Patent Application
20130283362
External tools expand longevity of legacy solutions. Integrated tools can enable an existing application to provide new functionality. An existing solution lacking modern functionality can add modern features through integrated tools. However, most third party tool solutions are custom developed and lack flexibility. Most legacy applications rarely provide standardized interfaces to integrate external tools. Vendors develop custom solutions to integrate external tools for inflexible legacy applications at great cost to a customer. Custom solutions are rarely portable or upgradeable. In addition, a typical vendor developing external tools spends significant resources to maintain in house legacy knowledge base. Legacy knowledge bases depreciate at alarming speed with each new product cycle and change in the technology.
User authentication schemes rarely work well across external tools and legacy applications. A user seeking access to protected resources in a legacy application is usually forced to authenticate separately for the external tool and the legacy application. The user is forced to break flow of a work process and provide duplicate credentials through multiple log-in processes. In addition, privileges usually do not propagate from the legacy application to the external tool. External tools can be forced to implement expansive and exotic authentication schemes to gain privileges to access protected resources of the legacy application. Forcing the user to manage multiple credentials for a single task complicates user productivity.
This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This summary is not intended to exclusively identify key features or essential features of the claimed subject matter, nor is it intended as an aid in determining the scope of the claimed subject matter.
Embodiments are directed to authenticating a user through a web extension using a token based authentication scheme. According to some embodiments, a web extension may retrieve a token from a client to authenticate a user. The token may be a user identity token containing attributes about a user. The web extension may transmit the token to a server component to authenticate the user. The server component of the web extension may be web service. The server component may validate the token. Validation may include verification of a unique user identifier contained in the token using a validation library. The server component may map the user to the token and authenticate the user upon validating the token.
These and other features and advantages will be apparent from a reading of the following detailed description and a review of the associated drawings. It is to be understood that both the foregoing general description and the following detailed description are explanatory and do not restrict aspects as claimed.
As briefly described above, a web extension may authenticate a user using a token based authentication scheme. The web extension may retrieve a token from a client application to authenticate the user. The web extension may transmit the token to its server component to authenticate the user. The server component may map the user to the token and authenticate the user upon validating the token.
In the following detailed description, references are made to the accompanying drawings that form a part hereof, and in which are shown by way of illustrations specific embodiments or examples. These aspects may be combined, other aspects may be utilized, and structural changes may be made without departing from the spirit or scope of the present disclosure. The following detailed description is therefore not to be taken in a limiting sense, and the scope of the present disclosure is defined by the appended claims and their equivalents.
While the embodiments will be described in the general context of program modules that execute in conjunction with an application program that runs on an operating system on a computing device, those skilled in the art will recognize that aspects may also be implemented in combination with other program modules.
Generally, program modules include routines, programs, components, data structures, and other types of structures that perform particular tasks or implement particular abstract data types. Moreover, those skilled in the art will appreciate that embodiments may be practiced with other computer system configurations, including hand-held devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, minicomputers, mainframe computers, and comparable computing devices. Embodiments may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.
Embodiments may be implemented as a computer-implemented process (method), a computing system, or as an article of manufacture, such as a computer program product or computer readable media. The computer program product may be a computer storage medium readable by a computer system and encoding a computer program that comprises instructions for causing a computer or computing system to perform example process(es). The computer-readable storage medium is a computer-readable memory device. The computer-readable storage medium can for example be implemented via one or more of a volatile computer memory, a non-volatile memory, a hard drive, a flash drive, a floppy disk, or a compact disk, and comparable media.
Throughout this specification, the term “platform” may be a combination of software and hardware components for authenticating a user through a web extension using a token based authentication scheme. Examples of platforms include, but are not limited to, a hosted service executed over a plurality of servers, an application executed on a single computing device, and comparable systems. The term “server” generally refers to a computing device executing one or more software programs typically in a networked environment. However, a server may also be implemented as a virtual server (software programs) executed on one or more computing devices viewed as a server on the network. More detail on these technologies and example operations is provided below.
A web extension 106 may authenticate a user 112 attempting to access protected resources of a client application 108 through the web extension 106. The user may initiate the web extension 106 in the client application 108 to perform added functionality provided by the web extension 106. The added functionality may attempt to access protected resources in the client application 108. The client application 108 may demand the web extension 106 to authenticate the user 112.
