Security architecture for authentication and audit

A method for centralizing authentication, authorization and audit (“AAA”) of user activities within a web services layer, said web services layer comprising a web interface, the method comprising:

• receiving at web services layer a user ID, a password, an ID token and a service request, said user ID, password and ID token being registered with a Ping security token service (“STS”);
• using the Ping STS to generate a one-time security assertion markup language(“SAML”) token, said SAML token expiring after a pre-determined time, said SAML token for enabling secure access to the web interface, said SAML token containing client identification and authorization of the service request, said authorization either authorizing or denying whether said web services layer is authorized to provide the requested service;
• transmitting said SAML token to the web services layer;
• authenticating the SAML token, said authenticating comprising accepting the previously-determined authorization at the web services layer;
• upon receiving previously-determined authorization, said web services layer performing the requested user operation;
• logging user actions at said web services layer, said logging comprising integrating the web services layer with a logging system such that the logging system enables searching and tracking of said user actions.

A centralized architecture for authentication, authorization and audit of user activities within a web services layer mechanism, the architecture comprising:

• a web services layer which is configured to receive a user ID, a password and an identification token (“ID”), said ID token being located in a header of a communication from a user;
• a Ping security token service (“STS”), said Ping STS configured to generate a one-time use(“OTU”) security assertion markup language (“SAML”) token;
• wherein the web services layer, upon receipt of the user ID, the password and the ID token, transmits said user ID, said password and said ID token to the Ping STS and receives, in response, a Boolean value indicating the response from Ping STS for authenticating the said user;
• said SAML token enabling the web services layer to authenticate a user;
• a central repository system (“CRS”), wherein, the web services layer is configured to transmit the resource requested and information from the SAML token to the CRS, said CRS to confirm, based on security level stored in the SAML token, permissibility of the request, said confirmation enabling the web services layer to either execute or deny the requested operation;
• and
• a user activity logging system, wherein the web services layer transmits a record of user activities to the logging system, said logging that enables searching and tracking of user activities.

A mechanism for consolidating communications between a computer tenant and a web services layer, said mechanism comprising:

• the web services layer, said web services layer configured to:
• receive communications, via an authentication validation module, from an authentication service, said authentication service in communication with the computer tenant and the web services layer;
• receive authorization data, via an authorization module, from an authorization data store, said authorization data store maintaining computer tenant authorization data;
• receive and transmit logged calls from a log database, said logged calls configured to store calls from the computer tenant to the web services layer and calls from the web services layer to the authentication server;
• wherein:
• when a computer tenant attempts to initiate communication with the web services layer, the computer tenant is configured to transmit the user id and password to Ping STS and get the token to the web services layer;
• upon receipt, by the web services layer, of the token and the initiation attempt, the web services layer is configured to validate the token;
• and
• upon validation of the token, the web services layer authenticates the computer tenant, said SAML token enabling the user to authenticate itself within the web services layer.