Granted Patent B2

US 10,505,733 · App. 15/714,460 · Granted Dec 10, 2019

Inventors: Bradley Markus Rowe (Boca Raton, FL); Ricardo Feijoo (Davie, FL); Tom Michael Kludy (Cooper City, FL); Ayush Jain (North Lauderdale, FL); Gerald Haagsma (Fort Lauderdale, FL)

Assignee: Citrix Systems, Inc.

H04L9/3213H04L9/0891H04L63/0807H04L63/0884H04L9/0861H04L2463/082

Abstract

Claims (120)

1. A method comprising:

at a composite identity server comprising at least one processor, at least one memory, and at least one communication interface:

receiving, by the at least one processor and from a user agent associated with a user computing device, a request to upgrade a first authentication token triggered by a relying party server, wherein the relying party server is associated with services provided by a first relying party and services provided by a second relying party, wherein the first authentication token was issued by a first identity provider to permit the user agent access to the services provided by the first relying party;

determining, by the at least one processor, whether the user agent is currently involved in a valid identity login session associated with the relying party server;

in response to determining that the user agent is currently involved in the valid identity login session associated with the relying party server, redirecting, by the at least one processor, the user agent to an identity provider server associated with a second identity provider for authentication;

receiving, by the at least one processor and from the identity provider server associated with the second identity provider, a second authentication token, the second authentication token indicating that an authorization code associated with the identity provider server is valid, wherein the second authentication token permits the user agent access to the services provided by the second relying party;

sending, by the at least one processor and to a federated microservice server, the second authentication token for transformation, wherein the federated microservice server is specific to the second identity provider;

receiving, by the at least one processor and from the federated microservice server, one or more transformed claims of the second authentication token and one or more claims of the second authentication token designated for storage by a profile microservice server;

sending, by the at least one processor and to the profile microservice server, the one or more claims of the second authentication token designated for storage at the profile microservice server;

after receiving a storage confirmation from the profile microservice server, redirecting, by the at least one processor, the user agent to the relying party server with an authorization code associated with the composite identity server;

after redirecting the user agent to the relying party server, receiving, by the at least one processor and from the relying party server, the authorization code associated with the composite identity server;

in response to determining that the authorization code associated with the composite identity server received from the relying party server is valid, sending, by the at least one processor and to the relying party server, a composite token comprising:

the one or more transformed claims of the second authentication token; and

one or more claims of the first authentication token,

wherein the composite token permits, via the relying party server, the user agent access to the services provided by the first relying party and the services provided by the second relying party.

2. The method of claim 1 , further comprising:

at the composite identity server,

after redirecting the user agent to the identity provider server, receiving, by the at least one processor and from the user agent, the authorization code associated with the identity provider server; and

sending, by the at least one processor and to the identity provider server, the authorization code associated with the identity provider server for validation.

3. The method of claim 1 , comprising:

at the composite identity server,

receiving, by the at least one processor and from the relying party server, the composite token and user information identifying a user associated with the user agent;

sending, by the at least one processor and to the profile microservice server, the user information; and

receiving, by the at least one processor and from the profile microservice server, one or more updated, transformed claims of the second authentication token.

4. The method of claim 3 , comprising:

at the composite identity server:

sending, by the at least one processor and to a principal microservice, the user information;

receiving, by the at least one processor and from the principal microservice, one or more updated claims of the first authentication token; and

generating, by the at least one processor, an updated composite token comprising:

the one or more updated claims of the first authentication token, and

the one or more updated, transformed claims of the second authentication token.

5. The method of claim 3 , comprising:

at the profile microservice server:

receiving, by at least one processor of the profile microservice server and from the composite identity server, the user information and the composite token;

in response to receiving the user information, sending, by the at least one processor of the profile microservice server and to the federated microservice server, the one or more transformed claims of the second authentication token;

receiving, by the at least one processor of the profile microservice server and from the federated microservice server, the one or more updated, transformed claims of the second authentication token; and

sending, by the at least one processor of the profile microservice server and to the composite identity server, the one or more updated, transformed claims of the second authentication token.