The web extension may communicate with the client using an application programming interface (API) 110 to request a token. The token may contain identifier information about the user. The token may be transmitted to a server component 104 of the web extension at a server 102 to authenticate the user. The server component 104 such as a web service may validate the token and authenticate the user in server 102. The web extension 106 may communicate with the server component 104 using any standard or proprietary format and communication protocol, for example, extensible markup language (XML) formatted hypertext transport protocol (HTTP) or even binary.
Embodiments are not limited to implementation in a client-server type architecture. A web extension may authenticate a user using a token based authentication scheme in a peer-to-peer, distributed, cloud based, and combination type architecture. In an example scenario, the web extension may implement client and server components entirely in a client device while merging server and client functionality.
Some embodiments enable a server component and a client application to use different identity providers for their user population to sign-on, and provide a mechanism to securely link the same user of both systems. A conventional server component would have to also integrate with the identity provider of the client, which may be a substantial change for the server component. Thus, a client and a server component may have separate identity providers to provide logon to their users.
When a user initiates a web extension 208 to interact with a client application 206, the client application may demand the web extension 208 to authenticate the user. The web extension 208 may retrieve a token identifying the user 210 from the client application. The web extension may determine a unique user identifier in the token. A signature may be determined in the token signed with a certificate from a server 202. A formatting using a script object notation standard or any other form may be detected in the token. In addition, the token may not be encrypted. The token may be determined in an unencrypted state to simplify the authentication scheme by avoiding complex encryption methodologies.
The web extension may transmit the token to a server component 204 of the web extension 208 to authenticate the token. The server component 204 may be a web service. The server component 204 may validate the token automatically using a validation library (i.e.: validation API). The server component may also validate the token manually by retrieving a public key from a server 202 hosting public keys.
Upon validating the token, the server component may extract the unique user identifier from the token. The server component may authenticate the user using the unique user identifier. If the unique user identifier is not found, the server component may request the web extension to prompt the user to log in and provide credentials. When the user provides credentials to the web extension, the web extension may transmit the credentials to the server component.
The server component may verify the user by matching the credentials to a set of registered users. If the server component cannot locate the user, the server component may notify the user that the credentials were not matched. If the server component matches the credentials to the set of registered users, the server component may create a mapping for the user and the token by using a uniform resource locator (URL) of a public or a private key used to sign the token. Next, the server component may inform the web extension 208 that the token was accepted and the user was authenticated.
A client application according to embodiments may create a token that has specific information that can be used to create an application-specific unique identifier for a user that the server component uses to create a unique tuple of {user-id; client-id} for connecting and later matching a connected user. In one example, the client-id may be the URL of where the key material is distributed to validate the token. In another example, the client component (that creates the token) may use either the native to the client user identifier (e.g. e-mail address) or create a unique hash using information from the server component that is registered in the client application, thus not providing even the user's identifier in the client application.
The authentication scheme may be optimized by caching a public key retrieved for authenticating the token for an extended predetermined time. If validation with the public key fails then the server component may retrieve a new public key at a URL associated with the public key.
In addition, a token may be valid for a predetermined time. Server component may avoid validating the token during the predetermined time, treat the token as a cookie or cache the token. Furthermore, single sign-on based user authentication may also be supported by using the token to authenticate the user interacting with the web extension.
In some examples, the token indicates that the user can trust that the URL where they fetched the public key (the URL which is signed into the token) is the same as one who signed it and represents the partner hosting system on the other end. It can also be assumed that the service performed its duty authenticating the user on its end. If the user is moved to another related system (e.g., from on-premise to cloud in a hybrid tenant), they may keep the same “user id” but the URL where to fetch the public key may change (e.g., to the cloud service).
Once the mapping is established, a user does not need to provide credentials for the same application across multiple devices. As long as it is the same application and the same user, the authentication may work regardless of which computing device the application is active on.
A server component may determine an availability of a validation library after receiving the token to authenticate the user. If the server component determines the availability of the validation library, the server component may verify authority of an issuing server over the unique user identifier in the token. The server component may affirm that the token is not expired. Next, the server component may verify that the token correctly addresses an associated client application.
