Token caching in trust chain processing
A method, system, and computer usable program product for token caching in a trust chain processing are provided in the illustrative embodiments. An information in a token associated with a first request is mapped. A determination is made whether a requester of the first request has provided a constraint in the first request, the constraint concerning the token, the constraint forming a client constraint. The client constraint is stored. The information and the mapped information is stored, forming stored information. The token is received in a second request. The stored information is reused if the client constraint allows reusing the stored information. A further determination may be made whether a target system receiving the mapped information has provided a server constraint, the second constraint concerning the mapped information, the second constraint forming a server constraint. The stored information may be reused if the server constraint allows reusing the stored information.
1. A computer implemented method for token caching in a trust chain processing, the computer implemented method comprising:
mapping an information, which is present in a token received in a first request, forming mapped information, wherein the token comprises a system-specific data construct other than a username and password pair;
determining whether a requestor of the first request has provided a constraint in the first request, the constraint concerning the token, the constraint forming a client constraint;
storing the client constraint;
storing the information and the mapped information, forming stored information;
receiving the token in a second request;
determining whether a target system receiving the mapped information has provided a second constraint, the second constraint concerning the mapped information, the second constraint forming a server constraint; and
reusing the stored information when the client constraint and the server constraint both allow reusing the stored information.
2. The computer implemented method of claim 1 , wherein the client constraint includes one of (i) a time of expiry of the token, (ii) a duration of validity of the token, (iii) a number of reuse permitted of the token, and (iv) an indication whether a target system can receive the client constraint.
3. The computer implemented method of claim 1 , wherein the server constraint includes one of (i) a time of expiry of the mapped information, (ii) a duration of validity of the mapped information, (iii) a number of reuse permitted of the mapped information.
4. The computer implemented method of claim 1 , further comprising:
resolving a conflict between the client constraint and the server constraint with respect to the token and the mapped information resulting from the token.
5. The computer implemented method of claim 1 , wherein the requestor controls the reuse of the information in the token by a trust service.
6. The computer implemented method of claim 1 , wherein the token is an incoming SAML token, the information is authentication information, the mapping is a part of a trust chain processing, and the mapped information is an issued outgoing token.
7. A computer usable program product comprising a computer usable storage device including computer usable code for token caching in a trust chain processing, the computer usable code comprising:
computer usable code for mapping an information, which is present in a token received in a first request, forming mapped information;
computer usable code for determining whether a requestor of the first request has provided a constraint in the first request, the constraint concerning the token, the constraint forming a client constraint;
computer usable code for storing the client constraint;
computer usable code for storing the information and the mapped information, forming stored information;
computer usable code for receiving the token in a second request;
computer usable code for determining whether a target system receiving the mapped information has provided a second constraint, the second constraint concerning the mapped information, the second constraint forming a server constraint; and
computer usable code for reusing the stored information when the client constraint and the server constraint both allow reusing the stored information.
8. The computer usable program product of claim 7 , wherein the client constraint includes one of (i) a time of expiry of the token, (ii) a duration of validity of the token, (iii) a number of reuse permitted of the token, and (iv) an indication whether a target system can receive the client constraint.
9. The computer usable program product of claim 7 , wherein the server constraint includes one of (i) a time of expiry of the mapped information, (ii) a duration of validity of the mapped information, (iii) a number of reuse permitted of the mapped information.
10. The computer usable program product of claim 7 , wherein the requestor controls the reuse of the information in the token by a trust service.
11. The computer usable program product of claim 7 , wherein the token is an incoming SAML token, the information is authentication information, the mapping is a part of a trust chain processing, and the mapped information is an issued outgoing token.
12. The computer program product of claim 7 , wherein the computer usable code is stored in a computer readable storage medium in a data processing system, and wherein the computer usable code is transferred over a network from a remote data processing system.
13. The computer program product of claim 7 , wherein the computer usable code is stored in a computer readable storage medium in a server data processing system, and wherein the computer usable code is downloaded over a network to a remote data processing system for use in a computer readable storage medium associated with the remote data processing system.
14. A data processing system for token caching in a trust chain processing, the data processing system comprising:
a storage device including a storage medium, wherein the storage device stores computer usable program code; and
a processor, wherein the processor executes the computer usable program code, and wherein the computer usable program code comprises:
computer usable code for mapping an information, which is present in a token received in a first request, forming mapped information;
computer usable code for determining whether a requestor of the first request has provided a constraint in the first request, the constraint concerning the token, the constraint forming a client constraint;
computer usable code for storing the client constraint;
computer usable code for storing the information and the mapped information, forming stored information;
computer usable code for receiving the token in a second request;
computer usable code for determining whether a target system receiving the mapped information has provided a second constraint, the second constraint concerning the mapped information, the second constraint forming a server constraint; and
computer usable code for reusing the stored information when the client constraint and the server constraint both allow reusing the stored information.
15. The data processing system of claim 14 , wherein the client constraint includes one of (i) a time of expiry of the token, (ii) a duration of validity of the token, (iii) a number of reuse permitted of the token, and (iv) an indication whether a target system can receive the client constraint.
16. The data processing system of claim 14 , further comprising:
computer usable code for resolving a conflict between the client constraint and the server constraint with respect to the token and the mapped information resulting from the token.
17. The data processing system of claim 16 , wherein the server constraint includes one of (i) a time of expiry of the mapped information, (ii) a duration of validity of the mapped information, (iii) a number of reuse permitted of the mapped information.
18. The data processing system of claim 14 , wherein the requestor controls the reuse of the information in the token by a trust service.
19. The data processing system of claim 14 , wherein the token is an incoming SAML token, the information is authentication information, the mapping is a part of a trust chain processing, and the mapped information is an issued outgoing token.