# US 9,847,991 B2 · Method for managing user accounts in a hosted application > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,847,991 B2 - Document ID: US9847991B2 - Status: Granted - Kind: B2 - Application number: 15/311,009 - Filed: 2015-05-13 - Published: 2017-03-16 - Granted: 2017-12-19 - Earliest claimed: 2014-05-14 - Assignees: Evidian - Applicants: Evidian - Inventors: Christophe Guionneau - Web page: https://patentgrep.com/patent/US9847991B2 ## CPC - H04L 63/0815: {providing single-sign-on or federations} - G06F 21/41: where a single sign-on provides access to a plurality of computers - H04L 63/10: {for controlling access to devices or network resources} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for managing user accounts in an application of an application provider, includes: receiving a request for proof of authentication to authenticate a user attempting to access the application, the user being registered with an identity provider having a trust relationship with the application provider; obtaining, from a local database, user data including authentication data and access rights data; authenticating the user by the authentication data; determining the user right to access the application, by the access rights data; determining the existence or absence of a user account associated with the user, by querying an external database managed by the application provider; if the user has the right to access the application and there is no user account associated with the user: triggering provisioning of the user account at an entity, generating a proof of authentication associated with the user, sending the proof of authentication to the application provider. ## Claims ### Claim 1 A method for managing user accounts in an application of an application service provider, comprising the following steps, performed by an identity provider sharing a trust relationship with the application service provider: receiving a request for proof of authentication in order to authenticate a user attempting to access the application, said user being registered with the identity provider; obtaining, from a local database, data about the user, said data comprising authentication data and access rights data; authenticating the user by means of the authentication data; determining the right to access the application by the user by means of the access rights data; determining an existence or absence of a user account associated with the user, by querying an external database managed by the application service provider; when the user has the right to access the application and there is no user account associated with the user: triggering provisioning of the user account at an entity; generating a proof of authentication associated with the user; sending said proof of authentication to the application service provider. ### Claim 2 (depends on 1) The method according to claim 1, comprising: when the user does not have the right to access the application and there is a user account associated with the user, triggering deprovisioning of the user account at the entity. ### Claim 3 (depends on 1) The method according to claim 1, wherein the entity is the application service provider, the identity provider providing account provisioning or deprovisioning instructions to the external database. ### Claim 4 (depends on 1) The method according to claim 1, wherein the entity is an external management component, the external management component providing account provisioning or deprovisioning instructions to the external database. ### Claim 5 (depends on 1) The method according to claim 1, wherein after provisioning or deprovisioning triggering of a user account, the identity provider updates information of user accounts, indicating the user accounts associated with the application service provider and the user accounts associated with the user. ### Claim 6 (depends on 5) The method according to claim 5, wherein the identity provider performs an overall checking step, comprising: for each user registered with the identity provider, obtaining form the local database access rights data relating to the user; determining a list of user accounts to be deprovisioned, based on the access rights and the information of user accounts; triggering the deprovisioning of the user accounts from the list of accounts to be deprovisioned. ### Claim 7 (depends on 5) The method according to claim 5, wherein the identity provider performs a reconciliation step, comprising: obtaining from the external database a list of user accounts provisioned; comparing the information of user accounts with the list of accounts to be provisioned; updating the information of user accounts based on the result of the comparison. ### Claim 8 (depends on 5) The method according to claim 5, wherein the identity provider performs an account deletion step, comprising: obtaining a piece of information for modifying access rights data of a user; determining a list of user accounts to be deprovisioned, based on the access rights data modified and the information of user accounts; triggering the deprovisioning of the user accounts from the list of accounts to be deprovisioned. ### Claim 9 A non-transitory computer readable medium, comprising a set of instructions, which when run by a computer, causes the implementation of a method for managing user accounts in an application of an application service provider, comprising the following steps, performed by an identity provider sharing a trust relationship with the application service provider: receiving a request for proof of authentication in order to authenticate a user attempting to access the application, said user being registered with the identity provider; obtaining, from a local database, data about the user, said data comprising authentication data and access rights data; authenticating the user by means of the authentication data; determining the right to access the application by the user by means of the access rights data; determining an existence or absence of a user account associated with the user, by querying an external database managed by the application service provider; when the user has the right to access the application and there is no user account associated with the user: triggering provisioning of the user account at an entity; generating a proof of authentication associated with the user; sending said proof of authentication to the application service provider.