Method and system for providing a circle of trust on a network
Embodiments of the present invention provide a circle of trust on a network. The circle of trust is configured by exchanging credential of a first and a second affiliated entity. The credentials of the first affiliated entity is stored in a trusted partner list of the second affiliated entity. The credentials of the second affiliated entity is stored in a trusted partner list of the first affiliated entity. Thereafter, a circle of trust session may be provided when a client device initiates use of a resource on a relying party device by providing an authentication assertion reference. The identity of the issuing party of the authentication is determined as a function of the authentication assertion reference. The relying party sends an authentication query containing its credential to the issuing party. The issuing party determines if the relying party is a trusted entity based upon whether the relying party's credential is contained in the trusted partner list of the issuing party.
1. A method for granting access to a resource comprising:
sending a first authentication request to a first server;
receiving, in response to the first authentication request, an authentication assertion reference from the first server;
sending, to a second server, a request to access the resource operatively connected to the second server,
wherein the request comprises the authentication assertion reference,
wherein, in response to the request, the second server sends the first server a second authentication request comprising a certificate associated with the second server,
wherein the first server, in response to the second authentication request, determines whether the certificate is present in a trusted partner list maintained by the first server, and
wherein the first server, in response to determining whether the certificate is present in the trusted partner list, sends an authentication assertion to the second server; and
receiving a grant of access to the resource from the second server, wherein the second server grants access to the resource based on the authentication assertion.
2. The method of claim 1 , wherein prior to sending the first server the second authentication request, the second server identifies the first server using the authentication assertion reference.
3. The method of claim 1 , wherein sending a first authentication request to the first server comprises providing the first server with user login information.
4. The method of claim 3 , wherein the first authentication request is a Security Assertion Markup Language request in a SOAP envelope.
5. A method for granting access to a resource comprising:
receiving, by a first server, a request to access the resource operatively connected to the first server, wherein the request comprises an authentication assertion reference from a client;
sending, in response to the request, an authentication request to a second server, wherein the authentication request comprises a certificate associated with the first server;
receiving, in response to the authentication request, an authentication assertion from the second server,
wherein the second server, in response to the authentication request, determines whether the certificate is present in a trusted partner list maintained by the second server,
wherein the second server, in response to determining whether the certificate is present in the trusted partner list, sends the authentication assertion to the first server; and
granting, by the first server, access to the resource to the client based on the authentication assertion.
6. The method of claim 5 , wherein prior to sending the authentication request, the first server identifies the second server using the authentication assertion reference.
7. The method of claim 5 , wherein the client is authenticated by the second server prior to obtaining the authentication assertion reference.
8. The method of claim 7 , wherein the second authentication request is a Security Assertion Markup Language request in a SOAP envelope.
9. A system for granting access to a resource comprising:
a first server operatively connected to a client, the resource and a second server,
wherein the first server is configured to:
receive, from the client, a request to access the resource, wherein the request comprises an authentication assertion reference;
send, in response to the request, an authentication request to the second server, wherein the authentication request comprises a certificate associated with the first server;
receive, in response to the authentication request, an authentication assertion from the second server,
wherein the second server, in response to the authentication request, determines whether the certificate is present in a trusted partner list maintained by the second server, and
wherein the second server, in response to determining whether the certificate is present in the trusted partner list, sends the authentication assertion to the first server; and
grant access to the resource to the client based on the authentication assertion.
10. The system of claim 9 , wherein the client is authenticated by the second server prior to obtaining the authentication assertion reference.
11. The system of claim 10 , wherein the client provides the second server with user login information.
12. The system of claim 11 , wherein the second authentication request is a Security Assertion Markup Language request in a SOAP envelope.
13. The system of claim 9 , wherein prior to sending the authentication request, the first server identifies the second server using the authentication assertion reference.