Communicating state information to legacy clients using legacy protocols
When a user account is in an alternate (fault) state, communication or sync between an application provider and a device or client application typically is interrupted. When parties do not support rich fault messaging, communication of the reason for the interruption and remediation steps has been impossible. An application server provides rich fault messaging using applications that do not provide explicit error messaging and protocols that do not provide explicit error messaging without changing either the application or the protocol by additional interactions between an identity provider and the application server. The application server uses authentication state information provided by the identity server to generate a notification sync event that appears to the application and the protocol to be a normal sync event. The notification sync event is used to provide the user with information needed to determine what the problem with the account is and how to fix it.
1. A system comprising:
at least one processor of an application server computing device;
a memory of the application server computing device; and
at least one module loaded into the memory causing the at least one processor to:
receive authentication evaluation state information from an identity provider in response to unsuccessful authentication of a user of a client device, wherein credentials received by the identity provider for the user are valid but the client device is in an alternate state in which full synchronization is prevented; and
send a notification message to a client application executing on the client device, usurping the client application's existing synchronization mechanism, the notification message comprising information identifying a cause of the unsuccessful authentication of the user.
2. The system of claim 1 , further comprising
sending a notification message to the client application usurping the client application's existing synchronization mechanism, the notification message comprising remediation information for the cause of the unsuccessful authentication of the user.
3. The system of claim 1 , wherein a protocol used by the client application's existing synchronization mechanism is a protocol comprising one of: POP, IMAP, Exchange Active Sync, or a legacy client-server communication protocol.
4. The system of claim 1 , wherein the client application's existing synchronization mechanism fails to support a mechanism to identify a reason for the unsuccessful authentication of the user.
5. The system of claim 1 , wherein the client application's existing synchronization mechanism fails to support a mechanism to remediate the unsuccessful authentication of the user.
6. The system of claim 1 , wherein the notification message sent to the client application identifies the cause of the unsuccessful authentication of the user as one of: expiration of a password of the user; a password on the application server computing device does not match a corresponding password on a client device; a user account is throttled; the user account is blocked; the client device fails to pass a health check; a communication sent from the client device comes from an unknown, unusual or high risk location; the client device is unsupported; the client device is misconfigured; the client device is using a deprecated client/protocol version; the user account is blocked because of non-compliance of the user with a user account agreement; credentials belonging to the user have been compromised; credentials belonging to the user are suspected of being compromised; the user has to rename his account; the user has to change a password; the user has to change secret question/secret answer information; the user has to change how the user proves the user's identity; for account detail review; for maintenance check; or identity proofs have to be added.
7. The system of claim 1 , wherein the notification is machine readable.
8. The system of claim 7 , wherein in response to receiving the machine readable notification, at least one remediation action can be automatically performed.
9. A method comprising:
receiving by a processor of an application server computer, authentication evaluation state information from an identity provider, in response to an unsuccessful authentication of a user of a client device, wherein in response to receiving invalid credentials for the user a user account of the user is placed in an alternate state in which full synchronization of the client device is prevented; and
sending a fault notification message to a client application executing on the client device, usurping the client application's existing synchronization mechanism, the fault notification message comprising information to remediate the unsuccessful authentication of the user of the client device.
10. The method of claim 9 , further comprising:
sending a fault notification message to a client application executing on the client device, using the client application's existing synchronization mechanism, the fault notification message comprising information identifying a cause of the unsuccessful authentication of the user, the cause comprising one of: expiration of a password of the user, a password on the application server computer does not match a corresponding password on the client device, the user account is throttled, the user account is blocked, the client device fails a health check; a communication sent from the client device comes from an unknown, abnormal or high risk location, the client device is unsupported, the client device is misconfigured, the client device is using a deprecated client/protocol version, the user account is blocked because of non-compliance of the user with a user account agreement; credentials belonging to the user have been compromised; credentials belonging to the user are suspected of being compromised; the user has to rename the user account; the user has to change a password; the user has to change secret question/secret answer information; the user has to change how the user proves the user's identity; for account detail review; for maintenance check; or identity proofs for the user have to be added.
11. The method of claim 9 , further comprising:
receiving information concerning an optional interrupt state enabling the application server computer to choose whether or not to change the authentication flow for the user.
12. The method of claim 9 , further comprising:
receiving information concerning a non-optional interrupt state directing the application server to interrupt the authentication flow for the user.
13. The method of claim 9 , further comprising:
sending the client application a notification sync event that enables limited sync behavior when full sync is disabled.
14. A computing device, comprising:
at least one processor and a memory;
the at least one processor is configured to:
receive authentication evaluation state information from an identity provider in response to unsuccessful authentication of a user of a client device, wherein credentials received by the identity provider for the user are valid but a user account of the user is locked because of a fault condition; and
send a notification message to a client application executing on the client device, using the client application's existing synchronization mechanism, the notification message comprising information identifying the fault condition and providing remediation information to correct the fault condition, wherein the client application's existing synchronization mechanism updates at least one user data file on the client device.
15. The computing device of claim 14 , wherein the at least one processor is further configured to:
send the notification message to the client application executing on the client device, the notification message comprising a push event.
16. The computing device of claim 14 , wherein the at least one processor is further configured to:
send the notification message to the client application executing on the client device, the notification message indistinguishable by the client application from a user data file updating sync event.
17. The computing device of claim 14 , wherein the at least one processor is further configured to:
alter an authorization flow by enabling limited sync behavior.
18. The computing device of claim 14 , wherein the at least one processor is further configured to:
push a notification sync event to the client application.
19. The computing device of claim 14 , wherein that at least one processor is further configured to:
send the notification message to the client application executing on the client device without changing the client application.
20. The computing device of claim 14 , wherein the at least one processor is further configured to:
send the notification message to the client application executing on the client device without changing a protocol used by the client application.