication component. ### Claim 2 (depends on 1) The method of claim 1, wherein the access manager framework is stateless and processes each received request independently from previous related requests. ### Claim 3 (depends on 1) The method of claim 1, wherein the resource includes an application. ### Claim 4 (depends on 1) The method of claim 1, wherein the authentication context is stored in an internet browser of the client. ### Claim 5 (depends on 1) The method of claim 1, wherein the authorization context is persisted in an authentication cookie. ### Claim 6 (depends on 1) The method of claim 1, wherein the authentication context is represented as a Java® object. ### Claim 7 (depends on 1) The method of claim 1, wherein at least one of the authentication components is an authentication plugin. ### Claim 8 (depends on 6) The method of claim 6, wherein the authentication plugin includes LDAP, RSA, KERBEROS, or X509 authentication plugins. ### Claim 9 (depends on 1) The method of claim 1, wherein at least one of the authentication components is developed by a third party developer. ### Claim 10 (depends on 1) The method of claim 1, wherein the sets of credential information received from the client include a username, password, date of birth, social security number, or one-time password. ### Claim 11 (depends on 1) The method of claim 1, further comprising: upon successful authentication of the received second set of credential information, generating a session to allow access of the requested resource to the client. ### Claim 12 (depends on 11) The method of claim 11, wherein the client is authorized to access other resources with substantially identical security requirements in the generated session. ### Claim 13 (depends on 1) The method of claim 1, further comprising: upon successful authentication of the received second set of credential information, generating additional information indicating successful authentication of the received second set of information. ### Claim 14 (depends on 1) The method of claim 1, further comprising: upon successful authentication of the received second set of credential information, requesting a third set of credential information required for authentication of a third authentication component within the determined sequential order. ### Claim 15 (depends on 1) A computer system executing instructions in a computer program, the computer program instructions comprising program code for performing the operations of claim 1. ### Claim 16 (depends on 1) A non-transitory machine-readable storage medium having instructions stored thereon, the instructions comprising program code for the operations of claim 1. ### Claim 17 (depends on 16) The non-transitory computer-readable storage medium of claim 16, wherein, the authentication context is persisted in an authentication cookie and stored in an internet browser of the client. ### Claim 18 (depends on 16) The non-transitory computer-readable storage medium of claim 16, wherein at least one of the authentication components is an authentication plugin from at least one of LDAP, RSA, KERBEROS, and X509 authentication plugins. ### Claim 19 A method comprising: receiving a request to access a resource from a client, access to the resource requiring a first authentication and a second authentication; authenticating the user on a web browser client at a server using a first authentication plugin; sending an encrypted cookie to the client based on the first authentication; requesting the encrypted cookie from the web browser client; bypassing the first authentication based on the received encrypted cookie and then authenticating the user on the web browser client using a second authentication plugin; and allowing access to the resources that requires the first and second authentications based on the received encrypted cookie and the second authentication using the second authentication plugin. ### Claim 20 A method comprising: authenticating a user on a web browser client at a server using a first authentication plugin; sending an encrypted cookie to the client based on the authentication; receiving a request to access a resource from the client, access to the resource requiring a first authentication and a second authentication; requesting the encrypted cookie from the web browser client; bypassing the first authentication based on the received encrypted cookie and then authenticating the user on the web browser client using a second authentication plugin; and allowing access to the resources that requires the first and second authentications based on the received encrypted cookie and authentication using the second authentication plugin.