IP Library Granted Patent US 12676847
Granted Patent B2
US 12676847 · App. 18/422,224 · Granted Jul 7, 2026

Declarative authentication engine

Inventors: Federico Piagentini (Buenos Aires, AR); Franco Garcia (Buenos Aires, AR)
Assignee: Salesforce, Inc.
H04L63/083
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12676847
App. No.
18/422,224
Granted
Jul 7, 2026
Kind
B2
Abstract

Disclosed herein are system, method, and computer program product embodiments for implementing variable a declarative authentication engine. The system generates a schema that includes a field and has a format defined by an authentication protocol associated with a service. The system then validates a connection request based on comparing the field of the generated schema to a field of the connection request for the service, wherein the connection request is formatted according to the schema and received from a client device. The system then provides the client device access to the service according to the connection request based on a result of the validating.

Claims (56)

1 . A system for a declarative authentication engine, comprising:

a memory; and

at least one processor coupled to the memory and configured to:

generate, in response to selection of a base authentication protocol, a schema that includes a field and an optional field and has a format defined by the base authentication protocol associated with a service;

validate a connection request based on comparing the field of the generated schema to a field of the connection request for the service, wherein the connection request is formatted according to the schema and received from a client device; and

provide the client device access to the service according to the connection request based on a result of the validating and in response to determining that the connection request fails to include the optional field.

2 . The system of claim 1 , wherein the generated schema field comprises a script and the connection request field comprises a value produced by the script executing.

3 . The system of claim 1 , wherein the schema is a default schema and the field comprises a username and password.

4 . The system of claim 1 , wherein the at least one processor is further configured to:

compare a version value of the generated schema to a version value of the connection request;

in response to the comparison, determine that the version value of the generated schema is compatible with the version value of the connection request; and

in response to the determination, provide access to the service associated with the connection request.

5 . The system of claim 1 , wherein the field comprises a key and a value, and the at least one processor is further configured to:

generate a first graphical user interface (GUI) in response to the connection request, wherein the first GUI comprises the key; and

in response, generate a second GUI corresponding to the service, wherein the second GUI is customized according to the value of the connection request field.

6 . The system of claim 1 , wherein the processor is further configured to:

store the connection request at a connection store;

receive a second connection request;

identify, at the connection store, the connection request based on a comparison between the connection request field and a second connection request field; and

in response to the identification, provide access to the service according to the second connection request.

7 . A method for using a declarative authentication engine, comprising:

generating, in response to selection of a base authentication protocol, a schema that includes a field and an optional field and has a format defined by the base authentication protocol associated with a service;

validating a connection request based on comparing the field of the generated schema to a field of the connection request for the service, wherein the connection request is formatted according to the schema and received from a client device; and

provide the client device access to the service according to the connection request based on a result of the validating and in response to determining that the connection request fails to include the optional field.

8 . The method of claim 7 , wherein the generated schema field comprises a script and the connection request field comprises a value produced by the script executing.

9 . The method of claim 7 , the schema is a default schema and the field comprises a username and password.

10 . The method of claim 7 , wherein the method further comprises:

comparing a version value of the generated schema to a version value of the connection request;

in response to the comparing, determining that the version value of the generated schema is compatible with the version value of the connection request; and

in response to the determining, providing access to the service associated with the connection request.

11 . The method of claim 7 , wherein the field comprises a key and a value and the method further comprises:

generating a first graphical user interface (GUI) in response to the connection request, wherein the first GUI comprises the key; and

generating a second GUI corresponding to the service, wherein the second GUI is customized according to the value of the connection request field.

12 . The method of claim 7 , wherein the method further comprises:

storing the connection request at a connection store;

receiving a second connection request;

identifying, at the connection store, the connection request based on a comparison between the connection request field and a second connection request field; and

in response to the identification, provide access to the service according to the second connection request.

13 . A non-transitory computer-readable device having instructions stored thereon that, when executed by at least one computing device, cause the at least one computing device to perform operations comprising:

generating, in response to selection of a base authentication protocol, a schema that includes a field and an optional field and has a format defined by the base authentication protocol associated with a service;

validating a connection request based on comparing the field of the generated schema to a field of the connection request for the service, wherein the connection request is formatted according to the schema and received from a client device; and

providing the client device access to the service according to the connection request based on a result of the validating and in response to determining that the connection request fails to include the optional field.

14 . The non-transitory computer-readable device of claim 13 , wherein the generated schema field comprises a script and the connection request field comprises a value produced by the script executing.

15 . The non-transitory computer-readable device of claim 13 , wherein the schema is a default schema and the field comprises a username and password.

16 . The non-transitory computer-readable device of claim 13 , wherein the operations further comprise:

comparing a version value of the generated schema to a version value of the connection request;

in response to the comparing, determining that the version value of the generated schema is compatible with the version value of the connection request; and

in response to the determining, providing access to the service associated with the connection request.

17 . The non-transitory computer-readable device of claim 13 , wherein the operations further comprise:

generating a first graphical user interface (GUI) in response to the connection request, wherein the first GUI comprises a key; and

in response, generating a second GUI corresponding to the service, wherein the second GUI is customized according to the value of the connection request field.

18 . The non-transitory computer-readable device of claim 13 , wherein the operations further comprise:

storing the connection request at a connection store;

receiving a second connection request;

identifying, at the connection store, the connection request based on a comparison between the connection request field and a second connection request field; and

in response to the identification, providing access to the service according to the second connection request.