In-line sign in
View Patent ↗A method of in-line sign in that allows a user to sign into a first server based on a sign-in methodology of a second server is disclosed. The method uses, among other things, a nonce and approved URL list to prevent spoofing and replay attack. Additionally, the method allows error messages that occur during the authentication process to be displayed to the user having the look and feel of the first server, despite using the authentication process of the second server. A method of dual or distributed authentication is also disclosed wherein the user need only to input the login id and password once and wherein the two authentication processes need not exchange the user's password.
1. A method of seamlessly authenticating a user to a first server by way of a second server, the method comprising:
requesting content from the first server;
receiving an authentication response from the first server, the authentication response including a first address associated with the first server and an executable script, and a second address associated with the second server;
executing the executable script, including:
issuing a request for state information to the second server at the second address, whereby the state information includes a nonce and a third address associated with the second server;
receiving the state information from the second server;
forwarding the nonce and the first address to the third address whereby a determination is made whether the user is authenticated based on the nonce and the first address; and
if not, displaying a login module for collecting login information for authenticating the user in the second server, the login module being displayed with a view associated with the first server and;
if so, allowing the user to proceed in the first server,
wherein determining, based on the state information, whether the user is authenticated to the second server comprises comparing the first address associated with the first server to a list of pre-approved servers.
2. The method of claim 1 , further comprising:
issuing a request to the second server for vouching information;
receiving the vouching information from the second server; and
forwarding the vouching information to the first server.
3. The method of claim 1 , wherein the login module is displayed according to information received with the authentication response from the first server.
4. The method of claim 1 , wherein issuing a request to the second server comprises issuing a request to the second server for state information wherein the state information includes a timestamp and a third address associated with the second server.
5. The method of claim 4 , wherein the second server determines whether the user is authenticated based on the timestamp and the first address comprises calculating an elapsed time based on the nonce and comparing the time elapsed to a predetermined time.
6. The method of claim 1 comprising forwarding the nonce and the first address to a third address associated with a third server.
7. A computer-readable medium having computer-executable instructions to perform the method of claim 1 .