Granted Patent B2

US 10,454,974 · App. 14/753,636 · Granted Oct 22, 2019

Inventors: Dileep Reddem (San Jose, CA); Pratap Ranjan Tiwary (San Jose, CA); Arkesh Kumar (San Jose, CA); Naresh Babu Jampani (San Jose, CA)

Assignee: CITRIX SYSTEMS, INC.

H04L63/205G06F21/31H04L63/0884G06F2221/2133H04L63/08

Abstract

Claims (81)

1. A method of generating a login form to authenticate a client, comprising:

receiving, by a device intermediary to a plurality of clients and a plurality of servers that provide one or more resources, a request from a client to access a resource of the one or more resources;

selecting, by the device, a login schema associated with the request from a repository storing a plurality of login schemas, the login schema comprising a definition of a login form using an authentication protocol, the login schema including one or more of an authentication schema or a dialog schema, wherein an authentication module executing on a server is configured to authenticate the client using at least one of the plurality of login schemas;

in response to the request, generating, by a virtual server executed by the device and configured to generate forms for each of the plurality of login schemas, the login form constructed for the client to access the resource according to the definition provided by the selected login schema and based on a combination of the one or more of the authentication schema or the dialog schema, wherein the virtual server is configured to interface with the authentication module executing on the server to authenticate the client using at least one of the plurality of login schemas;

providing, by the virtual server executed by the device, the login form for display via the client;

receiving, by the device, information inputted into the login form via the client; and

establishing, by the device responsive to authentication of the client based on the information and the authentication protocol, access to the resource by the client.

2. The method of claim 1 , further comprising:

generating, by the device, a login page comprising the login form; and

providing, by the device, the login page for display via the client.

3. The method of claim 1 , further comprising:

identifying, by the device, a server specified by the login schema configured to perform authentication;

transmitting, by the device, the information to the server based on the login schema;

receiving, by the device, authentication information generated by the server; and

using, by the device, the authentication information received from the server to authenticate the client.

4. The method of claim 1 , further comprising:

identifying, by the device, a policy of the login schema;

obtaining, by the device based on the policy, the authentication module from the server, the authentication module configured with at least one of a CAPTCHA or a token; and

configuring, by the device responsive to the request, the login form with the authentication module.

5. The method of claim 1 , wherein the login schema includes the authentication schema, the dialog schema, a username expression, a password expression, and an authentication strength.

6. The method of claim 1 , further comprising:

aggregating, by the device based on the login schema, a plurality of form fields associated with a plurality of heterogeneous authentication modules; and

configuring, by the device responsive to the request, the login form with the plurality of form fields.

7. The method of claim 1 , further comprising:

extracting, by the device, a field from the request comprising a plurality of fields; and

configuring, by the device, the login form based on the extracted field from the request.

8. The method of claim 1 , further comprising:

creating, by the device, a first cascade comprising a first authentication policy of a first login schema, and a second cascade comprising a second authentication policy of a second login schema;

generating, by the device, a first login form with the first authentication policy and a second login form with the second authentication policy;

generating, by the device, a first login field for the first login form using the first login schema and a second login field for the second login form using the second login schema;

providing, by the device, the first cascade with the first login field of the first login form for display on the client; and

providing, by the device based on input received responsive to the first cascade, the second cascade with the second login field of the second login form for display on the client.

9. The method of claim 8 , further comprising:

generating, by the device, a first prompt based on the first login schema; and

providing, by the device, the first prompt for display with the first login field of the first login form.

10. The method of claim 1 , further comprising:

creating, by the device based on the login schema, at least three cascades, wherein each of the at least three cascades includes a priority, an authentication policy, a login schema, and a next cascade identifier that identifies a next cascade to use responsive to authentication via a first cascade of the at least three cascades.

11. The method of claim 10 , further comprising:

using, by an authentication policy of the next cascade, information obtained from the first cascade.

12. The method of claim 1 , further comprising:

establishing, by the device, the virtual server configured to access the repository comprising the plurality of login schemas;

receiving, by the virtual server, a second request from a second client to access a second resource of the one or more resources;

selecting, by the virtual server, from the repository, a second login schema associated with the second request to authenticate the second client;

receiving, by the virtual server, a third request from a third client to access a third resource of the one or more resources; and

selecting, by the virtual server, from the repository, a third login schema associated with the third request to authenticate the third client.

13. A system for generation of a login page to authenticate a client, comprising:

a device intermediary to a plurality of servers that provide one or more resources and a plurality of clients;

a repository storing a plurality of login schemas;

an interface of the device configured to receive a request from the client to access a resource of the one or more resources;

a form generator executed by a virtual server of the device and configured to generate forms for each of the plurality of login schemas stored in the repository, wherein an authentication module executing on a server is configured to authenticate the client using at least one of the plurality of login schemas, the form generator further configured to:

select a login schema associated with the request from the repository storing the plurality of login schemas, the login schema comprising a definition of a login form using an authentication protocol, the login schema including one or more of an authentication schema or a dialog schema, and

generate responsive to the request, the login page constructed for the client to access the resource according to the definition provided by the selected login schema and based on a combination of the one or more of the authentication schema or the dialog schema;

wherein the interface is configured to receive information inputted into the login form via the client and authenticate the client using the at least one of the plurality of login schemas via the authentication module executing on the server; and

the device is configured to establish, responsive to authentication of the client based on the information and the authentication protocol, access to the resource by the client.

14. The system of claim 13 , wherein the device is further configured to:

identify a server specified by the login schema configured to perform authentication;

transmit the information to the server based on the login schema;

receive authentication information generated by the server; and

use the authentication information received from the server to authenticate the client.

15. The system of claim 13 , wherein the device is further configured to:

identify a policy of the login schema;

retrieve, based on the policy, the authentication module from the server, the authentication module configured with at least one of a CAPTCHA or a token; and

configure, responsive to the request, the login form with the authentication module.

16. The system of claim 13 , wherein the device is further configured to:

aggregate, based on the login schema, a plurality of form fields associated with a plurality of different types of authentication modules; and

configure, responsive to the request, the login form with the plurality of form fields.

17. The system of claim 13 , wherein the device is further configured to:

extract a field from a plurality of fields in the request; and

configure the login form based on the extracted field from the request.

18. The system of claim 13 , wherein the device is further configured to:

create a first cascade comprising a first authentication policy of a first login schema, and a second cascade comprising a second authentication policy of a second login schema;

generate a first login form with the first authentication policy and a second login form with the second authentication policy;

generate a first login field for the first login form using the first login schema and a second login field for the second login form using the second login schema;

provide the first cascade with the first login field of the first login form for display on the client; and

provide, based on input received responsive to the first cascade, the second cascade with the second login field of the second login form for display on the client.

19. The system of claim 13 , wherein the device is further configured to:

create, based on the login schema, at least three cascades, wherein each of the at least three cascades includes a priority, an authentication policy, a login schema, and a next cascade identifier that identifies a next cascade to use responsive to authentication via a first cascade of the at least three cascades.

20. The system of claim 19 , wherein the device is further configured to:

determine that credential information received from the client fails to satisfy the authentication policy in the first cascade;

select, responsive to failure of the authentication policy in the first cascade, a second cascade of the at least three cascades identified by the next cascade identifier; and

authenticate the client with a second authentication policy of the second cascade.

Assignments (9)

Continuity (1)