Distributed network identity
A distributed network identity is provided. An identity provider stores a portion of a user's personal information. A service provider accesses user information from one or more identity providers. System entities such as identity providers and service providers can be linked to enable information sharing and aggregation. User policies and privacy preferences are provided to control how information is shared. A single sign-on architecture is provided where an identity provider is used to facilitate cross-domain authentication and to enhance user convenience. Service delegation features are also provided.
1. A method for providing user authentication to a service provider, the method comprising:
an identity provider receiving an identifier from the service provider, wherein the identifier indicates the service provider, and wherein the identifier includes an assertion conveying information about a previous act of authentication performed on an identity of a user; and
in response to said receiving:
the identity provider requesting an identity credential from the user;
the identity provider authenticating the identity credential to produce an authenticated credential; and
the identity provider passing the authenticated credential to the service provider.
2. The method of claim 1 , further comprising:
the identity provider providing user profile data associated with the user to the service provider.
3. The method of claim 1 , wherein at least one of the receiving, requesting, authenticating, and passing is performed using web services.
4. The method of claim 1 , wherein the identity credential comprises a username and a password.
5. The method of claim 1 , wherein the identity credential comprises a certificate.
6. The method of claim 1 , wherein the authenticated credential comprises a transient token.
7. The method of claim 1 , further comprising:
the identity provider passing an identity provider preference to a common domain, wherein the identity provider preference facilitates selection of the identity provider by the service provider for subsequent authentication of the user.
8. A method for delegating a requested service, the method comprising:
an identity provider authenticating a user;
a first service provider receiving a request for a service from the user;
the first service provider requesting a ticket from the identity provider for the service requested by the user, wherein the requested service is to be performed by a second service provider;
the first service provider receiving the ticket from the identity provider, the ticket authorizing the second service provider to perform the requested service on behalf of the user;
the first service provider presenting the ticket at the second service provider; and
the second service provider performing the requested service on behalf of the user.
9. The method of claim 8 , wherein the ticket comprises a transient token.
10. The method of claim 8 , wherein the ticket is encrypted with a key corresponding to the first service provider.
11. The method of claim 8 , wherein the requested service is a payment service.
12. A non-transitory, computer-readable storage medium, comprising program instructions that when executed on one or more computers cause the one or more computers to perform:
an identity provider receiving an identifier from a service provider, wherein the identifier indicates the service provider, and wherein the identifier includes an assertion conveying information about a previous act of authentication performed on an identity of a user; and
in response to said receiving:
the identity provider requesting an identity credential from the user;
the identity provider authenticating the identity credential to produce an authenticated credential; and
the identity provider passing the authenticated credential to the service provider.
13. The non-transitory, computer-readable storage medium of claim 12 , wherein when executed on the one or more computers, the program instructions further cause the one or more computers to perform:
the identity provider providing user profile data associated with the user to the service provider.
14. The non-transitory, computer-readable storage medium of claim 12 , wherein at least one of the receiving, requesting, authenticating, and passing is performed using web services.
15. The non-transitory, computer-readable storage medium of claim 12 , wherein the identity credential comprises a username and a password.
16. The non-transitory, computer-readable storage medium of claim 12 , wherein the identity credential comprises a certificate.
17. The non-transitory, computer-readable storage medium of claim 12 , wherein the authenticated credential comprises a transient token.
18. The non-transitory, computer-readable storage medium of claim 12 , wherein when executed on the one or more computers, the program instructions further cause the one or more computers to perform:
the identity provider passing an identity provider preference to a common domain, wherein the identity provider preference facilitates selection of the identity provider by the service provider for subsequent authentication of the user.