Method and system for authenticating a user to access a web application hosted on an application server

1 . A method for authenticating a user to access a web application hosted on an application server, said method comprising:

an authentication phase comprising

receiving, by said application server, of a request for access to said web application formulated by the user through a user device;

redirecting said user to a first authentication server comprising an Identity-as-a-Service (IDAAS) server;

selecting, by said user and on said IDAAS server, of a second authentication server comprising a social server, holding personal data of said user;

authenticating said user with said social server;

receiving by said IDAAS server of said personal data of said user transmitted by said social server;

verifying the personal data of said user according to at least one previously entered rule for accessing said web application; and

when the personal data satisfies at least one access rule of said at least one previously entered rule, transmitting from said IDAAS server to said application server a proof of authentication authorizing said user to access said web application;

wherein

the personal data transmitted by the social server is received by the IDAAS server and is not transmitted to the application server,

the IDAAS server generates said proof of authentication based on a result of testing said personal data against said at least one access rule, without including said personal data,

the proof of authentication comprises at least one test data item representing said result of said testing of the personal data against said at least one access rule, each test data item of said at least one test data item corresponding to said at least one access rule and without including said personal data,

no indication of the web application is transmitted to the social server,

the social server cannot determine which web application is being accessed by the user.

2 . The method according to claim 1 , wherein the proof of authentication comprises an authentication token comprising a temporary identifier assigned to said user by the IDAAS server.

3 . The method according to claim 1 , wherein the at least one test data item indicates compliance of at least one personal data item of said personal data with said at least one access rule, without including the at least one personal data item corresponding therewith.

4 . The method according to claim 3 , wherein the authentication phase further comprises, prior to transmitting the at least one test data item, requesting confirmation from said user.

5 . The method according to claim 1 , further comprising, prior to the authentication phase, enrolling the web application to said IDAAS server, said enrolling indicating said at least one access rule for accessing said web application.

6 . The method according to claim 5 , wherein

the authentication phase further comprises creating a temporary profile for said user on the IDAAS server, and

said method further comprises deleting said temporary profile after the authentication phase.

7 . The method according to claim 1 , wherein the second authentication server comprising said social server is selected from among several social servers listed by the IDAAS server.

8 . The method according to claim 1 , wherein data exchange between the IDAAS server and the social server is carried out using OpenID Connect (OIDC) or Security Assertion Markup Language (SAML) authentication kinematics between said IDAAS server and said social server.

9 . The method according to claim 1 , wherein data exchange between the IDAAS server and the application server is carried out using OpenID Connect (OIDC) or Security Assertion Markup Language (SAML) authentication kinematics between said IDAAS server and said application server.

10 . The method according to claim 1 , further comprising creating a user account on the application server, after the authentication phase.

11 . The method according to claim 1 , wherein the personal data comprises

at least one of

an age of the user,

a location of the user,

a nationality of the user.

12 . A non-transitory computer medium storing a program comprising computer instructions, which when executed, implement a method for authenticating a user to access a web application hosted on an application server, said method comprising:

an authentication phase comprising

receiving, by said application server, of a request for access to said web application formulated by the user through a user device;

redirecting said user to a first authentication server comprising an Identity-as-a-Service (IDAAS) server;

selecting, by said user and on said IDAAS server, of a second authentication server comprising a social server, holding personal data of said user;

authenticating said user with said social server;

receiving by said IDAAS server of said personal data of said user transmitted by said social server;

verifying the personal data of said user according to at least one previously entered rule for accessing said web application; and

when the personal data satisfies at least one access rule of said at least one previously entered rule, transmitting from said IDAAS server to said application server a proof of authentication authorizing said user to access said web application;

wherein

the personal data transmitted by the social server is received by the IDAAS server and is not transmitted to the application server,

the IDAAS server generates said proof of authentication based on a result of testing said personal data against said at least one access rule, without including said personal data,

the proof of authentication comprises at least one test data item representing said result of said testing of the personal data against said at least one access rule, each test data item of said at least one test data item corresponding to said at least one access rule and without including said personal data,

no indication of the web application is transmitted to the social server,

the social server cannot determine which web application is being accessed by the user.

13 . A system configured to authenticate a user to access a web application hosted on an application server, said system comprising:

a first authentication client that manages access to a web application, installed on an application server,

a second authentication-as-a-service client installed on an Identity-as-a-Service (IDAAS) server, and

a third authentication client comprising a social authentication client installed on a social authentication server;

wherein said system is configured to implement a method for authenticating said user to access said web application hosted on said application server, said method comprising

an authentication phase comprising

receiving, by said application server, of a request for access to said web application formulated by the user through a user device;

redirecting said user to said IDAAS server;

selecting, by said user and on said IDAAS server, said social authentication server holding personal data of said user;

authenticating said user with said social authentication server;

receiving by said IDAAS server of said personal data of said user transmitted by said social authentication server;

verifying the personal data of said user according to at least one previously entered rule for accessing said web application; and

when the personal data satisfies at least one access rule of said at least one previously entered rule, transmitting from said IDAAS server to said application server a proof of authentication authorizing said user to access said web application;

wherein

the personal data transmitted by the social server is received by the IDAAS server and is not transmitted to the application server,

the IDAAS server generates said proof of authentication based on a result of testing said personal data against said at least one access rule, without including said personal data,

the proof of authentication comprises at least one test data item representing said result of said testing of the personal data against said at least one access rule, each test data item of said at least one test data item corresponding to said at least one access rule and without including said personal data,

no indication of the web application is transmitted to the social server,

the social server cannot determine which web application is being accessed by the user.