6. The method of claim 1 , comprising:

at the federated microservice server:

receiving, by at least one processor of the federated microservice server and from the composite identity server, the second authentication token;

transforming, by the at least one processor of the federated microservice server, one or more claims of the second authentication token to produce the one or more transformed claims of the second authentication token, wherein the transforming comprises one or more of:

replacing a claim of the one or more claims of the second authentication token with a new claim;

amending a claim of the one or more claims of the second authentication token; or

appending a new claim to the second authentication token; and

designating, by the at least one processor of the federated microservice server, one or more claims of the second authentication token for storage by the profile microservice server to produce the one or more claims of the second authentication token designated for storage by the profile microservice server.

7. The method of claim 1 , comprising:

at the relying party server:

determining, by at least one processor of the relying party server, that the user agent is attempting to access the services provided by the second relying party and that the second relying party is associated with a two-factor authentication; and

generating, by the at least one processor of the relying party server, the request to upgrade the first authentication token.

8. The method of claim 1 , comprising:

at the relying party server:

determining, by at least one processor of the relying party server, that the user agent is attempting to access services provided by a third relying party associated with the relying party server; and

in response to determining that the user agent is attempting to access the service associated with the third relying party, generating, by the at least one processor of the relying party server, a second request to upgrade the composite token to produce an upgraded composite token.

9. The method of claim 8 , comprising:

at the user agent:

interacting, by at least one processor of the user computing device and via the relying party server, with the services provided by the first relying party using the upgraded composite token;

interacting, by the at least one processor of the user computing device and via the relying party server, with the services provided by the second relying party using the upgraded composite token; and

interacting, by the at least one processor of the user computing device and via the relying party server, with the services provided by the third relying party using the upgraded composite token.

10. The method of claim 1 , comprising:

in response to determining that the user agent is currently not involved in the valid identity login session associated with the relying party server, preventing, by the at least one processor, generation of the composite token.

11. A system comprising:

a composite identity server comprising at least one processor, a memory, and at least one communication interface,

wherein the composite identity server is configured to:

receive, by the at least one processor and from a user agent associated with a user computing device, a request to upgrade a first authentication token triggered by a relying party server, wherein the relying party server is associated with services provided by a first relying party and services provided by a second relying party, wherein the first authentication token was issued by a first identity provider to permit the user agent access to the services provided by the first relying party;

determine, by the at least one processor, whether the user agent is currently involved in a valid identity login session associated with the relying party server;

in response to determining that the user agent is currently involved in the valid identity login session associated with the relying party server, redirect, by the at least one processor, the user agent to an identity provider server associated with a second identity provider for authentication;

receive, by the at least one processor and from the identity provider server, a second authentication token, the second authentication token indicating that an authorization code associated with the identity provider server is valid, wherein the second authentication token permits the user agent access to the services provided by the second relying party;

send, by the at least one processor and to a federated microservice server, the second authentication token for transformation, wherein the federated microservice server is specific to the second identity provider;

receive, by the at least one processor and from the federated microservice server, one or more transformed claims of the second authentication token and one or more claims of the second authentication token designated for storage by a profile microservice server;

send, by the at least one processor and to the profile microservice server, the one or more claims of the second authentication token designated for storage by the profile microservice server;

after receiving a storage confirmation from the profile microservice server, redirect, by the at least one processor, the user agent to the relying party server with an authorization code associated with the composite identity server;

after redirecting the user agent to the relying party server, receive, by the at least one processor and from the relying party server, the authorization code associated with the composite identity server;

in response to determining that the authorization code associated with the composite identity server received from the relying party server is valid, send, by the at least one processor and to the relying party server, a composite token comprising:

the one or more transformed claims of the second authentication token; and

one or more claims of the first authentication token,

wherein the composite token permits, via the relying part server, the user agent access to the services provided by the first relying party and the services provided by the second relying party.

12. The system of claim 11 , wherein the composite identity server is configured to:

after redirecting the user agent to the identity provider server, receive, by the at least one processor and from the user agent, the authorization code associated with the identity provider server; and

send, by the at least one processor and to the identity provider server, the authorization code associated with the identity provider server for validation.

13. The system of claim 11 , wherein the composite identity server is configured to:

receive, by the at least one processor and from the relying party server, the composite token and user information identifying a user associated with the user agent;

send, by the at least one processor and to the profile microservice server, the user information; and

receive, by the at least one processor and from the profile microservice server, one or more updated, transformed claims of the second authentication token.

