Patent Application
20090007250
Generally, client applications may need to authenticate to a remote server to operate. In some situations multiple applications may need to authenticate to a common authentication provider. Existing computer operating systems may accommodate multiple authentication requests for the same authentication provider by initiating a new authentication session with the authentication provider for each authentication request received from a client application. Each authentication session may require that a user provide user credentials, such as a user login and password, to authenticate to the authentication provider. Because a user may open multiple applications or multiple instances of the same application (all of which require authentication to the common authentication provider), a user may need to provide the same user credentials (e.g., user login and password) multiple times during a computing session. This may be cumbersome and inefficient.
The claimed method and system provides a client authentication distributor component (CAD) that handles single or multiple client application requests for authentication to a common authentication provider. The CAD may be responsible for collecting client credentials for use in maintaining an authentication state. The CAD may provide indications of an authentication state, a connection state or change in an authentication state or connection state. As multiple applications or multiple application instances request authentication to the common authentication provider, the CAD may provide a local client authentication service in place of the authentication provider after an initial authentication process.
Although the following text sets forth a detailed description of numerous different embodiments, it should be understood that the legal scope of the description is defined by the words of the claims set forth at the end of this patent. The detailed description is to be construed as exemplary only and does not describe every possible embodiment since describing every possible embodiment would be impractical, if not impossible. Numerous alternative embodiments could be implemented, using either current technology or technology developed after the filing date of this patent, which would still fall within the scope of the claims.
It should also be understood that, unless a term is expressly defined in this patent using the sentence “As used herein, the term ‘______’ is hereby defined to mean . . . ” or a similar sentence, there is no intent to limit the meaning of that term, either expressly or by implication, beyond its plain or ordinary meaning, and such term should not be interpreted to be limited in scope based on any statement made in any section of this patent (other than the language of the claims). To the extent that any term recited in the claims at the end of this patent is referred to in this patent in a manner consistent with a single meaning, that is done for sake of clarity only so as to not confuse the reader, and it is not intended that such claim term be limited, by implication or otherwise, to that single meaning. Finally, unless a claim element is defined by reciting the word “means” and a function without the recital of any structure, it is not intended that the scope of any claim element be interpreted based on the application of 35 U.S.C. §112, sixth paragraph.
The authentication ticket may be cached in a data store 210 for future use. For example, when the client application 201 needs to access the server application 203 multiple times, the client application 201 may send the authentication ticket or a copy of the authentication ticket in cache 210 when accessing the server application 203. Generally, the authentication ticket may have an expiration time after which the authentication ticket is no longer valid. For example, upon expiration of the authentication ticket, the client application may not be able to access the server application using the authentication ticket. At expiration, the client application may need to again request user credentials that the client application may again pass to the authentication provider 202 to obtain a renewed authentication ticket.
Generally, the authentication ticket may be specific for a particular application, where the authentication ticket may only be used by that application. Thus, when a second application requires access to a server (e.g., 203), the second application must undergo the same process described above in
In one embodiment, a single CAD 400 may manage all authentication requests for a single authentication provider. The CAD 400 may provide credentials to an authentication provider 406 and receive an authentication state (e.g., an authentication ticket) from the authentication provider 406. If there are multiple authentication providers, a separate CAD may exist for each authentication provider. In one embodiment, a plurality of authentication providers may be managed by a single CAD. In this embodiment, a single CAD may keep track of the authentication clients for each authentication provider that the single CAD manages.
As illustrated in
Authentication state monitor 417 may monitor authentication expiration or check authentication state. For example, the authentication state monitor 417 may attempt to access a server using an authentication ticket to determine whether the authentication ticket is valid. Alternatively, the authentication state monitor may periodically check an authentication ticket expiration time (which may be indicated on the ticket or may be a duration provided by the authentication server) against a current time. The authentication ticket may be stored in an authentication ticket cache 425. The authentication state monitor 417 may determine that an authentication state is valid if the authentication ticket is not expired. The authentication state monitor 417 may determine that an authentication state is due if the authentication ticket is about to expire (based on a predetermined or preset time to expire). The authentication state monitor 417 may determine that an authentication state is expired if a current time is past the authentication ticket expiration time. The authentication state monitor 417 may determine that an authentication state is lost if the CAD cannot locate or obtain a previously referenced authentication ticket.
Connection state monitor 419 may periodically check whether a valid connection to an authentication provider and/or a target application server (e.g., an application server associated with the authentication provider) exist. In one embodiment, the connection state monitor may leverage or use existing operating system functions 427 or network functions (e.g., by calling the operating system functions) to check the state of a connection. Alternatively, the connection state monitor may determine connection status or state by attempting to connect to authentication provider 423 or to an application server. The connection state monitor 419 may determine that a connection is lost when the connection state monitor 419 is not able to establish communication between the client and a server. The connection state monitor may determine that a connection is valid or invalid based on whether the client is able to communicate with the server (e.g., even after a communication is established).
