Cross-domain authentication
AssigneeGoogle Inc.
InventorsKevin Kai-Wei Chang, Nicholas Austin White
Life of this patent
Estimating the term…
Abstract
A user using a browser having stored authentication information for a web service in a first domain is authenticated to a web service in a second domain. The browser is provided with computer program instructions causing the browser to transparently provide the stored authentication information to the service in the first domain, receive cross-domain authentication credentials from the service in the first domain, and provide the cross-domain authentication credentials to the service in the second domain. The service in the second domain validates the cross-domain authentication credentials. If the credentials validate, the service in the second domain transparently provides the user with authenticated access.
Claims22
A method of authenticating a user to a web service in a second domain, the user using a browser having a stored browser authentication cookie issued by a web service in a first domain, wherein the first domain and the second domain are different second-level Internet domains, and wherein the browser is configured to prevent the web service in the second domain from accessing a cookie created by the web service in the first domain, the method comprising:
- the web service in the second domain providing the browser with computer program instructions causing the browser to transparently:
- provide the stored browser authentication cookie to the web service in the first domain;
- receive, responsive to successful validation of the browser authentication cookie by the web service in the first domain, cross-domain authentication credentials from the web service in the first domain;
- and
- provide the cross-domain authentication credentials to the web service in the second domain;
- validating the cross-domain authentication credentials;
- and
- providing the user with authenticated access to the web service in the second domain responsive at least in part to successful validation of the cross-domain authentication credentials.
A computer system for authenticating a user to a web service in a second domain, the user using a browser having a stored browser authentication cookie issued by a web service in a first domain, wherein the first domain and the second domain are different second-level Internet domains, and wherein the browser is configured to prevent the web service in the second domain from accessing a cookie created by the web service in the first domain, comprising:
- a processor for executing computer program instructions;
- a non-transitory computer-readable storage medium storing executable computer program instructions comprising:
- a cross-domain interaction module configured to provide the browser with computer program instructions causing the browser to transparently:
- provide the stored browser authentication cookie to the web service in the first domain;
- receive, responsive to successful validation of the browser authentication cookie by the web service in the first domain, cross-domain authentication credentials from the web service in the first domain;
- and provide the cross-domain authentication credentials to the web service in the second domain;
- a credentials validation module configured to validate the cross-domain authentication credentials;
- and an access control module configured to provide the user with authenticated access to the web service in the second domain responsive at least in part to successful validation of the cross-domain authentication credentials.
A non-transitory computer-readable storage medium storing executable computer program instructions for authenticating a user to a web service in a second domain, the user using a browser having a stored browser authentication cookie issued by a web service in a first domain, wherein the first domain and the second domain are different second-level Internet domains, and wherein the browser is configured to prevent the web service in the second domain from accessing a cookie created by the web service in the first domain, the instructions comprising:
- a cross-domain interaction module configured to provide the browser with computer program instructions causing the browser to transparently:
- provide the stored browser authentication cookie to the web service in the first domain;
- receive, responsive to successful validation of the browser authentication cookie by the web service in the first domain, cross-domain authentication credentials from the web service in the first domain;
- and
- provide the cross-domain authentication credentials to the web service in the second domain;
- a credentials validation module configured to validate the cross-domain authentication credentials;
- and
- an access control module configured to provide the user with authenticated access to the web service in the second domain responsive at least in part to successful validation of the cross-domain authentication credentials.
A method of authenticating a user to a web service in a second domain, the user using a browser having stored authentication information for a web service in a first domain, wherein the first domain and the second domain are different second-level Internet domains, and wherein the browser is configured to prevent the web service in the second domain from accessing a cookie created by the web service in the first domain, the method comprising:
- receiving an activation module having computer program instructions for transparently performing cross-domain authentication of the user;
- executing the activation module;
- and
- responsive at least in part to execution of the activation module:
- providing the stored authentication information to the web service in the first domain;
- receiving cross-domain authentication credentials from the web service in the first domain;
- and
- providing the cross-domain authentication credentials to the web service in the second domain.
Dependencies are inferred from the claim text.