14. The system of claim 13 , wherein the composite identity server is configured to:

send, by the at least one processor and to a principal microservice, the user information;

receive, by the at least one processor and from the principal microservice, one or more updated claims of the first authentication token; and

generate, by the at least one processor, an updated composite token comprising:

the one or more updated claims of the first authentication token, and

the one or more updated, transformed claims of the second authentication token.

15. The system of claim 11 , wherein the composite identity server is configured to:

update, by the at least one processor, the composite token to produce an updated composite token, wherein the updated composite token is configured to permit, via the relying party server, interactions with the services provided by the first relying party, the services provided by the second relying party, and services provided by a third relying party.

16. One or more non-transitory computer readable media storing computer-executable instructions that, when executed by at least one processor, cause a composite identity server to:

receive, by the at least one processor and from a user agent associated with a user computing device, a request to upgrade a first authentication token triggered by a relying party server, wherein the relying party server is associated with services provided by a first relying party and services provided by a second relying party, wherein the first authentication token was issued by a first identity provider to permit the user agent access to the services provided by the first relying party;

determine, by the at least one processor, whether the user agent is currently involved in a valid identity login session associated with the relying party server;

in response to determining that the user agent is currently involved in the valid identity login session associated with the relying party server, redirect, by the at least one processor, the user agent to an identity provider server associated with a second identity provider for authentication;

receive, by the at least one processor and from the identity provider server, a second authentication token, the second authentication token indicating that an authorization code associated with the first identity provider server is valid, wherein the second authentication token permits the user agent access to the services provided by the second relying party;

send, by the at least one processor and to a federated microservice server, the second authentication token for transformation, wherein the federated microservice server is specific to the second identity provider;

receive, by the at least one processor and from the federated microservice server, one or more transformed claims of the second authentication token and one or more claims of the second authentication token designated for storage by a profile microservice server;

send, by the at least one processor and to the profile microservice server, the one or more claims of the second authentication token designated for storage by the profile microservice server;

after receiving a storage confirmation from the profile microservice server, redirect, by the at least one processor, the user agent to the relying party server with an authorization code associated with the composite identity server;

after redirecting the user agent to the relying party server, receive, by the at least one processor and from the relying party server, the authorization code associated with the composite identity server;

in response to determining that the authorization code associated with the composite identity server received from the relying party server is valid, send, by the at least one processor and to the relying party server, a composite token comprising:

the one or more transformed claims of the second authentication token; and

one or more claims of the first authentication token,

wherein the composite token permits, via the relying party server, the user agent access to the services provided by the first relying party and the services provided by the second relying party.

17. The one or more non-transitory computer readable media of claim 16 , wherein the instructions, when executed by at least one processor, cause the composite identity server to:

after redirecting the user agent to the identity provider server, receive, by the at least one processor and from the user agent, the authorization code associated with the identity provider server; and

send, by the at least one processor and to the identity provider server, the authorization code associated with the identity provider server for validation.

18. The one or more non-transitory computer readable media of claim 16 , wherein the instructions, when executed by at least one processor, cause the composite identity server to:

receive, by the at least one processor and from the relying party server, the composite token and user information identifying a user associated with the user agent;

send, by the at least one processor and to the profile microservice server, the user information; and

receive, by the at least one processor and from the profile microservice server, one or more updated, transformed claims of the second authentication token.

19. The one or more non-transitory computer readable media of claim 18 , wherein the instructions, when executed by at least one processor, cause the composite identity server to:

send, by the at least one processor and to a principal microservice, the user information;

receive, by the at least one processor and from the principal microservice, one or more updated claims of the first authentication token; and

generate, by the at least one processor, an updated composite token comprising:

the one or more updated claims of the first authentication token, and

the one or more updated, transformed claims of the second authentication token.

20. The one or more non-transitory computer readable media of claim 16 , wherein the instructions, when executed by at least one processor, cause the composite identity server to:

update, by the at least one processor, the composite token to produce an updated composite token, wherein the updated composite token is configured to permit, via the relying party server, interactions with the services provided by the first relying party, the services provided by the second relying party, and services provided by a third relying party.

Assignments (9)

Continuity (1)

Cited By (3)

US 12,212,572 US 12,689,514 US 12,739,121