Secure content management through authentication
Techniques are described herein for performing authentication, and also “eager” or “lazy” fetch of data, for restricted webpages based on the restricted webpages being associated with an authentication tier in an AASD registry. Inclusion of a restricted webpage in the AASD registry enables AASD-based authentication for the webpage. According to embodiments, information for a restricted webpage included in the AASD registry includes one or more of the following for the webpage: an identifier, an authentication level, allowed fields, eager fetch fields, one or more sources for one or more fields, etc. When information for a webpage is included in the AASD registry, that information is used to perform eager fetch for one or more fields of the webpage that are not associated with authentication requirements indicated in the AASD registry information, or whose authentication requirements are already fulfilled by the requesting client.
1. A computer-executed method comprising:
maintaining registry information for one or more restricted webpages;
wherein the registry information for each restricted webpage, of the one or more restricted webpages, includes:
an identifier of said each restricted webpage, and
an authentication tier, of an ordered plurality of authentication tiers, associated with at least a portion of said each restricted webpage;
wherein each authentication tier, of the ordered plurality of authentication tiers, is associated with a set of authentication requirements;
receiving, from a client, a request for a particular restricted webpage of the one or more restricted webpages;
in response to receiving the request for the particular restricted webpage:
based, at least in part, on the registry information, identifying a particular authentication tier associated with at least a portion of the particular restricted webpage,
determining whether the client is associated with an authentication tier, of the ordered plurality of authentication tiers, that is at or above a level of the particular authentication tier within the ordered plurality of authentication tiers,
responsive to determining that the client is not associated with an authentication tier, of the ordered plurality of authentication tiers, that is at or above the level of the particular authentication tier, causing one or more authentication requests, for one or more particular authentication requirements associated with the particular authentication tier, to be issued to the client, and
after causing the one or more authentication requests to be issued to the client:
receiving authentication information, associated with the client, that qualifies the client to be associated with an authentication tier that is at or above the level of the particular authentication tier,
after receiving the authentication information associated with the client, determining that the client is associated with an authentication tier, of the ordered plurality of authentication tiers, that is at or above the level of the particular authentication tier, and
responsive to determining that the client is associated with the authentication tier, of the ordered plurality of authentication tiers, that is at or above the level of the particular authentication tier, allowing the client access to said at least a portion of the particular restricted webpage;
wherein the method is performed by one or more computing devices.
2. The computer-executed method of claim 1 , wherein said at least a portion of the particular restricted webpage is one or more fields of the particular restricted webpage.
3. The computer-executed method of claim 1 , wherein said at least a portion of the particular restricted webpage is all of the particular restricted webpage.
4. The computer-executed method of claim 1 , wherein said at least a portion of the particular restricted webpage is a restricted action accessible on the particular restricted webpage.
5. The computer-executed method of claim 1 , wherein:
said at least a portion of the particular restricted webpage is a first portion of the particular restricted webpage; and
the method further comprises: in response to receiving the request for the particular restricted webpage and prior to allowing the client access to the first portion of the particular restricted webpage, allowing the client access to a second portion of the particular restricted webpage other than the first portion of the particular restricted webpage.
6. The computer-executed method of claim 5 , wherein:
the second portion of the particular restricted webpage is associated, in the registry information with a second authentication tier, of the ordered plurality of authentication tiers, that is at a lower level than the particular authentication tier;
the method further comprises, prior to allowing the client access to the second portion of the particular restricted webpage:
determining that the client is associated with an authentication tier, of the ordered plurality of authentication tiers, that is at or above a level of the second authentication tier within the ordered plurality of authentication tiers, and
wherein said allowing the client access to the second portion of the particular restricted webpage is responsive to determining that the client is associated with the authentication tier, of the ordered plurality of authentication tiers, that is at or above the level of the second authentication tier.
7. The computer-executed method of claim 1 , wherein:
an identifier of the particular restricted webpage, in the registry information, is associated with an identifier of a particular field of the particular restricted webpage;
the identifier of the particular field, in the registry information, is associated with the particular authentication tier;
allowing the client access to the particular restricted webpage comprises:
fetching a value for the particular field from a field value source, and
wherein the particular restricted webpage accessible by the client includes the fetched value for the particular field.
