IP Library › Granted Patent US 11,196,732
Granted Patent B2
US 11,196,732 · App. 16/817,562 · Granted Dec 7, 2021

Single sign-on registration

Inventors: Dick Clarence Hardt (Seattle, WA); Darin Keith McAdams (Seattle, WA)
Assignee: Amazon Technologies, Inc.
H04L63/08H04L63/0807H04L63/0815H04L63/205H04L67/02H04L67/06H04L67/146
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,196,732
App. No.
16/817,562
Granted
Dec 7, 2021
Kind
B2
Abstract

An identity provider receives a request to configure authentication for enabling single sign-on to a service provider. The identity provider identifies the authentication protocols supported by the service provider and determines whether it is compatible with these authentication protocols. As a result of the identity provider being compatible with at least some of the authentication protocols, the identity provider generates configuration information that is usable by the service provider to configure the authentication. The identity provider transmits, to a computer system, a response that causes the computer system to be redirected to the service provider in order to provide information usable by the service provider to obtain the configuration information.

Claims (55)

1. A computer-implemented method, comprising:

obtaining, at an identity provider, a request to configure authentication for enabling single sign-on to a service provider, the request containing an identifier usable to retrieve protocol information;

identifying authentication protocols supported by the service provider based on the protocol information;

determining, based at least in part on the authentication protocols supported by the service provider, that the identity provider is compatible with the service provider;

generating configuration information of the identity provider, the configuration information usable by the service provider to configure the authentication; and

transmitting, to a computer system, a response to the request that causes the computer system to be redirected to the service provider and that indicates information usable by the service provider to obtain the configuration information to configure the authentication.

2. The computer-implemented method of claim 1 , further comprising:

identifying, from the identifier, a Uniform Resource Identifier corresponding to a location for a file of the service provider; and

retrieving the protocol information using the identifier by:

using the Uniform Resource Identifier to obtain the file from the location; and

extracting, from the file, the authentication protocols supported by the service provider.

3. The computer-implemented method of claim 1 , wherein the configuration information usable by the service provider to obtain the configuration information includes a token usable by the service provider to access the configuration information.

4. The computer-implemented method of claim 1 , further comprising:

obtaining a second request, wherein the second request is transmitted as a result of a redirect response from the service provider to the computer system;

using information from the second request to obtain second configuration information; and

using the second configuration information to enable single sign-on to the service provider using the authentication.

5. A system, comprising:

one or more machine-readable mediums comprising a set of instructions, which, as a result of execution by one or more processors, cause the system to at least:

obtain, at a first computer system, a request to configure authentication for a second computer system, the request usable to retrieve protocol information, wherein the request indicates a location of a file that specifies a set of authentication protocols supported by a third computer system;

retrieve the protocol information to determine compatibility of the first computer system and the third computer system; and

transmit, to the second computer system, a response to the request that indicates the third computer system and that indicates configuration information to be transmitted to the third computer system to configure authentication.

6. The system of claim 5 , wherein:

the set of instructions further cause the system to:

obtain, from the location, the file; and

determine, based at least in part on the set of authentication protocols supported by the third computer system specified in the file, that the first computer system is compatible with the third computer system.

7. The system of claim 5 , wherein the configuration information includes a token usable to access tenant-specific information for the second computer system, the tenant-specific information for the second computer system usable to configure the authentication.

8. The system of claim 5 , wherein the set of instructions, as a result of execution by one or more processors, further cause the system to:

obtain, from the second computer system, a second request that indicates second information usable by the first computer system to configure the authentication;

use the second information to obtain second configuration information for the third computer system; and

configure the authentication using the second configuration information.

9. The system of claim 5 , wherein the response includes a HyperText Transfer Protocol response that causes the second computer system to be redirected from the first computer system to the third computer system.

10. The system of claim 5 , wherein the first computer system is an identity provider and the third computer system is a service provider.

11. The system of claim 5 , wherein the first computer system is a service provider and the third computer system is an identity provider.

12. The system of claim 5 , wherein the authentication is configured using a Security Assertion Markup Language protocol.

13. A non-transitory computer-readable storage medium storing thereon a set of instructions that, in response to execution by one or more processors of a computer system, cause the computer system to at least:

obtain, at a first computer system, a request to configure authentication, the request identifying a location of a file that specifies authentication protocols supported by a second computer system;

based on the request, retrieve compatibility information;

determine compatibility between the first computer system and the second computer system based on the compatibility information; and

transmit, to a third computer system, a response to the request that indicates the second computer system and that indicates information to be transmitted to the second computer system to configure authentication.

14. The non-transitory computer-readable storage medium of claim 13 , wherein the authentication is configured using an OpenID Connect authentication protocol.

15. The non-transitory computer-readable storage medium of claim 13 , wherein the set of instructions, in response to execution by the one or more processors, further cause the computer system to:

generate a token and a nonce usable to access tenant-specific information for the first computer system usable to configure the authentication; and

include, in the information to be transmitted to the third computer system, the token and the nonce to enable the third computer system to access the tenant-specific information.

16. The non-transitory computer-readable storage medium of claim 13 , wherein:

retrieving the compatibility information includes utilizing a Uniform Resource Identifier to identify the location of the file and obtain the file from the location; and

determining compatibility includes determining, based at least in part on a set of authentication protocols identified from the file, that the first computer system is compatible with the second computer system.

17. The non-transitory computer-readable storage medium of claim 13 , wherein the response causes the third computer system to be redirected from the first computer system to the second computer system.

18. The non-transitory computer-readable storage medium of claim 13 , wherein the set of instructions, in response to execution by the one or more processors, further cause the computer system to:

obtain, from the third computer system, a second request that indicates a location for second information to configure the authentication;

obtain, from the location, the second information; and

configure the authentication using the second information.

19. The non-transitory computer-readable storage medium of claim 18 , wherein the set of instructions further cause the computer system to obtain, from the location, a token usable to initiate communications with the third computer system.

20. The non-transitory computer-readable storage medium of claim 13 , wherein:

the request is obtained via an interface provided by the first computer system, the interface specifying a set of computer systems for configuring the authentication, the second computer system part of the set of computer systems; and

the request indicates selection of the second computer system via the interface.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Mar 12, 2020
From: HARDT, DICK CLARENCE; MCADAMS, DARIN KEITH
To: AMAZON TECHNOLOGIES, INC.
Reel/Frame 052103/0481 →
Continuity (3)
Continuation 15677930 · Aug 15, 2017
Provisional Application 62492059 · Apr 28, 2017
Related Publication 20200220854A1 · Jul 9, 2020