User authentication framework
Described herein is a framework to authenticate users. In accordance with one aspect of the framework, an authentication library is provided to implement an authentication process. The authentication library comprises computer-readable program code to create a request for an access token, send the request to the authorization server, deconstruct a response from the authorization server to extract the access token, and return the access token for use in accessing one or more resources.
1. A user authentication system, comprising:
a non-transitory memory device for storing an authentication library that is consumed by an application that requires authentication by an authorization server to access one or more resources stored in a resource server, wherein the authentication library comprises computer-readable program code; and
a processor in communication with the memory device, the processor being operative with the computer-readable program code to:
obtain an assertion from an identity provider,
invoke a token-based authentication process defined in the authentication library to:
create a request, including the assertion, for an access token for accessing the one or more resources stored in the resource server;
send the request to the authorization server via a computer network;
deconstruct a response from the authorization server to extract the access token, wherein the deconstruction comprises deserializing the response and generating an object of a pre-defined type, wherein the object stores an access token identifier, an access token type, an expires-in value, an expiry time, a scope of the access token, or a combination thereof; and
return the access token to the application for use in accessing the one or more resources stored in the resource server via the computer network.
2. The system of claim 1 wherein the application comprises a .NET framework application.
3. The system of claim 2 wherein the resource server comprises a NETWEAVER application server.
4. The system of claim 1 wherein the request for the access token comprises a hypertext transfer protocol (HTTP) request.
5. The system of claim 1 wherein the request for the access token comprises a client device identifier, an assertion received from an identity provider and a list of one or more scopes.
6. A non-transitory computer-readable medium having stored thereon program code, the program code executable by a computer to perform steps comprising:
obtaining an assertion from an identity provider; and
executing a token-based authentication process defined in an authentication library, wherein the executing comprises:
creating a request, including the assertion, for an access token for accessing the resource stored in the resource server,
sending the request to an authorization server over a computer network,
deconstructing a response from the authorization server to extract the access token, wherein the deconstructing comprises deserializing a body of the response and generating an object of a pre-defined type, wherein the object stores an access token identifier, an access token type, an expires-in value, an expiry time, a scope of the access token, or a combination thereof, and
returning the access token to the application for use in accessing the resource stored in the resource server.
7. The non-transitory computer-readable medium of claim 6 , wherein the program code is executable by the computer to create the request for the access token via a client object that represents a calling client device.
8. The non-transitory computer-readable medium of claim 6 , wherein the program code is executable by the computer to create the request for the access token by creating a hypertext transfer protocol (HTTP) request.
9. The non-transitory computer-readable medium of claim 6 , wherein the program code is executable by the computer to create the request for the access token by creating a request that comprises a client device identifier, the assertion received from the identity provider, and one or more scopes for the one or more resources.
10. The non-transitory computer-readable medium of claim 6 , wherein the program code is executable by the computer to create the request for the access token by encoding the request and setting hypertext transfer protocol (HTTP) headers.
11. The non-transitory computer-readable medium of claim 6 , wherein the steps further comprise calculating the time of expiry of the access token.
12. The non-transitory computer-readable medium of claim 6 , wherein the assertion comprises a Security Assertion Markup Language (SAML) assertion.
13. A method performed by one or more computing devices, the method comprising:
obtaining an assertion from an identity provider; and
invoking a token-based authentication process defined in the authentication library, wherein the invoking comprises:
creating a request, including the assertion, for an access token for accessing the resource stored in the resource server,
sending the request to an authorization server over a computer network,
deconstructing a response from the authorization server to extract the access token, wherein the deconstructing comprises deserializing the response and generating an object of a pre-defined type, wherein the object stores an access token identifier, an access token type, an expires-in value, an expiry time, a scope of the access token, or a combination thereof, and
returning the access token to the application for use in accessing the resource stored in the resource server.
14. The method of claim 13 , wherein the request is created via a client object that represents a calling client device.