Authentication for requests from third-party interfaces
Methods, systems, and apparatus, including computer-readable media, for authentication requests from third party interfaces. In some implementations, an information request is received to an information system from a computing system that provides a natural language interface, wherein the information request is associated with a user, and (ii) a token corresponding to the information request. In response to receiving the information request, a user data request and the token corresponding to the information request are sent for requesting user profile information for the user associated with the information request. A user identifier is extracted from user profile information received from the trusted profile provider system. A user identity is identified for the user based on a match between the extracted user identifier and a user identifier in a user registry associated with the information system. The information request is processed based on the identified user identity.
1. A method performed by one or more computers, the method comprising:
receiving, by the one or more computers, (i) an information request to an information system from a computing system that provides a natural language interface, wherein the information request is associated with a user, and (ii) a token associated with the information request, wherein the one or more computers are configured to interface between the information system and multiple different natural language interfaces operated by different third parties and to identify and authenticate users even if the multiple different natural language interfaces do not provide authentication tokens recognized by the information system;
in response to receiving the information request, sending, by the one or more computers, (i) the token associated with the information request and (ii) a user data request for information from a user profile for the user;
extracting, by the one or more computers, a user identifier from user profile information received in response to the user data request;
identifying, by the one or more computers, a user identity for the user based on a match between the extracted user identifier and a user identifier in a user registry associated with the information system; and
processing, by the one or more computers, the information request based on the identified user identity, comprising, in response to identifying the user identity, generating, by the one or more computers, one or more sessions between a web server and the computing system to provide the user access to the web server over the one or more sessions.
2. The method of claim 1 , wherein the token associated with the information request corresponds to a first authentication protocol; and
wherein identifying the user identity for the user based on the match between the extracted user identifier and the user identifier in the user registry comprises:
based on the match between the extracted user identifier and the user identifier in the user registry, generating, by the one or more computers, a second token that corresponds to an authentication protocol that is different from the first authentication protocol.
3. The method of claim 1 , further comprising:
determining that the token associated with the information request is not of a type used by the information system,
wherein the user data request is sent based on determining that the token associated with the information request is not of a type used by the information system.
4. The method of claim 1 , wherein the information request is from a system providing a natural language interface, and wherein the information request comprises a natural language query.
5. The method of claim 1 , wherein the information request comprises (i) text of a spoken request entered through a voice interface, (ii) text entered from a messaging platform, (iii) text entered using a social networking platform, or (iv) text entered using a chat platform.
6. The method of claim 1 , further comprising:
selecting a trusted profile provider system from among multiple trusted profile provider systems based on a source of the information request, wherein the selecting comprises using data indicating a mapping of sources of requests to the multiple trusted profile provider systems to select one of the multiple trusted profile provider systems that corresponds to the source of the information request.
7. The method of claim 1 , further comprising:
accessing mapping data indicating a mapping of different types of user identifiers to different trusted profile provider systems; and
selecting, based on the mapping data, one of the different types of user identifiers to extract from the user profile information received from the trusted profile provider system.
8. The method of claim 1 , wherein a trusted profile provider system is a predetermined provider known to verify an accuracy of at least a user identifier in the user profile information.
9. The method of claim 1 , further comprising:
providing, by the one or more computers, responses to the information request from the information system over the one or more sessions, wherein the responses have been personalized based on the identified user identity.
10. The method of claim 1 , wherein the information request is provided through an application programming interface (API) provided by a trusted profile provider system.
11. A system comprising:
one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
receiving, by the one or more computers, (i) an information request to an information system from a computing system that provides a natural language interface, wherein the information request is associated with a user, and (ii) a token associated with the information request, wherein the one or more computers are configured to interface between the information system and multiple different natural language interfaces operated by different third parties and to identify and authenticate users even if the multiple different natural language interfaces do not provide authentication tokens recognized by the information system;
in response to receiving the information request, sending, by the one or more computers, (i) the token associated with the information request and (ii) a user data request for information from a user profile for the user;
extracting, by the one or more computers, a user identifier from user profile information received in response to the user data request;
identifying, by the one or more computers, a user identity for the user based on a match between the extracted user identifier and a user identifier in a user registry associated with the information system; and
processing, by the one or more computers, the information request based on the identified user identity, comprising, in response to identifying the user identity, generating, by the one or more computers, one or more sessions between a web server and the computing system to provide the user access to the web server over the one or more sessions.
12. The system of claim 11 , wherein the token associated with the information request corresponds to a first authentication protocol; and
wherein identifying the user identity for the user based on the match between the extracted user identifier and the user identifier in the user registry comprises:
based on the match between the extracted user identifier and the user identifier in the user registry, generating, by the one or more computers, a second token that corresponds to an authentication protocol that is different from the first authentication protocol.
13. The system of claim 11 , wherein the operations further comprise:
determining that the token associated with the information request is not of a type used by the information system,
wherein the user data request is sent based on determining that the token associated with the information request is not of a type used by the information system.
14. The system of claim 11 , wherein the information request is from a system providing a natural language interface, and wherein the information request comprises a natural language query.
15. The system of claim 11 , wherein information request comprises (i) text of a spoken request entered through a voice interface, (ii) text entered from a messaging platform, (iii) text entered using a social networking platform, or (iv) text entered using a chat platform.
16. The system of claim 11 , wherein the operations further comprise:
selecting a trusted profile provider system from among multiple trusted profile provider systems based on a source of the information request, wherein the selecting comprises using data indicating a mapping of sources of requests to the multiple trusted profile provider systems to select one of the multiple trusted profile provider systems that corresponds to the source of the information request.
17. The system of claim 11 , wherein the operations further comprise:
accessing mapping data indicating a mapping of different types of user identifiers to different trusted profile provider systems; and
selecting, based on the mapping data, one of the different types of user identifiers to extract from the user profile information received from the trusted profile provider system.
18. One or more non-transitory computer-readable media storing software comprising instructions executable by one or more computers which, upon such execution, cause the one or more computers to perform operations comprising:
receiving, by the one or more computers, (i) an information request to an information system from a computing system that provides a natural language interface, wherein the information request is associated with a user, and (ii) a token associated with the information request, wherein the one or more computers are configured to interface between the information system and multiple different natural language interfaces operated by different third parties and to identify and authenticate users even if the multiple different natural language interfaces do not provide authentication tokens recognized by the information system;
in response to receiving the information request, sending, by the one or more computers, (i) the token associated with the information request and (ii) a user data request for information from a user profile for the user;
extracting, by the one or more computers, a user identifier from user profile information received in response to the user data request;
identifying, by the one or more computers, a user identity for the user based on a match between the extracted user identifier and a user identifier in a user registry associated with the information system; and
processing, by the one or more computers, the information request based on the identified user identity, comprising, in response to identifying the user identity, generating, by the one or more computers, one or more sessions between a web server and the computing system to provide the user access to the web server over the one or more sessions.