Pluggable token provider model to implement authentication across multiple web services
AssigneeMicrosoft Corporation
InventorsRanjith Narayanan, Rui Liang, Srivatsa Srinivasan
Life of this patent
Estimating the term…
Abstract
A pluggable token provider model for message level authentication across multiple web services is provided. Web service and token provider implementations within a client application are separated from an actual component that operates the business logic to formulate and understand a web request. The web service components may request web services to be executed and supply the body for the web service message while a common framework maintains the web services metadata, which includes definitions associated with respective tokens. The framework may further maintain token provider implementations that actually fetch authentication tokens and perform the web requests.
Claims19
A method to be executed at least in part in a computing device for message level authentication across multiple web services through a pluggable token provider model, the method comprising:
- receiving a web service request from a local web service component at a client application;
- locating metadata associated with the requested web service, wherein the metadata includes information associated with execution and authentication of the requested web service;
- parsing the metadata into a plurality of binding entries;
- when a credential is associated with the requested web service, retrieving the credential;
- based on the credential, selecting an appropriate binding entry from the plurality of binding entries, wherein the plurality of binding entries includes at least one from a set of:
- a resource identifier against which the web service request is to be made, operation and action information to be included in a web service message, an authentication type supported by the resource, security policy information corresponding to the resource, and a token provider identification based on a token issuer identifier in the security policy;
- retrieving a token associated with the retrieved credential;
- authenticating the requested web service based on the retrieved token and the selected binding entry;
- and
- when the authentication is successful, performing the requested web service.
A unified communication system employing message level authentication across multiple web services through a pluggable token provider model, the system comprising:
- a server configured to:
- manage communications between internal and external resources of the unified communication system and a plurality of client applications;
- a client device executing a client application, the client application including:
- at least one web service component;
- at least one token provider component representing token issuers interacting with the client application;
- a metadata model component for retrieving metadata from a web service, wherein the metadata includes information associated with execution and authentication of a requested web service;
- and
- a web service manager component configured to:
- retrieve the metadata from the metadata model component,
- cycle through a plurality of bindings parsed from the metadata by the metadata model component, wherein the plurality of binding entries includes at least one from a set of:
- a resource identifier against which the web service request is to be made, operation and action information to be included in a web service message, an authentication type supported by the resource, security policy information corresponding to the resource, and a token provider identification based on a token issuer identifier in the security policy,
- select one of the bindings based on the requested web service and associated authentication type, and
- construct an actual web service request.
A computer storage device with instructions stored thereon for employing message level authentication across multiple web services through a pluggable token provider model, the instructions comprising:
- receiving a payload of a web service call to be made from a web service component of a client application;
- extracting a base identifier of the call;
- calling into a meta data model component requesting web service metadata;
- upon retrieval of the metadata, cycling thorough available bindings in the metadata, wherein the available bindings in the metadata includes at least one from a set of:
- a resource identifier against which the web service request is to be made, operation and action information to be included in a web service message, an authentication type supported by the resource, security policy information corresponding to the resource, and a token provider identification based on a token issuer identifier in the security policy;
- selecting an appropriate binding based on a requested operation and an authentication type depending on a credential associated with the requested web service;
- and
- fetching a token associated with the credential such that an actual web service request is constructed.
Dependencies are inferred from the claim text.