8. The computer-executed method of claim 7 , wherein:
the identifier of the particular restricted webpage, in the registry information, is associated with a second identifier of a second field of the particular restricted webpage;
the identifier of the second field, in the registry information, is associated with a second authentication tier that is a higher-level tier than the particular authentication tier within the ordered plurality of authentication tiers;
allowing the client access to the particular restricted webpage further comprises:
fetching a link for a value for the second field,
wherein a web server that serves the particular restricted webpage uses the link to fetch the value for the second field from a field value source, and
including the fetched value for the second field in the particular restricted webpage accessible by the client when the client is associated with an authentication tier, of the ordered plurality of authentication tiers, that is at or above the level of the second authentication tier.
9. The computer-executed method of claim 1 , wherein:
the identifier of the particular restricted webpage, in the registry information, is associated with an identifier of a particular field of the particular restricted webpage;
the identifier of the particular field, in the registry information, is associated with the particular authentication tier
allowing the client access to the particular restricted webpage comprises:
fetching a link for a value for the particular field,
wherein a web server that serves the particular restricted webpage uses the link to fetch the value for the particular field from a field value source, and
wherein the particular restricted webpage accessible by the client includes the fetched value for the particular field.
10. The computer-executed method of claim 1 , wherein:
the registry information for the particular restricted webpage includes source information that identifies a field value source for a particular field in said at least a portion of the particular restricted webpage:
allowing the client access to said at least a portion of the particular restricted webpage comprises using the source information for the particular field to access a value for the particular field from the field value source to display in the particular restricted webpage.
11. The computer-executed method of claim 1 , further comprising, prior to receiving the request for the particular restricted webpage:
receiving, from a web server that serves the particular restricted webpage, registration information for the particular restricted webpage;
wherein the registration information identifies the particular authentication tier; and
in response to receiving the registration information, maintaining particular registry information that identifies the particular restricted webpage and the particular authentication tier.
12. The computer-executed method of claim 1 , further comprising:
receiving, from the client, a second request for second restricted webpage that is not included in the registry information;
in response to receiving the second request for the second restricted webpage:
determining whether the client is associated with a highest authentication tier of the ordered plurality of authentication tiers,
responsive to determining that the client is not associated with the highest authentication tier, causing second one or more authentication requests, for one or more authentication requirements associated with the highest authentication tier, to be issued to the client, and
after causing the second one or more authentication requests to be issued to the client:
receiving second authentication information, associated with the client, that qualifies the client to be associated with the highest authentication tier,
after receiving the second authentication information, determining that the client is associated with the highest authentication tier, and
responsive to determining that the client is associated with the highest authentication tier, allowing the client access to the second restricted webpage.
13. The computer-executed method of claim 1 , wherein an identifier of the particular restricted webpage, in the registry information, comprises one or more of: a URL for the particular restricted webpage; a relative path for the particular restricted webpage; information for a web server for the particular restricted webpage; one or more protected data fields of the particular restricted webpage; or source information for one or more protected data fields of the particular restricted webpage.
14. A system, comprising:
one or more computing devices; and
one or more non-transitory computer-readable media storing one or more sequences of instructions that, when executed by the one or more computing devices, cause:
maintaining registry information for one or more restricted webpages;
wherein the registry information for each restricted webpage, of the one or more restricted webpages, includes:
an identifier of said each restricted webpage, and
an authentication tier, of an ordered plurality of authentication tiers, associated with at least a portion of said each restricted webpage;
wherein each authentication tier, of the ordered plurality of authentication tiers, is associated with a set of authentication requirements;
receiving, from a client, a request for a particular restricted webpage of the one or more restricted webpages;
in response to receiving the request for the particular restricted webpage:
based, at least in part, on the registry information, identifying a particular authentication tier associated with at least a portion of the particular restricted webpage,
determining whether the client is associated with an authentication tier, of the ordered plurality of authentication tiers, that is at or above a level of the particular authentication tier within the ordered plurality of authentication tiers,
responsive to determining that the client is not associated with an authentication tier, of the ordered plurality of authentication tiers, that is at or above the level of the particular authentication tier, causing one or more authentication requests, for one or more particular authentication requirements associated with the particular authentication tier, to be issued to the client, and
after causing the one or more authentication requests to be issued to the client:
receiving authentication information, associated with the client, that qualifies the client to be associated with an authentication tier that is at or above the level of the particular authentication tier,
after receiving the authentication information associated with the client, determining that the client is associated with an authentication tier, of the ordered plurality of authentication tiers, that is at or above the level of the particular authentication tier, and
responsive to determining that the client is associated with the authentication tier, of the ordered plurality of authentication tiers, that is at or above the level of the particular authentication tier, allowing the client access to said at least a portion of the particular restricted webpage.
