Granted Patent B2

US 12,375,485 · App. 18/317,657 · Granted Jul 29, 2025

Inventors: Christopher Marie (Denver, CO); Carl Eric Leach (Carlsbad, CA); Eric Olden (Niwot, CO); Warren Fernandes (Erie, CO)

Assignee: Strata Identity Inc.

H04L63/0876H04L63/102H04L63/108

Abstract

Claims (91)

1. A system configured for controlling user access to an application, the system comprising:

one or more hardware processors configured by machine-readable instructions to:

request to access the application, wherein the application is associated with an identity provider and a datastore;

route the request to an intermediary prior to receipt by the application, wherein,

the intermediary redirects the request to the identity provider for authentication, and

the authentication comprises:

receiving application identity information at the identity provider from the user; and

authenticating the user with the application based at least in part on the application identity information;

receive user authentication confirmation at the intermediary;

generate at the intermediary a temporary user credential associated with the application;

provide, from the intermediary to the application, the request to access the application with the temporary user credential;

capture, at the intermediary, a backchannel request from the application to the data store, wherein the backchannel request includes the temporary user credential;

confirm, at the intermediary, that the temporary user credential provided in the backchannel request matches the temporary user credential generated previously;

send confirmation from the intermediary to the application that the temporary user credential enables user access to the application; and

in response to the request to access the application from the user, send a communication from the application to the user granting the user access to the application.

2. The system of claim 1 , wherein requesting to access the application comprises a plurality of separate requests to access the application; and

wherein generating at the intermediary a temporary user credential comprises generating a temporary user credential for each of the plurality of separate requests to access the application.

3. The system of claim 1 , wherein the datastore comprises a legacy identity and access management system (IAM) datastore associated with the application, and wherein the datastore comprise one of a MySQL datastore and a lightweight data access protocol (LDAP) datastore.

4. A method for controlling user access to an application, comprising:

requesting to access the application, wherein the application is associated with an identity provider and a datastore;

routing the request to an intermediary prior to receipt by the application, wherein,

the intermediary redirects the request to the identity provider for authentication, and

the authentication comprises:

receiving application identity information at the identity provider from the user; and

authenticating the user with the application based at least in part on the application identity information;

receiving user authentication confirmation at the intermediary;

generating at the intermediary a temporary user credential associated with the application;

providing, from the intermediary to the application, the request to access the application with the temporary user credential;

capturing, at the intermediary, a backchannel request from the application to the datastore, wherein the backchannel request includes the temporary user credential;

confirming, at the intermediary, that the temporary user credential provided in the backchannel request matches the temporary user credential generated previously;

sending confirmation from the intermediary to the application that the temporary user credential enables user access to the application; and

in response to the request to access the application from the user, sending a communication from the application to the user, granting the user access to the application.

5. The method of claim 4 , wherein,

requesting to access the application comprises a plurality of separate requests to access the application; and

generating at the intermediary a temporary user credential comprises generating a temporary user credential for each of the plurality of separate requests to access the application.

6. The method of claim 4 , wherein the datastore comprises a legacy identity and access management system (IAM) datastore associated with the application.

7. The method of claim 4 , wherein the datastore comprise one of a MySQL datastore and a lightweight data access protocol (LDAP) datastore.

8. The method of claim 4 , further comprising:

sending the temporary user credential from the application to the datastore; and

wherein capturing the backchannel request comprises intercepting the sending by the intermediary.

9. The method of claim 4 , wherein sending confirmation from the intermediary to the application that the temporary user credential enables user access to the application comprises applying one or more authorization decisions to determine whether the user is authorized to access the application.

10. The method of claim 4 , wherein the datastore comprises a plurality of user data associated with the application, the method further comprising:

adding additional user data to the datastore.

11. The method of claim 10 , wherein,

the user data comprises at least one of a user identifier, a user first name, a user last name, and information related to an identifier number;

the user data comprises data for use:

with one of data customization and authorization decisions, and

across a target identity domain;

the datastore comprises a first datastore; and

adding additional user data to the datastore comprises providing additional user data from a second datastore to the first datastore.

12. The method of claim 11 , wherein,

the second datastore comprises a datastore which one of,

uses a standard identity protocol, and

leverages multi-factor authentication; and

the additional user data comprises at least one of,

a user first name,

a user last name,

a job title,

a physical address, and

an email address.

13. The method of claim 12 , wherein the standard identity protocol comprise at least one of:

OpenID Connect (OIDC);

Security Assertion Markup Language (SAML); and

Web Authentication (WebAuthn).

14. The method of claim 4 , wherein receiving application identity information at the identity provider from the user comprises adding the user and one or more user attributes to the datastore.

15. The method of claim 14 , further comprising:

removing the user and the one or more user attributes from the datastore upon one of:

user logout of the application; and

expiration of a user session with the application.

16. The method of claim 15 , wherein, before the intermediary redirects the request to the identity provider for authentication, the method comprises:

configuring the intermediary as an Application Gateway proxy for the identity provider.

17. A non-transient computer-readable storage medium having instructions embodied thereon, the instructions being executable by one or more processors to perform a method for controlling user access to an application, the method comprising:

requesting to access the application, wherein the application is associated with an identity provider and a datastore;

routing the request to an intermediary prior to receipt by the application, wherein,

the intermediary redirects the request to the identity provider for authentication; and

the authentication comprises:

receiving application identity information at the identity provider from the user; and

authenticating the user with the application based at least in part on the application identity information;

receiving user authentication confirmation at the intermediary;

generating at the intermediary a temporary user credential associated with the application;

providing, from the intermediary to the application, the request to access the application with the temporary user credential;

capturing, at the intermediary, a backchannel request from the application to a datastore, wherein the backchannel request includes the temporary user credential;

confirming, at the intermediary, that the temporary user credential provided in the backchannel request matches the temporary user credential generated previously;

sending confirmation from the intermediary to the application that the temporary user credential enables user access to the application; and

in response to the request to access the application from the user, sending a communication from the application to the user granting the user access to the application.

18. The non-transient computer-readable storage medium of claim 17 , wherein requesting to access the application comprises a plurality of separate requests to access the application; and

wherein generating at the intermediary a temporary user credential comprises generating a temporary user credential for each of the plurality of separate requests to access the application.

19. The non-transient computer-readable storage medium of claim 17 , wherein the method further comprises:

sending the temporary user credential from the application to the datastore; and

wherein capturing the backchannel request comprises intercepting the sending by the intermediary.

20. The non-transient computer-readable storage medium of claim 17 , wherein sending confirmation from the intermediary to the application that the temporary user credential enables user access to the application comprises applying one or more authorization decisions to determine whether the user is authorized to access the application.

Assignments (4)

Continuity (2)

References Cited (9)