If the server component may determine an unavailability of the validation library, the server component may affirm that the token is not expired. Next, the server component may validate that an audience parameter of the token corresponds to an URL pointing to the web extension. The server component may also retrieve a public key to validate a signature of the token. The token may be validated using the signature by determining a validity of a certificate encompassing the signature.
The example scenarios and schemas in
As discussed above, a web extension may authenticate a user using a token based authentication scheme. A web extension may retrieve a token from a client application to authenticate the user. The token may be transmitted to a server component which may validate the token in order to authenticate the user. The user may be mapped to the token and authenticated upon validation. Client devices 411-413 may enable access to applications executed on remote server(s) (e.g. one of servers 414) as discussed previously. The server(s) may retrieve or store relevant data from/to data store(s) 419 directly or through database server 418.
Network(s) 410 may comprise any topology of servers, clients, Internet service providers, and communication media. A system according to embodiments may have a static or dynamic topology. Network(s) 410 may include secure networks such as an enterprise network, an unsecure network such as a wireless open network, or the Internet. Network(s) 410 may also coordinate communication over other networks such as Public Switched Telephone Network (PSTN) or cellular networks. Furthermore, network(s) 410 may include short range wireless networks such as Bluetooth or similar ones. Network(s) 410 provide communication between the nodes described herein. By way of example, and not limitation, network(s) 410 may include wireless media such as acoustic, RF, infrared and other wireless media.
Many other configurations of computing devices, applications, data sources, and data distribution systems may be employed to authenticate a user through a web extension using a token based authentication scheme. Furthermore, the networked environments discussed in
An application may use the web extension 522 to authenticate the user using a token based authentication scheme according to embodiments. The web extension 522 may transmit a token retrieved from the client application to a server component to authenticate the user. The server component 524 may validate the token, map the user to the token, and authenticate the user. This basic configuration is illustrated in
Computing device 500 may have additional features or functionality. For example, the computing device 500 may also include additional data storage devices (removable and/or non-removable) such as, for example, magnetic disks, optical disks, or tape. Such additional storage is illustrated in
Computing device 500 may also contain communication connections 516 that allow the device to communicate with other devices 518, such as over a wireless network in a distributed computing environment, a satellite link, a cellular link, and comparable mechanisms. Other devices 518 may include computer device(s) that execute communication applications, storage servers, and comparable devices. Communication connection(s) 516 is one example of communication media. Communication media can include therein computer readable instructions, data structures, program modules, or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and includes any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media.
Example embodiments also include methods. These methods can be implemented in any number of ways, including the structures described in this document. One such way is by machine operations, of devices of the type described in this document.
Another optional way is for one or more of the individual operations of the methods to be performed in conjunction with one or more human operators performing some. These human operators need not be co-located with each other, but each can be only with a machine that performs a portion of the program.
Process 600 may begin with operation 610 where the web extension may retrieve a token from a client application to authenticate a user. The token may include a unique user identifier associated with the user. The token may be transmitted to a server component to authenticate the user at operation 620. The server component may request the web extension to prompt the user to provide credentials if the unique user identifier specifies an unknown user. At operation 630, the server component may validate the token. The token may be validated using a validation library or a public key based manual validation scheme. Next, the server component may map the user to the token and authenticate the user at operation 640.
Some embodiments may be implemented in a computing device that includes a communication module, a memory, and a processor, where the processor executes a method as described above or comparable ones in conjunction with instructions stored in the memory. Other embodiments may be implemented as a computer readable storage medium with instructions stored thereon for executing a method as described above or similar ones.
The operations included in process 600 are for illustration purposes. Authenticating a user through a web extension using a token based authentication scheme, according to embodiments, may be implemented by similar processes with fewer or additional steps, as well as in different order of operations using the principles described herein.
The above specification, examples and data provide a complete description of the manufacture and use of the composition of the embodiments. Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims and embodiments.
This application claims the benefit of U.S. Provisional Patent Application Ser. No. 61/635,404 filed on Apr. 19, 2012. The disclosures of the provisional patent application are hereby incorporated by reference for all purposes.
| Number | Date | Country | |
|---|---|---|---|
| 61635404 | Apr 2012 | US |