15. The system of claim 14 , wherein:
said at least a portion of the particular restricted webpage is a first portion of the particular restricted webpage;
a second portion of the particular restricted webpage, other than the first portion of the particular restricted webpage, is associated in the registry information with a second authentication tier, of the ordered plurality of authentication tiers, that is at a lower level than the particular authentication tier; and
the one or more sequences of instructions further comprise instructions that, when executed by the one or more computing devices, cause, in response to receiving the request for the particular restricted webpage and prior to allowing the client access to the first portion of the particular restricted webpage:
determining that the client is associated with an authentication tier, of the ordered plurality of authentication tiers, that is at or above a level of the second authentication tier within the ordered plurality of authentication tiers, and
responsive to determining that the client is associated with the authentication tier, of the ordered plurality of authentication tiers, that is at or above the level of the second authentication tier, allowing the client access to the second portion of the particular restricted webpage.
16. The system of claim 14 , wherein:
an identifier of the particular restricted webpage, in the registry information, is associated with an identifier of a particular field of the particular restricted webpage;
the identifier of the particular field, in the registry information, is associated with the particular authentication tier;
allowing the client access to the particular restricted webpage comprises:
fetching a value for the particular field from a field value source, and
wherein the particular restricted webpage accessible by the client includes the fetched value for the particular field.
17. The system of claim 14 , wherein: the identifier of the particular restricted webpage, in the registry information, is associated with a second identifier of a second field of the particular restricted webpage; the identifier of the second field, in the registry information, is associated with a second authentication tier that is a higher-level tier than the particular authentication tier within the ordered plurality of authentication tiers; allowing the client access to the particular restricted webpage further comprises: fetching a link for a value for the second field, wherein a web server that serves the particular restricted webpage uses the link to fetch the value for the second field from a field value source, and including the fetched value for the second field in the particular restricted webpage accessible by the client when the client is associated with an authentication tier, of the ordered plurality of authentication tiers, that is at or above the level of the second authentication tier.
18. The system of claim 14 , wherein:
the identifier of the particular restricted webpage, in the registry information, is associated with an identifier of a particular field of the particular restricted webpage;
the identifier of the particular field, in the registry information, is associated with the particular authentication tier
allowing the client access to the particular restricted webpage comprises:
fetching a link for a value for the particular field,
wherein a web server that serves the particular restricted webpage uses the link to fetch the value for the particular field from a field value source, and
wherein the particular restricted webpage accessible by the client includes the fetched value for the particular field.
19. The system of claim 14 , wherein:
the registry information for the particular restricted webpage includes source information that identifies a field value source for a particular field in said at least a portion of the particular restricted webpage:
allowing the client access to said at least a portion of the particular restricted webpage comprises using the source information for the particular field to access a value for the particular field from the field value source to display in the particular restricted webpage.
20. One or more non-transitory computer-readable media storing one or more sequences of instructions that, when executed by one or more processors, cause:
maintaining registry information for one or more restricted webpages;
wherein the registry information for each restricted webpage, of the one or more restricted webpages, includes:
an identifier of said each restricted webpage, and
an authentication tier, of an ordered plurality of authentication tiers, associated with at least a portion of said each restricted webpage;
wherein each authentication tier, of the ordered plurality of authentication tiers, is associated with a set of authentication requirements;
receiving, from a client, a request for a particular restricted webpage of the one or more restricted webpages;
in response to receiving the request for the particular restricted webpage:
based, at least in part, on the registry information, identifying a particular authentication tier associated with at least a portion of the particular restricted webpage,
determining whether the client is associated with an authentication tier, of the ordered plurality of authentication tiers, that is at or above a level of the particular authentication tier within the ordered plurality of authentication tiers,
responsive to determining that the client is not associated with an authentication tier, of the ordered plurality of authentication tiers, that is at or above the level of the particular authentication tier, causing one or more authentication requests, for one or more particular authentication requirements associated with the particular authentication tier, to be issued to the client, and
after causing the one or more authentication requests to be issued to the client:
receiving authentication information, associated with the client, that qualifies the client to be associated with an authentication tier that is at or above the level of the particular authentication tier,
after receiving the authentication information associated with the client, determining that the client is associated with an authentication tier, of the ordered plurality of authentication tiers, that is at or above the level of the particular authentication tier, and
responsive to determining that the client is associated with the authentication tier, of the ordered plurality of authentication tiers, that is at or above the level of the particular authentication tier, allowing the client access to said at least a portion of the particular restricted webpage.