Method for using openID connect to manage access to data with rights granted by multiple authentication providers
An approach to allow cloud-based positioning systems to use their own identity provider. An extra field is included in a token that is used to look up the identity provider for token verification for each user. Each access claim of the access token is checked for invalidity. If no invalid claims are found, accepting the authorization request. If an invalid claim is found, rejecting the authorization request.
1. A method of validating an authorization request comprising:
receiving, from a user, an access token, the access token having been issued by an identity provider and provided to the user;
extracting an identity provider identifier from the access token;
validating the access token by using the identity provider identifier as a key in a database to confirm the identity provider is a known identity provider;
further validating the access token using keys obtained from a JSON Web Token (JWT) key set of the known identity provider;
checking each access claim of the access token for invalidity, wherein at least one of the each access claim provides access for an access level within a hierarchy of access levels; and
if no invalid claims are found, accepting the authorization request.
2. The method of claim 1 , further comprising:
if any of the access claims are invalid, failing the authorization request.
3. The method of claim 1 , further comprising:
if a first access claim of the access claims is invalid and a second access claim of the access claims is valid, accepting authorization for access associated with the second access claim.
4. The method of claim 1 , wherein the identity provider is provided control over only a predetermined subset of all data elements and organizations.
5. The method of claim 4 , wherein the access token is invalid if any access claim of the access token falls outside the predetermined subset of all data elements and organizations available to the identity provider.
6. The method of claim 1 , wherein a validated access claim provides access to less than all data elements under control of the identity provider.
7. The method of claim 1 , further comprising:
checking that an expiration time in the access token is a future time.
8. The method of claim 1 , wherein the authorization request is associated with a real-time location services provision.
9. A computer-implemented method for validating an authorization request, the computer-implemented method comprising:
receiving, from a user, an access token, the access token having been issued by an identity provider and provided to the user;
extracting an identity provider identifier from the access token;
validating the access token by using the identity provider identifier as a key in a database to confirm the identity provider is a known identity provider;
further validating the access token using keys obtained from a JSON Web Token (JWT) key set of the known identity provider;
checking each access claim of the access token for invalidity, wherein at least one of the each access claim provides access for an access level within a hierarchy of access levels; and
if no invalid claims are found, accepting the authorization request.
10. The computer-implemented method of claim 9 , further comprising:
if any of the access claims are invalid, failing the authorization request.
11. The computer-implemented method of claim 9 , further comprising:
if a first access claim of the access claims is invalid and a second access claim of the access claims is valid, accepting authorization for access associated with the second access claim.
12. The computer-implemented method of claim 9 , wherein a validated access claim provides access to less than all data elements under control of the identity provider.
13. The computer-implemented method of claim 9 , further comprising:
checking that an expiration time in the access token is a future time.
14. The computer-implemented method of claim 9 , wherein the authorization request is associated with a real-time location services provision.
15. A services provision system comprising at least one processor and a memory coupled to the at least one processor, the at least one processor configured to:
receive, from a user, an access token, the access token having been issued by an identity provider and provided to the user;
extract an identity provider identifier from the access token;
validate the access token by using the identity provider identifier as a key in a database to confirm the identity provider is a known identity provider;
further validate the access token using keys obtained from a JSON Web Token (JWT) key set of the known identity provider;
check each access claim of the access token for invalidity, wherein at least one of the each access claim provides access for an access level within a hierarchy of access levels; and
if no invalid claims are found, accept the authorization request.
16. The services provision system of claim 15 , wherein the at least one processor is further configured to:
if any of the access claims are invalid, fail the authorization request.
17. The services provision system of claim 15 , wherein the at least one processor is further configured to:
if a first access claim of the access claims is invalid and a second access claim of the access claims is valid, accept authorization for access associated with the second access claim.
18. The services provision system of claim 15 , wherein the identity provider is provided control over only a predetermined subset of all data elements and organizations.
19. The services provision system of claim 18 , wherein the access token is invalid if any access claim of the access token falls outside the predetermined subset of all data elements and organizations available to the identity provider.
20. The services provision system of claim 15 , wherein a validated access claim provides access to less than all data elements under control of the identity provider.