Client certificates to communicate trusted information
A device comprises: a receiver configured to receive a client certificate; a processor coupled to the receiver and configured to: authenticate the client certificate, extract, in response to the authentication, attributes from the client certificate, and create, in response to the extraction, a message comprising reformatted attributes based on the attributes, wherein the reformatted attributes can be trusted; and a transmitter coupled to the processor and configured to transmit the message. A device comprises: a processor configured to: process a client certificate comprising a certificate identifier (ID) attribute, a tenant ID attribute, and a role ID attribute, and package the client certificate in a request for a shared service; and a transmitter coupled to the processor and configured to transmit the request.
1. A device comprising a processor implemented on one or more computer chips configured to:
authenticate a client certificate, wherein the client certificate is signed by a private certificate authority associated with the device,
extract, in response to the authentication, attributes from the client certificate, and
create, in response to the extraction, a message comprising reformatted attributes based on the attributes, wherein the reformatted attributes comprise a certificate identifier (ID) attribute, a tenant ID attribute, and a role ID attribute, wherein the certificate ID attribute identifies the client and uniquely identifies the client certificate, wherein the tenant ID attribute is associated with partner data and specifies which partner data is client accessible, wherein the role ID attribute helps to implement role-based access control, and wherein the reformatted attributes can be trusted.
2. The device of claim 1 , wherein the device is a gateway server and wherein the gateway server is configured to receive the client certificate from a client.
3. The device of claim 1 , wherein the reformatted attributes can be trusted because of the authentication.
4. The device of claim 1 , wherein the reformatted attributes can be trusted because the processor created the message comprising the reformatted attributes.
5. The device of claim 1 , wherein the reformatted attributes are included in Hypertext Transfer Protocol (HTTP) or HTTP Secure (HTTPS) headers.
6. The device of claim 1 , wherein the message is in an Extensible Markup Language (XML) or JavaScript Object Notation (JSON) format.
7. A device comprising a processor implemented on one or more computer chips configured to:
process a client certificate's attributes to produce reformatted attributes comprising a certificate identifier (ID) attribute, a tenant ID attribute, and a role ID attribute, and include the client certificate in a request for a shared service, wherein the certificate identifier (ID) attribute identifies a client and uniquely identifies the device, wherein the device is the client, wherein the tenant ID attribute specifies which partner data is device accessible, and wherein the role ID attribute helps to implement role-based access control.
8. The device of claim 7 , wherein the certificate identifier (ID) attribute, the tenant ID attribute, and the role ID attribute are globally unique identifiers (GUIDs) that are unique and cannot be forged.
9. The device of claim 7 , wherein the client certificate is signed by a private certificate authority associated with a gateway server.
10. The device of claim 7 , wherein the request is in an Extensible Markup Language (XML) or JavaScript Object Notation (JSON) format.
11. A method comprising:
authenticating a client certificate based on a signature in the client certificate;
authorizing, in response to the authenticating, access to a shareable service;
extracting, in response to the authenticating, attributes from the client certificate; and
creating, in response to the extracting, a message comprising reformatted attributes based on the attributes, wherein the reformatted attributes comprise a certificate identifier (ID) attribute, a tenant identifier attribute, and a role ID attribute, wherein the reformatted attributes can be trusted based on the authentication and wherein the reformatted attributes are globally unique identifiers (GUIDs) that are unique and cannot be forged, and wherein the certificate ID attribute uniquely identifies the device, the tenant ID attribute specifies which partner data is device accessible, and the role ID attribute specifies a role of the device.
12. The method of claim 11 , further comprising transmitting the message.
13. The method of claim 12 , further comprising receiving, in response to the transmitting, a resource associated with the shareable service.