Cross-domain inactivity tracking for integrated web applications
View Patent ↗In a cloud computing environment, a user authenticates to multiple cloud services concurrently. A master service has knowledge of or tracks the cloud service(s) to which a user is authenticated. Each cloud service may enforce its own inactivity period, and the inactivity period of at least first and second cloud services may be distinct from one another. When the master service receives an indication that the authenticated user is attempting to take an action at a first cloud service despite an activity timeout there, the master service issues a status request to at least the second cloud service to determine whether the user is still active at the second cloud service (despite its different inactivity period). If the user is still active at the second cloud service, the master service provides a response, selectively overriding (re-setting) the activity timeout at the first cloud service to permit the action.
1. A method of inactivity tracking and management in a cloud computing infrastructure, wherein information about a set of cloud services to which a user is authenticated is maintained within the infrastructure, comprising:
receiving an indication that the user has attempted to take an action at a first cloud service following timeout of an inactivity period there;
responsive to receiving the indication, identifying, from the information, a second cloud service as a service to which the user has previously authenticated and may still be active;
responsive to identifying the second cloud service, querying, using software executing in a hardware element, the second cloud service to determine, based on an inactivity period at the second cloud service, whether the user is indicated to be still active at the second cloud service; and
when a response is received indicating that the user is indicated to be still active at the second cloud service, issuing a reply to the indication, wherein the reply re-sets the inactivity period at the first cloud service, thereby enabling the user to take the action.
2. The method as described in claim 1 wherein an inactivity period at the first cloud service differs from an inactivity period at the second cloud service.
3. The method as described in claim 1 further including:
querying at least a third cloud service to which the user has previously authenticated to determine, based on an inactivity period at the third cloud service, whether the user is indicated to be still active at the third cloud service; and
wherein the reply re-setting the inactivity period at the first cloud service is issued if a response is received indicating that the user is indicated to be still active at either the second cloud service or at the third cloud service.
4. The method as described in claim 1 further including caching for re-use the response received as a result of the querying of the second cloud service.
5. The method as described in claim 1 wherein the information is maintained in one of: a data store, a cookie.
6. The method as described in claim 1 wherein the user authenticates to the first and second cloud services using single sign-on.
7. An apparatus, comprising:
a processor;
computer memory holding computer program instructions that when executed by the processor perform a method of inactivity tracking and management in a cloud computing infrastructure, wherein information about a set of cloud services to which a user is authenticated is maintained within the infrastructure, the computer program instructions comprising:
program code to receive an indication that the user has attempted to take an action at a first cloud service following timeout of an inactivity period there;
program code responsive to receipt of the indication to identify, from the information, a second cloud service as a service to which the user has previously authenticated and may still be active;
program code responsive to identification of the second cloud service to query the second cloud service to determine, based on an inactivity period at the second cloud service, whether the user is indicated to be still active at the second cloud service; and
program code operative when a response is received indicating that the user is indicated to be still active at the second cloud service, to issue a reply to the indication, wherein the reply re-sets the inactivity period at the first cloud service, thereby enabling the user to take the action.
8. The apparatus as described in claim 7 wherein an inactivity period at the first cloud service differs from an inactivity period at the second cloud service.
9. The apparatus as described in claim 7 further including:
program code to query at least a third cloud service to which the user has previously authenticated to determine, based on an inactivity period at the third cloud service, whether the user is indicated to be still active at the third cloud service;
wherein the reply re-setting the inactivity period at the first cloud service is issued if a response is received indicating that the user is indicated to be still active at either the second cloud service or at the third cloud service.
10. The apparatus as described in claim 7 further including program code to cache for re-use the response received as a result of the querying of the second cloud service.
11. The apparatus as described in claim 7 further including a data store in which the information is maintained.
12. The apparatus as described in claim 7 further including an authentication mechanism to authenticate the user to the first and second cloud services using single sign-on.
13. A computer program product in a non-transitory computer readable medium for use in a data processing system, the computer program product holding computer program instructions which, when executed by the data processing system, perform a method of inactivity tracking and management in a cloud computing infrastructure, wherein information about a set of cloud services to which a user is authenticated is maintained within the infrastructure, the computer program instructions comprising:
program code to receive an indication that the user has attempted to take an action at a first cloud service following timeout of an inactivity period there;
program code responsive to receipt of the indication to identify, from the information, a second cloud service as a service to which the user has previously authenticated and may still be active;
program code responsive to identification of the second cloud service to query the second cloud service to determine, based on an inactivity period at the second cloud service, whether the user is indicated to be still active at the second cloud service; and
program code operative when a response is received indicating that the user is indicated to be still active at the second cloud service, to issue a reply to the indication, wherein the reply re-sets the inactivity period at the first cloud service, thereby enabling the user to take the action.
14. The computer program product as described in claim 13 wherein an inactivity period at the first cloud service differs from an inactivity period at the second cloud service.
15. The computer program product as described in claim 13 further including:
program code to query at least a third cloud service to which the user has previously authenticated to determine, based on an inactivity period at the third cloud service, whether the user is indicated to be still active at the third cloud service;
wherein the reply re-setting the inactivity period at the first cloud service is issued if a response is received indicating that the user is indicated to be still active at either the second cloud service or at the third cloud service.
16. The computer program product as described in claim 13 further including program code to cache for re-use the response received as a result of the querying of the second cloud service.
17. The computer program product as described in claim 13 further including a data store in which the information is maintained.
18. The computer program product as described in claim 13 further including an authentication mechanism to authenticate the user to the first and second cloud services using single sign-on.