The CAD 400 may also include a state machine 421 that may function to provide indications to an application, operating system, or user. The indications may include displaying a state of a connection, an authentication state, and/or changes in connection state or authentication state, as described above. In one embodiment, the state machine 421 may communicate with an operating system status bar 430, such as a Windows system tray. In this embodiment, the state machine 421 may use popup balloons, icons, or windows that emanate or appear to emanate from the system tray to display the indication. The indication may produce a popup balloon when a state change happens. The indication may produce an indication of an authentication state and/or connection state when a user performs an action requesting the indication (e.g., when the user places a mouse pointer over an icon representing the state machine in the system tray).
If there is an existing CAD instance 603, then the client application may synchronize or register with the CAD 605. This may entail providing information to the CAD for listing the client as an authentication client for a particular authentication provider and/or a particular server application requiring authentication. The client application may then begin communicating with the CAD instance to elicit authentication information 606. The client application may establish a secure channel with the CAD to query the CAD for its authentication state with an authentication provider. Generally, the authentication provider may provide an authentication service for a server application that the client application may access. If the CAD is authenticated 607, the CAD may provide an authentication state to the client application 608. The authentication state may be an authentication ticket, which may be optionally cached 609.
If the CAD is not authenticated to the appropriate authentication provider 607, the client may initiate an authentication process with the CAD. If user credentials relating to the server application (and the authentication provider for the server application) are cached 610, the client application may perform a silent sign in process that does not require user involvement (e.g., the process may not require the user to enter a login or password, or the process may not indicate to the user that a sign in is being performed) 611. If user credentials have not been cached 610, the client process may display a sign in form to collect or correct user credentials 612. Alternatively, if the sign in fails 613, an indication of the failed sign on process may be generated 614 and the client process may again display a sign in form to collect or correct user credentials 612.
If the credentials are properly authenticated 613, an authentication state may be obtained 615, otherwise the client application may not be able to access the server application. Obtaining an authentication state may involve possession of a valid authentication ticket that may be used to access a target server application. For example, upon obtaining the authentication ticket, the client application may then proceed to initiate communication with the server application. The client application may first send the authentication ticket to the server application to begin communication with the server application. In one embodiment, the authentication ticket may be required each time access to the server application is initiated by the client application.
In one embodiment, the authentication state (e.g., authentication ticket) may be managed by the client authentication distributor. Once the client application obtains an authentication state from an authentication provider for a server application, the client may establish a secure channel (e.g., an ICP channel) with the client authentication distributor. The client application may then provide the authentication state to the client authentication distributor via the secure channel 616. In addition to the authentication state, the client application may provide the user credentials used to obtain the authentication state to the client authentication distributor.
In one embodiment, the user credentials may be cached at the client device for access by the client application 617. In one embodiment, the user credentials are not cached and after the authentication state and the user credentials are communicated to the client authentication distributor, the user credentials are no longer persisted or accessible by the client application.
A cache, such as a cookie cache, may be used to store the authentication state (e.g., authentication ticket). As described above, after the authentication state is obtained by the client from the above process, the client application may store the authentication state in the cache 609. Each time the client application needs to communicate with the server application, the client application may send the authentication state (from the cache) with its access request to the server application.
After a first client application initiates the above process for obtaining an authentication state from the authentication provider for the target server application, a second client application requiring access to the same server application may easily obtain the authentication state from the client authentication provider without needing another sign on process. In particular, the second client application may start the process illustrated in
The CAD may be configured to maintain the authentication state. In particular, the CAD may be programmed to renew the authentication state. The renewal may be performed in a preemptive manner to prevent the authentication state from expiring. In one embodiment, the CAD may use the authentication state monitor 417 to periodically determine the status of the authentication state. For example, the authentication state may expire after a duration of time. The authentication state monitor may keep track of the expiration time for an authentication ticket. The authentication state monitor may then compare a current time with the expiration of the authentication ticket. The authentication state monitor may provide an indication of a time to expiration (e.g., indicating a duration between the expiration time and a current time) to the authentication state renewal component 415.
The authentication state renewal component may be programmed to renew an authentication state or ticket as illustrated in the embodiment of
In one embodiment, the CAD may compare the time to expiration to a predetermined time to expiration and initiate authentication state renewal if the actual time to expiration is less than the predetermined time to expiration. The authentication renewal may be initiated by communicating an authentication ticket (e.g., one that is about to expire) and/or a set of credentials corresponding to the authentication ticket. In one embodiment, the set of credentials may be maintained by an instance or thread of the CAD. For example, the credentials may be maintained by the authentication state renewal component. Because the credentials are stored in a running program memory of the CAD component instance, they may not be accessible to a user or other program (different from the CAD). In an alternative embodiment, the credentials may be stored or persisted in a credential cache, which may be public to the client computer. In this case, the credentials may be accessed by the user or another client application. If the credentials are cached, the CAD may access the credentials directly from the cache or the CAD may request the credentials from the client application, and the client application may in turn retrieve the credentials from the cache and supply the credentials to the CAD. In one embodiment, if the credentials are cached by the client application, the CAD may not directly access the credentials and therefore, the CAD may be programmed to always request the credentials from the client application when needed by the CAD for the renewal process. In one embodiment, the authentication state cache may be managed primarily by the CAD and may not be directly accessible by other programs. In this embodiment, access to the authentication ticket may be via the CAD. Thus, in this embodiment, any time a client application needs to use the authentication ticket, the client application may request it from the CAD. The determination of whether credentials are cached may be made by a user and/or operating system of the client computer.
