Federated timeout
View Patent ↗Techniques for workload federated timeout are presented. A federated service manages communications between service components of a system. Each component queries the federated service to determine a last activity time by the other components of the system before timing out during a session. Each component can update its last activity time based on the discovered last activity time of one of the components to prevent a premature time out from the session.
1. A method implemented in a non-transitory machine-readable storage medium and processed by a machine configured to perform the method, comprising:
maintaining, at the machine, a last-recorded activity time for a session reflecting an up-to-date time for a most recent activity occurring in the session between a principal and second principals, wherein maintaining further includes obtaining the most recent activity from a domain identified in a token with the principal and the second principals configured for reporting session activity to that domain; and
communicating, at the machine, the last-recorded activity time to a requesting principal before the requesting principal times out of the session due to that requesting principal's inactivity for a predefined amount of time within the session and the predefined amount of time for the inactivity is provided from the requesting principal as a dynamic query that is initiated from the requesting principal for the last-recorded activity time before that requesting principal times out of the session, and wherein updating, by the requesting principal, a principal maintained last activity time maintained by the requesting principal with the last-recorded activity time, wherein each principal updates that principal's individually maintained last activity time with the last-recorded activity time communicated and wherein none of the principals is permitted to time out of the session when at least one of the principals has a particular maintained last activity time that has not exceeded the predefined amount of time of inactivity.
2. The method of claim 1 further comprising, providing, by the machine, an authentication token, to an identity provider during initialization of the session, the identity provider acting as the principal in the session and the authentication token provides authentication for the second principals when interacting with the method, the identity provider distributes the authentication token to the second principals as part of the initialization of the session.
3. The method of claim 1 further comprising, acquiring, at the machine, a time-out instruction received from the principal or one of the second principals and returning a timed-out response to a particular requesting principal when the particular requesting principal asks for the last-recorded activity time.
4. The method of claim 1 , wherein maintaining further includes interacting with the principal and the second principals during the session via assertions.
5. The method of claim 4 , wherein interacting further includes identifying in each assertion: a reporting domain, an activity domain, a session identifier for the session, a principal identifier for a particular principal that initiates the session, and a particular activity time for activity within the session.
6. The method of claim 5 , wherein identifying further includes including a reporting domain authentication token for authentication within the reporting domain and an activity domain authentication token for authentication with the activity domain.
7. The method of claim 6 , wherein identifying further includes representing each assertion as a modified and extended version of a Security Assertion Markup Language (SAML) assertion.
8. The method of claim 1 , wherein maintaining further includes receiving at different intervals communications from the principal and each of the second principals, each communication identifying the session, a particular principal making the communication, and a value for an activity time for that particular principal within the session.
9. The method of claim 8 , wherein receiving further includes authenticating each communication before updating a particular value as the last-recorded activity time.
10. A method implemented in a non-transitory machine-readable storage medium and processed by a machine configured to perform the method, comprising:
authenticating, at the machine, a principal during a login to a session between the principal and a second principal and providing the principal and the second principal with a domain for reporting session activity;
generating, at the machine, an assertion, the assertion identifying a federated timeout controller that the second principal and other third principals interact with during the session and last activity times for the session reported by the principal, the second principal, and the other third principals on the domain and the principal, the second principal, and the other third principals request a most-recent activity time for the session from the federated timeout controller before timing out during the session, and wherein generating further includes dynamically querying, by the principals, the federated timeout controller for obtaining the most-recent activity time, and updating, by the principals local most-recent activity times maintained by the principals with the most-recent activity time, wherein each principal updates that principal's local most-recent activity time with the most-recent activity time and none of the principals are permitted to timeout of the session unless all of the local most-recent activity times being individually updated by the principals with the most-recent activity time, as provided by the federated controller, exceed a predefined amount of time of inactivity for the session;
establishing, from the machine, the session and communicating the assertion to the second principal and the other third principals.
11. The method of claim 10 further comprising, querying, from the machine, the federated timeout controller to obtain an authentication token for the second principal and the other third principals to use for authentication to the federated timeout controller when interacting with the federated timeout controller during the session.
12. The method of claim 10 , wherein authenticating further includes intercepting the login directed by the principal to the second principal to perform the authentication.
13. The method of claim 10 , wherein authentication further includes recognizing the principal as an end user and the second principal as a network-based service that includes the other third-principals as other services.
14. The method of claim 10 , wherein generating further includes sending authentication credentials to the second principal and the other third principals for the second principal and the other third principals to use when authenticating with the federated timeout controller during the session.
15. The method of claim 14 , wherein sending further includes instructing the second principal and/or the other third principals to sign the authentication principals before using for authentication with the federated timeout controller.
16. The method of claim 10 , wherein generating further includes instructing the second principal and/or the other third principals to build their own independent credentials for use when authenticating with the federated timeout controller during the session.
17. The method of claim 10 , wherein establishing further includes instructing the second principal and the other third principals to report activity times to the federated timeout controller during the session using the assertion and to query the federated timeout controller before timing out of the session.
18. A system, comprising:
a first processing device having an identity provider implemented and residing as instructions within a non-transitory computer-readable storage medium that processes on the first processing device; and
a second processing device having a federated timeout controller implemented and residing as instructions within a non-transitory computer-readable storage medium that processes on the second processing device;
wherein the identity provider is configured to configure principals to report activity times to the federated timeout controller though a domain monitored by the federated timeout controller during a session and to configure the principals for dynamically querying the federated timeout controller for a most-recent activity time and the principals to update local most-recent activity times being individually maintained by the principals with the most-recent activity time before making a decision to time out of the session, wherein each principal updates that principal's individually maintained activity time with the most-recent activity time provided by the federated timeout controller, the federated timeout controller is configured to maintain the most-recent activity time for the principals and deliver the most-recent activity time upon request from one of the principals during the session when that requesting principal attempts to time out of the session, and wherein none of the principals are permitted to time out of the session when at least one principal has activity within the session within a predefined period of time that has not exceeded the most-recent activity time managed by the federated timeout controller.
19. The system of claim 18 , wherein the identity provider is also configured to authenticate the principals to establish the session.
20. The system of claim 18 , wherein the identity provider is further configured to configure the principals for authentication with the federated timeout controller during interactions of the principals with the federated timeout controller during the session.