Architecture and design for central authentication and authorization in an on-demand utility environment
View Patent ↗A Centralized Authentication & Authorization (CAA) system that facilitates secure communication between service clients and service providers. CAA comprises a Service Request Filter (SRF), a Service Client Authentication Program (SCAP), a Service Authorization Program (SAP), and an Authorization Database (ADB). The SRF intercepts service requests, extracts the service client's identifier from a digital certificate attached to the request, and stores the identifier in memory accessible to service providers. In the preferred embodiment, the SRF forwards the service request to a web service manager. The web service manager invokes SCAP. SCAP matches the identifier with a record stored in ADB. SAP queries ADB to determine if the service request is valid for the service client. If the service request is valid, SAP authorizes the service request and the appropriate service provider processes the service request.
1. A method of authenticating and authorizing a service request sent from a service client through a firewall to a service provider, comprising the steps of:
using a service request filter, intercepting an incoming service request from a service client on a communication channel, the service request having a digital certificate of the service client attached;
using the service request filter, authenticating the digital certificate with an issuing certification authority;
using the service request filter, extracting a service client identifier from the digital certificate associated with the service request;
using the service request filter, storing the service client identifier in a memory;
using the service request filter, forwarding the service request to a web service manager;
at the web service manager, responsive to receiving the service request, retrieving the service client identifier from the memory and sending an authentication request to a service client authentication program;
responsive to receiving an authentication request from a web service manager at the service client authentication program, matching the service client identifier with a service client record;
responsive to matching the service client identifier with the service client record, sending a request to a service authorization program for an authorization for the service request;
at the service authorization program, determining if the service client identifier associated with the service request is entitled to access the service provider; and
responsive to determining that the service client is entitled, returning a service authorization to the web service manager;
at the web service manager, routing the service request to the service provider to process the request;
responsive to the service provider processing the request, returning an output to the web service manager.
2. The method of claim 1 wherein the digital certificate is an X.509 digital certificate.
3. The method of claim 1 wherein the service client identifier is a Distinguished Name.
4. The method of claim 1 wherein the digital certificate is self-signed.
5. The method of claim 1 further comprising the step of recording the service client identifier in an authorization log.
6. The method of claim 1 further comprising the step of recording the service client identifier and service request in the authorization log.