# US 8,544,074 B2 · Federated realm discovery > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,544,074 B2 - Document ID: US8544074B2 - Status: Granted - Kind: B2 - Application number: 12/141,940 - Filed: 2008-06-19 - Published: 2009-12-24 - Granted: 2013-09-24 - Earliest claimed: 2008-06-19 - Assignees: Microsoft Corporation - Applicants: Wei-Qiang Guo; Lynn Ayres; Rui Chen; Sarah Faulkner; Yordan Rouskov - Inventors: Wei-Qiang Guo; Lynn Ayres; Rui Chen; Sarah Faulkner; Yordan Rouskov - Web page: https://patentgrep.com/patent/US8544074B2 ## CPC - H04L 63/0815: {providing single-sign-on or federations} - G06F 16/951: Indexing; Web crawling techniques - G06F 21/41: where a single sign-on provides access to a plurality of computers - G06F 21/606: {by securing the transmission between two devices or processes} - G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself} - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 63/101: {Access control lists [ACL]} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A federated realm discovery system within a federation determines a “home” realm associated with a portion of the user's credentials before the user's secret information (such as a password) is passed to a non-home realm. A login user interface accepts a user identifier and, based on the user identifier, can use various methods to identify an account authority service within the federation that can authenticate the user. In one method, a realm list of the user device can be used to direct the login to the appropriate home realm of the user. In another method, an account authority service in a non-home realm can look up the user's home realm and provide realm information directing the user device to login at the home realm. ## Claims ### Claim 1 A method comprising: obtaining a system security token for a user when the user signs in to an enterprise network using domain-joined credentials, the domain-joined credentials including an identifier of the user; automatically transmitting a request for authentication to a home security authority of the user, the request including the system security token, the home security authority of the user associated with a first realm, and the user having an account with the first realm; receiving a partner security token in response to transmitting the request for authentication; submitting the partner security token to a non-home security authority associated with a network service responsive to the user navigating to the network service, the non-home security authority and the network service associated with a second realm, and the user not having an account with the second realm, the first realm and the second realm being members of a federation; receiving from the non-home security authority a security token for accessing the network service, the user having an account with the home security authority but not with the non-home security authority; and accessing the network service using the security token received from the non-home security authority and without presenting a login user interface of the non-home security authority or the home security authority to the user. ### Claim 2 (depends on 1) The method of claim 1 further comprising identifying the home security authority based on at least a portion of the identifier of the user received in the domain-joined credentials. ### Claim 3 (depends on 2) The method of claim 2 wherein the identifying further comprises identifying the home security authority of the user in a local realm list datastore using the at least a portion of the identifier of the user. ### Claim 4 (depends on 2) The method of claim 2 wherein the identifying further comprises: submitting the at least a portion of the identifier of the user to a security authority of the enterprise network; receiving from the security authority of the enterprise network realm information identifying the home security authority of the user from a realm list datastore accessible to the user of the enterprise network. ### Claim 5 (depends on 1) The method of claim 1 further comprising authenticating the user with a security authority of the enterprise network using the domain-joined credentials prior to receiving the partner security token. ### Claim 6 (depends on 1) The method of claim 1 further comprising presenting to the user an enterprise network login user interface. ### Claim 7 (depends on 1) The method of claim 1 further comprising: storing the partner security token in a user device used to access the enterprise network responsive to receiving the partner security token. ### Claim 8 A computer-readable storage memory device having computer-executable instructions for performing a method comprising: obtaining a system security token for a user when the user signs in to an enterprise network using domain-joined credentials, the domain-joined credentials including an identifier of the user; identifying a home security authority of the user based on at least a portion of the identifier of the user, the home security authority of the user associated with a first realm, and the user having an account with the first realm; automatically transmitting a request for authentication to the home security authority of the user, the request including the system security token; receiving a partner security token in response to transmitting the request for authentication; submitting the partner security token to a non-home security authority associated with a network service responsive to the user navigating to the network service, the non-home security authority and the network service associated with a second realm, and the user not having an account with the second realm, the first realm and the second realm being members of a federation; receiving from the non-home security authority a security token for accessing the network service, the user having an account with the home security authority but not with the non-home security authority, and the home security authority and the non-home security authority being members of a federation; and accessing the network service using the security token received from the non-home security authority and without presenting a login user interface of the non-home security authority or the home security authority to the user. ### Claim 9 (depends on 8) The computer-readable storage memory device of claim 8 wherein the obtaining further comprise signing into the enterprise network through an enterprise network login user interface using the domain-joined credentials. ### Claim 10 (depends on 8) The computer-readable storage memory device of claim 8 wherein the identifying further comprises identifying the home security authority of the user in a local realm list datastore using the at least a portion of the identifier of the user. ### Claim 11 (depends on 8) The computer-readable storage memory device of claim 8 wherein the identifying further comprises: submitting the at least a portion of the identifier of the user to a security authority of the enterprise network; and receiving from the security authority of the enterprise network realm information identifying the home security authority of the user from a realm list datastore accessible to the user of the enterprise network. ### Claim 12 (depends on 8) The computer-readable storage memory device of claim 8 wherein the method further comprises authenticating the user with a security authority of the enterprise network using the domain-joined credentials prior to receiving the partner security token. ### Claim 13 (depends on 8) The computer-readable storage memory device of claim 8 wherein the method further comprises presenting to the user an enterprise network login user interface. ### Claim 14 (depends on 8) The computer-readable storage memory device of claim 8 wherein the method further comprises storing the partner security token in a user device used to access the enterprise network responsive to receiving the partner security token. ### Claim 15 A computing device comprising: a processor; and a computer-readable storage medium having computer-executable instructions that, when executed by the processor, perform a method comprising: obtaining a system security token for a user when the user signs in to an enterprise network using domain-joined credentials, the domain-joined credentials including an identifier of the user; automatically transmitting a request for authentication to a home security authority of the user, the request including the system security token, the home security authority of the user associated with a first realm, and the user having an account with the first realm; receiving a partner security token in response to transmitting the request for authentication; submitting the partner security token to a non-home security authority associated with a network service responsive to the user navigating to the network service, the non-home security authority and the network service associated with a second realm, and the user not having an account with the second realm, the first realm and the second realm being members of a federation; receiving from the non-home security authority a security token for accessing the network service, the user having an account with the home security authority but not with the non-home security authority; and accessing the network service using the security token received from the non-home security authority and without presenting a login user interface of the non-home security authority or the home security authority to the user. ### Claim 16 (depends on 15) The computing device of claim 15 wherein the method further comprises identifying the home security authority based on at least a portion of the identifier of the user received in the domain-joined credentials. ### Claim 17 (depends on 16) The computing device of claim 16 wherein the identifying further comprises identifying the home security authority of the user in a local realm list datastore using the at least a portion of the identifier of the user. ### Claim 18 (depends on 16) The computing device of claim 16 wherein the identifying further comprises: submitting the at least a portion of the identifier of the user to a security authority of the enterprise network; receiving from the security authority of the enterprise network realm information identifying the home security authority of the user from a realm list datastore accessible to the user of the enterprise network. ### Claim 19 (depends on 15) The computing device of claim 15 wherein the method further comprises authenticating the user with a security authority of the enterprise network using the domain-joined credentials prior to receiving the partner security token. ### Claim 20 (depends on 15) The computing device of claim 15 wherein the method further comprises presenting to the user an enterprise network login user interface.