Method and apparatus for end-to-end identity propagation
AssigneeOracle International Corporation
InventorsGaurav Bhatia, Arun Swaminathan
Life of this patent
Estimating the term…
Abstract
One embodiment of the present invention provides a system that facilitates end-to-end identity propagation to a backend-tier application that is not single sign-on enabled. During operation, the system receives request from a user at a middle-tier application to access private data from the backend-tier application. Upon receiving this request, the system redirects the user to a single sign-on server that verifies authentication credentials of the user. The middle-tier application then receives a token from the single sign-on server authorizing access to a backend-tier application. Next, the middle-tier application uses the token to access the private data from the backend-tier application, and then provides the private data to the user.
Claims16
A method for end-to-end identity propagation to a backend-tier application that is not single sign-on enabled, comprising:
- receiving a request from a user at a middle-tier application to access private data from the backend-tier application;
- redirecting the user to a single sign-on server;
- receiving a token from the single sign-on server, wherein the token is used to verify the user's identity;
- presenting the token to the backend-tier application to prove that the middle-tier is authorized to act as the user's proxy;
- performing a proxy switch, thereby causing the middle-tier application to act as the user's proxy;
- accessing the private data from the backend-tier application;
- and
- providing the private data to the user.
An apparatus for end-to-end identity propagation to a backend-tier application that is not single sign-on enabled, comprising:
- a receiving mechanism configured to receive a request from a user at a middle-tier application to access private data from the backend-tier application;
- a redirecting mechanism configured to redirect the user to a single sign-on server;
- wherein the receiving mechanism is further configured to receive a token from the single sign-on server, wherein the token is used to verify the user's identity;
- a presenting mechanism configured to present the token to the backend-tier application to prove that the middle-tier is authorized to act as the user's proxy;
- a proxy-switching mechanism configured to perform a proxy switch, thereby causing the middle-tier application to act as the user's proxy;
- an accessing mechanism configured to access the private data from the backend-tier application;
- and
- a providing mechanism configured to provide the private data to the user.
Dependencies are inferred from the claim text.