Identification federation based single sign-on
View Patent ↗A computer readable medium having instructions embodied therewith, the instructions executable by a processor or programmable circuitry of a federation server to cause the processor or programmable circuitry to perform operations including configuring a plurality of identification (ID) federations between the federation server and a plurality of applications such that each of the plurality of ID federations is between the federation server and one of the plurality of applications, receiving a first authentication request for authenticating a user who has been authenticated on a first application of the plurality of applications using an ID federation between the first application and the federation server from among the plurality of ID federations, and sending a second authentication request to a second application of the plurality of applications for authenticating the user using an ID federation between the federation server and the second application from among the plurality of ID federations.
1. A computer readable medium having instructions embodied therewith, the instructions executable by a processor or programmable circuitry of a federation server to cause the processor or programmable circuitry to perform operations comprising: configuring, by the federation server, a plurality of identification (ID) federations between the federation server and a plurality of applications, each of the plurality of ID federations being between the federation server and a respective one of the plurality of applications; receiving, by the federation server, a first authentication request via the user's client device from a first application of the plurality of applications for authenticating a user on a second application of the plurality of applications selected by the user, the user having been authenticated on the first application using an ID federation between the first application and the federation server, the first authentication request including an identifier of the second application; and sending, by the federation server, a second authentication request via the users client device to the second application, the second authentication request including authentication information associated with the second application for authenticating the user using an ID federation between the federation server and the second application.
2. The computer readable medium of claim 1 , wherein:
configuring includes configuring a first unidirectional ID federation directed from the first application to the federation server and a second unidirectional ID federation directed from the federation server to the second application;
receiving includes receiving the first authentication request for authenticating the user using the first unidirectional ID federation; and
sending includes sending the second authentication request for requesting the second application to authenticate the user using the second unidirectional ID federation.
3. The computer readable medium of claim 1 , further comprising:
registering an ID mapping of the user, the ID mapping indicating a correspondence between a first user ID on the first application and a second user ID on the second application; and
converting the first user ID indicated in the first authentication request to the second user ID based on the ID mapping.
4. The computer readable medium of claim 3 , further comprising predicting the second user ID from the first user ID based on an ID assignment rule of the second application.
5. The computer readable medium of claim 1 , further comprising registering a group of two or more applications of the plurality of applications that allow authentications using the plurality of ID federations, wherein sending includes sending the second authentication in response to a condition that the first application and the second application are in the group.
6. The computer readable medium of claim 1 , further comprising registering a relationship among the plurality of applications, the relationship defining one or more applications that are allowed to login from each application using the plurality of ID federations.
7. The computer readable medium of claim 1 , wherein:
the first authentication request designates the first application as an ID provider and the federation server as a service provider; and
the second authentication request designates the federation server as an ID provider and the second application as a service provider.
8. The computer readable medium of claim 1 , wherein the first authentication request includes a Uniform Resource Identifier (URL) of the federation server including the second application as a target of the second authentication request.
9. A system comprising: a configuring section, of a federation server, to configure a plurality of identification (ID) federations between the federation server and a plurality of applications such that each of the plurality of ID federations is between the federation server and one of the plurality of applications; a receiving section, of the federation server, to receive a first authentication request via the user's client device from a first application of the plurality of applications for authenticating a user on a second application of the plurality of applications selected by the user, the user having been authenticated on the first application using an ID federation between the first application and the federation server, the first authentication request including an identifier of the second application; and a sending section, of the federation server, to send a second authentication request via the user's client device to the second application, the second authentication request including authentication information associated with the second application for authenticating the user using an ID federation between the federation server and the second application.
10. The system of claim 9 , wherein:
the configuring section is further configured to configure a first unidirectional ID federation directed from the first application to the federation server and a second unidirectional ID federation directed from the federation server to the second application;
the receiving section is further configured to receive the first authentication request for authenticating the user using the first unidirectional ID federation; and
the sending section is further configured to send the second authentication request for requesting the second application to authenticate the user using the second unidirectional ID federation.
11. The system of claim 9 , further comprising one or more application servers operable to execute the plurality of applications.
12. The system of claim 9 , further comprising:
a registering section to register an ID mapping of the user, the ID mapping indicating a correspondence between a first user ID on the first application and a second user ID on the second application; and
a converting section to convert the first user ID indicated in the first authentication request to the second user ID based on the ID mapping.
13. A method comprising: configuring, by the federation server, a plurality of identification (ID) federations between a federation server and a plurality of applications such that each of the plurality of ID federations is between the federation server and one of the plurality of applications; receiving, by the federation server, a first authentication request via the user's client device from a first application of the plurality of applications for authenticating a user on a second application of the plurality of applications selected by the user, the user having been authenticated on the first application using an ID federation between the first application and the federation server, the first authentication request including an identifier of the second application; and sending, by the federation server, a second authentication request via the user's client device to the second application, the second authentication request including authentication information associated with the second application for authenticating the user using an ID federation between the federation server and the second application.
14. The method of claim 13 , wherein:
configuring includes configuring a first unidirectional ID federation directed from the first application to the federation server and a second unidirectional ID federation directed from the federation server to the second application;
receiving includes receiving the first authentication request for authenticating the user using the first unidirectional ID federation; and
sending includes sending the second authentication request for requesting the second application to authenticate the user using the second unidirectional ID federation.
15. The method of claim 13 , further comprising:
registering an ID mapping of the user, the ID mapping indicating a correspondence between a first user ID on the first application and a second user ID on the second application; and
converting the first user ID indicated in the first authentication request to the second user ID based on the ID mapping.
16. The method of claim 15 , further comprising predicting the second user ID from the first user ID based on an ID assignment rule of the second application.
17. The method of claim 13 , further comprising registering a group of two or more applications of the plurality of applications that allow authentications using the plurality of ID federations, wherein sending includes sending the second authentication in response to a condition that the first application and the second application are in the group.
18. The method of claim 13 , further comprising registering a relationship among the plurality of applications, the relationship defining one or more applications that are allowed to login from each application using the plurality of ID federations.
19. The method of claim 13 , wherein:
the first authentication request designates the first application as an ID provider and the federation server as a service provider; and
the second authentication request designates the federation server as an ID provider and the second application as a service provider.
20. The method of claim 13 , wherein the first authentication request includes a Uniform Resource Identifier (URL) of the federation server including the second application as a target of the second authentication request.