System for and method of providing single sign-on (SSO) capability in an application publishing environment
View Patent ↗A client-server computing system includes a computer cluster for hosting certain resources, applications, programs, processes, files, and/or data that are published to users who are accessing the computer cluster remotely. The computer cluster includes a network of one or more host computers, a gateway server, a gateway service database, and a user database. A single sign-on (SSO) method of the disclosure includes performing a computer cluster authentication process in which a user enters his/her credentials followed by a resource authentication process in which there is no need for the user to reenter his/her credentials, having entered them already in the computer cluster authentication process.
1. A method for providing single-sign-on capability, the method comprising:
receiving at a gateway service an access request sent by a client device, the access request associated with credentials entered by a user of the client device, wherein the client device is successfully authenticated by the gateway service on a selected initial host computer from a cluster of host computers;
transmitting the credentials from the gateway service to the selected initial host computer;
executing instructions stored in memory of the gateway service, wherein execution of the instructions by a processor of the gateway service automatically erases the credentials from memory of the gateway service subsequent to the successful authentication on the selected initial host computer;
receiving at the gateway service a subsequent access request regarding another host computer in the cluster; and
forwarding the subsequent access request from the gateway service to the selected initial host computer for authentication based on the credentials.
2. The method of claim 1 , further comprising registering the host computers in the cluster.
3. The method of claim 2 , wherein registering each host computer comprises establishing a secure connection between the host computer and the gateway service.
4. The method of claim 2 , wherein registering each host computer comprises receiving identifying information from the host computer and storing the identifying information in a host table in memory.
5. The method of claim 2 , wherein the registering each host computer comprises verifying credentials of a user seeking to register the host computer.
6. The method of claim 2 , further comprising generating encryption keys for each registered host computer.
7. The method of claim 2 , wherein the registered host computer and its resources are visible to the user of the client device.
8. An apparatus for providing single-sign-on capability, the apparatus comprising:
a communication interface for:
receiving an access request sent over a communication network by a client device, the access request associated with credentials entered by a user of the client device, wherein the client device is successfully authenticated by the gateway service on a selected initial host computer from a cluster of host computers, and
transmitting the credentials from the gateway service to the selected initial host computer;
a memory; and
a hardware processor coupled to the memory for executing instructions stored in the memory of the gateway service, wherein execution of the instructions by the hardware processor of the gateway service automatically erases the credentials from the memory of the gateway service subsequent to the successful authentication on the selected initial host computer;
wherein the communication interface further:
receives at the gateway service a subsequent access request regarding another host computer in the cluster, and
forwards the subsequent access request from the gateway service to the selected initial host computer for authentication based on the credentials.
9. The apparatus of claim 8 , wherein execution of instructions by the hardware processor of the gateway service registers the host computers in the cluster.
10. The apparatus of claim 9 , wherein registration of each host computer comprises the gateway service establishing a secure connection with the host computer.
11. The apparatus of claim 9 , wherein registration of each host computer comprises the communication interface receiving identifying information from the host computer and the memory storing the identifying information in a host table.
12. The apparatus of claim 9 , wherein the registration of each host computer comprises the hardware processor further executing instructions to verify credentials of a user seeking to register the host computer.
13. The apparatus of claim 9 , wherein execution of instructions by the hardware processor of the gateway service generates encryption keys for each registered host computer.
14. The apparatus of claim 9 , wherein the registered host computer and its resources are visible to the user of the client device.
15. A system for providing single-sign-on capability, the system comprising:
a cluster comprising a plurality of host computers; and
a gateway service comprising:
a communication interface for:
receiving an access request sent over a communication network by a client device, the access request associated with credentials entered by a user of the client device, wherein the client device is successfully authenticated by the gateway service on a selected initial host computer from the cluster of host computers, and
transmitting the credentials from the gateway service to the selected initial host computer; and
a processor for executing instructions stored in memory of the gateway service, wherein execution of the instructions by the processor of the gateway service automatically erases the credentials from memory of the gateway service subsequent to the successful authentication on the selected initial host computer;
wherein the communication interface further:
receives at the gateway service a subsequent access request regarding another host computer in the cluster, and
forwards the subsequent access request from the gateway service to the selected initial host computer for authentication based on the credentials.
16. The system of claim 15 , wherein execution of instructions by the processor of the gateway service registers the host computers in the cluster.
17. The system of claim 16 , wherein registration of each host computer comprises the gateway service establishing a secure connection with the host computer.
18. The system of claim 16 , further comprising database memory, wherein registration of each host computer comprises the communication interface receiving identifying information from the host computer and the database memory storing the identifying information in a host table.
19. The system of claim 16 , wherein the registration of each host computer comprises the processor further executing instructions to verify credentials of a user seeking to register the host computer.
20. The system of claim 16 , wherein execution of instructions by the processor of the gateway service generates encryption keys for each registered host computer.
21. The system of claim 16 , wherein the registered host computer and its resources are visible to the user of the client device.
22. A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for providing single-sign-on capability, the method comprising:
receiving an access request sent by a client device, the access request associated with credentials entered by a user of the client device, wherein the client device is successfully authenticated by the gateway service on a selected initial host computer from a cluster of host computers;
transmitting the credentials to the selected initial host computer;
automatically erasing the credentials from memory subsequent to the successful authentication on the selected initial host computer;
receiving a subsequent access request regarding another host computer in the cluster; and
forwarding the subsequent access request to the selected initial host computer for authentication based on the credentials.