After communicating an authenticated ticket and/or credentials to the authentication provider in block 703, the authentication provider may renew the authentication state 703. If the authentication state is renewed 705, the authentication provider, may issue a renewed ticket 706 which is then stored in the authentication state cache 707. If the authentication state is not renewed 705, the CAD may then determine whether the authentication state is expired 708. If the authentication state is still valid, then the CAD may re-attempt to renew the authentication state 703. The authentication state may not have been renewed for a number of reasons, including a connection loss, a server unavailable issue, or other factors. If authentication is determined to be expired, then the CAD may provide a notification of the expiration 709.
A sign out indication may also be provided to each client application 905. The CAD may use a registry to determine all client applications registered for a common authentication provider and perform the indication based on the registry. In one embodiment, known Kernel objects, events, or processes may be used to provide mappings to applications. It should be noted that a user may initiate the sign off while using a first client application that is authenticated by a common authentication provider via the CAD. A second client application may also be using the same authentication ticket as the first client application. When the user signs off from the first client application, the second client application may be notified by the CAD that there is no longer an authentication state for the common authentication provider. The second application, if still running, may then disable certain functions requiring access to the server application authenticated by the authentication provider. If the user intends to continue using the second application, the client may require a user to provide user credentials.
In one embodiment, the functionality described above for a client application may be isolated and incorporated into a client interface component. In this embodiment, the interface component may provide a common set of functions to enable a separate client application to use the client authentication distributor. The set of functions that may be incorporated into the client interface may be summarized as follows:
Start CAD if not already running;
Synchronize with an established CAD during client application initialization;
Query the CAD to determine authentication state;
Obtain credentials from a user using a login form (e.g., using a secure cache);
Verify credentials by signing on and obtaining an authentication state with an authentication provider;
Report authentication failures to a user; Send verified credentials along with an authentication state to the CAD over a secure IPC connection;
Request the CAD to maintain authentication state using the credentials;
Provide or enable menu items including “sign out” and/or “sign out and forget me” functions;
Request that a sign out action be performed by the CAD when a corresponding menu item (e.g., “sign out” or “sign out and forget me”) is activated; and
Receive sign out notifications from the CAD and optionally disable functionality (such as UI functionality) of a client application based on the sign out notification.
It should be noted that the above described CAD may be hosted out of process as well as loaded in process. In other words in one embodiment, the CAD process may be loaded in shared or resident mode (e.g., shared memory) in which the CAD may be publicly accessed by any process having access to the shared process. In another embodiment, the CAD may be loaded in process or hosted inside a process. In this embodiment, the CAD may be isolated from or non-accessible to some other processes. This may be intentionally done to provide isolation from other processes.
The above described method and system of using a client authentication distributor generally enables more efficient operation of a client computing device by a user when the computing device is running a single application that is started and stopped multiple times or running a plurality of applications requiring authentication from a common authentication provider. Instead of requiring multiple sign on operations by the user for each application or requiring multiple sign on operations each time the same application is stopped and started, the described method and system allows a user to sign on a single time, for example when initiating a first client application for the common authentication provider, without the need to perform any further sign on processes. Moreover, because authentication states may expire after a set period of time, the described method and system may also prevent a user from having to periodically sign on (after an initial sign on process) to maintain an authentication state. Instead, the claimed method and system manages a periodic renewal process that may be preemptive of authentication state expiration. Moreover, the described client authentication distributor system may maintain a list of authentication clients (e.g., client applications) for a particular authentication provider. After a sign out process is initiated or performed, the described CAD may notify all registered authentication clients so that each client may react appropriately (e.g., by disabling application functionality). Moreover, the described process provides a notification system using a state machine. As discussed above, the state machine may be used with an operating system tray (or operating system monitoring bar) to provide instant notification to a user of state changes.
In one embodiment, the above described method may be implemented in a Microsoft Outlook and CRM server system. In this embodiment, the client interface described above may be implemented as a Microsoft Outlook plugin for providing Outlook clients with the CAD client functionality. The CRM server may represent a server providing the CRM server application which may need to be accessed by the Outlook clients. In this embodiment, the authentication server may be a Microsoft Passport server. The CAD may receive authentication requests from an Outlook client (via the plugin) and maintain an authentication state (e.g., using a passport ticket) with the Passport server for allowing access by the Outlook client to the CRM server application. In this embodiment, the authentication tickets may be stored in an Internet Explorer cookie store that is accessible to the Outlook client.
