Granted Patent B2

US 9,391,978 · App. 12/786,540 · Granted Jul 12, 2016

Abstract

Claims (66)

1. An apparatus, comprising:

a node comprising a physical machine having a generating identity provider (IDP), the generating IDP to:

receive original user credentials sufficient to authenticate a user directly from a user machine, or indirectly from an initial IDP, the original user credentials including at least one of a username password combination directly from the user or a token from the initial IDP;

generate generated user credentials, the generated user credentials including a unique user name and password combination different from that initially provided by the user for the original user credentials, the generated user credentials having a lifetime of a login session associated with the user, the lifetime initiated in response to validation of the original user credentials or validation of the token by the generating IDP;

receive a request associated with the user during the login session to access an application protected by an agent;

transmit the username and password of the generated user credentials to the application to authenticate the user while the login session is not terminated;

receive an authentication request from the agent using the username and password of the generated user credentials;

provide authentication to the agent based on the username and password of the generated user credentials while the login session is not terminated; and

invalidate the generated user credentials in response to login session termination, the login session termination occurring after an activity timeout, an explicit logout from the user at the generating IDP, or an administrator terminating the login session.

2. The apparatus of claim 1 , further comprising:

an LDAP server to receive the generated user credentials.

3. The apparatus of claim 1 , further comprising:

a memory to cache the generated user credentials.

4. A system, comprising:

a first node comprising a physical machine having a generating identity provider (IDP), the generating IDP to:

receive original user credentials sufficient to authenticate a user directly from a user machine, or indirectly from an initial IDP, the original user credentials including at least one of a username password combination directly from the user or a token from the initial IDP;

generate generated user credentials, the generated user credentials including a unique user name and password combination different from that initially provided by the user for the original user credentials, the generated user credentials having a lifetime of a login session associated with the user, the lifetime initiated in response to validation of the original user credentials or validation of the token by the generating IDP;

receive a request associated with the user during the login session to access an application protected by an agent;

transmit the username and password of the generated user credentials to the application to authenticate the user while the login session is not terminated;

receive an authentication request from the agent using the at least part of the generated user credentials;

provide authentication to the agent based on the at least part of the generated user credentials while the login session is not terminated; and

invalidate the generated user credentials in response to login session termination, the login session termination occurring after an activity timeout, an explicit logout from the user at the generating IDP, or an administrator terminating the login session; and

a second node to host the agent.

5. The system of claim 4 , further comprising:

a third node to host the initial identity provider.

6. The system of claim 4 , wherein the agent comprises a hypertext transfer protocol proxy agent.

7. A processor-implemented method to execute on one or more processors that perform the method, comprising:

receiving, at a generating identity provider (IDP), original user credentials sufficient to authenticate a user directly from a user machine, or indirectly from an initial IDP, the original user credentials including at least one of a username password combination directly from the user or a token from the initial IDP;

generating, by the generating IDP, generated user credentials, the generated user credentials including a unique user name and password combination different from that initially provided by the user for the original user credentials, the generated user credentials having a lifetime of a login session associated with the user, the lifetime initiated in response to validation of the original user credentials or validation of the token by the generating IDP;

receiving, by the generating IDP, a request associated with the user during the login session to access an application protected by an agent;

transmitting, by the generating IDP, the username and password of the generated user credentials from the generating IDP to the application to authenticate the user to the generating IDP while the login session is not terminated;

receiving, by the generating IDP, an authentication request from the agent using the username and password of the generated user credentials;

providing, by the generating IDP, authentication to the agent based on the username and password of the generated user credentials while the login session is not terminated; and

invalidating, by the generating IDP, the generated user credentials in response to login session termination, the login session termination occurring after an activity timeout, an explicit logout from the user at the generating IDP, or an administrator terminating the login session.

8. The method of claim 7 , wherein receiving the original user credentials comprises:

receiving the original user credentials as a username-password pair, as part of a token, or as provided by a smart card.

9. The method of claim 7 , further comprising:

caching the generated user credentials, by the generating IDP, during the login session.

10. The method of claim 7 , further comprising:

configuring the agent to access the generating IDP and the generated user credentials when authenticating the user in response to additional requests for additional services hosted by a back-end node.

11. The method of claim 7 , wherein the transmitting further comprises:

communicating, by the agent, the generated user credentials to the generating IDP using a lightweight directory access protocol (LDAP) or a structured query language (SQL).

12. The method of claim 7 , wherein receiving the request comprises:

receiving the request from the user machine.

13. The method of claim 7 , wherein the generating comprises:

generating the generated user credentials as a lightweight directory access protocol (LDAP) username and password.

14. A processor-implemented method to execute on one or more processors that perform the method, comprising:

receiving, at a generating identity provider (IDP), original user credentials sufficient to authenticate a user directly from a user machine, or indirectly from an initial IDP, the original user credentials including at least one of a username password combination directly from the user or a token from the initial IDP;

generating, by the generating IDP, generated user credentials, the generated user credentials including a unique user name and password combination different from that initially provided by the user for the original user credentials, the generated user credentials having a lifetime of a login session associated with the user, the lifetime initiated in response to validation of the original user credentials or validation of the token by the generating IDP;

receiving, by the generating IDP, a request associated with the user during the login session to access an application protected by an agent;

transmitting, by the generating IDP, the username and password of the generated user credentials from the generating IDP to the application to authenticate the user to the generating IDP via a lightweight directory access protocol (LDAP) server while the login session is not terminated;

receiving, by the generating IDP, an authentication request from the agent using the username and password of the generated user credentials;

providing, by the generating IDP, authentication to the agent based on the username and password of the generated user credentials while the login session is not terminated; and

invalidating, by the generating IDP, the generated user credentials in response to login session termination, the login session termination occurring after an activity timeout, an explicit logout from the user at the generating IDP, or an administrator terminating the login session.

15. The method of claim 14 , wherein receiving the request comprises:

receiving the request from a network browsing application.

16. The method of claim 14 , further comprising:

after the generating, and during the login session, mapping the generated user credentials to an account associated with another application.

17. The method of claim 14 , further comprising:

receiving a security assertion markup language (SAML) token as the token from the initial identity provider to indicate that the original credentials have been received by the initial identity provider.

18. The method of claim 14 , further comprising:

transmitting the generated user credentials to the application via the agent using identity injection.

19. The method of claim 14 , further comprising:

checking for the presence of the generated user credentials in a cache; and

denying access to the application if the generated user credentials are not found in the cache.

20. The method of claim 14 , further comprising: permitting proxy read access by the agent to a map of accounts associated with the generated user credentials.

Assignments (16)