Method of authentication processing during a single sign on transaction via a content transform proxy service
The Content Transform Proxy (CTP) service is an advanced Web proxy service, the basic function of which is to modify incoming HTTP requests having a server-side destination and/or outgoing HTTP responses. The CTP service is implemented by the CTP program, which resides on a host in a data communications network between an end user (the Web client) and a content server that the client is attempting to access. The HTTP request and/or an HTTP response is modified by making an HTTP request on the client side using a client web browser, processing the HTTP request on the server side using outgoing proxy rules, passing on the processed HTTP transaction to the server-side destination, returning the results of the processed HTTP request from the server-side destination, processing the HTTP response on the server side using incoming proxy rules, and returning the processed HTTP response to the client web browser on the client side.
1. A method of authentication processing during a Single Sign On transaction when any aspect of at least one of a transaction processing request, content processing, and output processing is accessed via a Web connection, and an authentication is required as part of a Web application, the method comprising the steps of:
receiving a request from a user for content from the Web application, wherein the Web application is proxied through a content transform proxy service implemented by a content transform proxy program;
using the Web application to match a set of definitions in the content transform proxy program;
creating a content transform proxy process for the content request;
determining whether the content request matches a specific Web application single sign on definition;
if the content request matches the specific Web application single sign on definition, continuing the authentication processing;
using the content transform proxy process to request an AuthToken for the Web application from a login proxy service;
obtaining the AuthToken using the login proxy service;
reading in pre-determined Resolver definitions;
after reading in the resolver definitions, using the resolver to determine specific authentication definitions that are required for the Web application;
using the resolver to check a database to determine whether, for the Web application, authentication credentials are stored for the user;
if the authentication credentials are stored for the user, using the resolver to re-submit the authentication credentials from the database;
if the authentication credentials are not stored for the user, using the resolver to query the user for input for the authentication credentials;
upon successful authentication, using the resolver to store the AuthToken in the database; and
using the database to return the AuthToken to the login proxy service used in the request to the proxied Web application.
2. The method of claim 1 , wherein the step of obtaining an AuthToken comprises the further steps of:
using the login proxy service to check with an Authentication Service to determine if, for the Web application, there is already an AuthToken created for this particular user;
if the AuthToken has already been created, then returning the AuthToken;
if the AuthToken has not already been created, then running a new resolver; and
using the new Resolver to obtain initial authentication from an external service.