Single sign-on (SSO) multi-identity provider (IDP) engine
A unified platform may comprise a combination of independent frameworks that have been integrated and configured to collaboratively operate seamlessly. In some aspects, the unified platform may comprise one or more of an authentication and authorization framework, a dynamic user interface framework, a workflow state management framework, a notification and active data loss and prevention (DLP) engine framework, and an orchestration engine framework. Each of the frameworks included in the unified platform may comprise one or more of the plurality of computing devices executing computer-readable program instructions.
1. An authentication and authorization framework comprising:
one or more among a plurality of computing devices that define a single sign-on (SSO) multi identity-provider (IdP) engine (“SSO multi-IdP engine”), the SSO multi-Idp engine comprising an authorization token class server and one or more processors executing computer-readable instructions that cause the SSO multi-IdP engine to:
receive, from a user device, access credentials for proceeding through one or more workflow journeys;
determine at least one of a protocol, standard and format associated with the access credentials;
determine an authentication of the access credentials based on authentication policy rules stored in one or more memory devices of the authentication and authorization framework;
generate, by the authorization token class server and based on the access credentials, an authorization indication that includes at least one of an access token and an authorization token;
build an authentication response that includes the authorization indication, according to the determined at least one of the protocol, standard and format based on the authentication policy rules;
transmit the authentication response to the user device;
receive, from each of one or more resources associated with the one or more workflow journeys, one or more authentication and authorization requests; and
build a response to each of the one or more authentication and authorization requests based on the at least one of the access token and the authorization token included in the authorization indication,
wherein the authorization token class server is further configured to determine an authorization level associated with the access credentials and include the authorization level in the authorization indication.
2. The authentication and authorization framework of claim 1 , wherein the SSO multi-IdP engine comprises a resource server and an authentication server from among the one or more computing devices, the resource server configured to:
receive the access credentials from the user device, determine the at least one of the protocol, standard and format associated with the access credentials, and build the authentication response; and
the authentication server configured to determine the authentication of the access credentials.
3. The authentication and authorization framework of claim 2 , wherein the authorization token class server is further configured to:
provide the authorization indication to the resource server for inclusion in the authentication response.
4. The authentication and authorization framework of claim 3 , wherein the one or more workflow journeys involves access to one or more resources, the resource server being further configured to:
receive, from each of the one or more resources, the one or more authentication and authorization requests;
parse the one or more authentication and authorization requests to identify and extract information indicative of a respective protocol and a respective data format associated with each of the one or more authentication and authorization requests; and
build the resource response to each of the one or more authentication and authorization requests according to its respective protocol and in its respective data format.
5. The authentication and authorization framework of claim 4 , wherein the one or more resources comprise one or more of software applications, systems, networks, routes, services, micro-services, and application program interfaces (APIs).
6. The authentication and authorization framework of claim 4 , wherein the respective protocol comprises at least one of OAuth1.0 and OAuth2.0, and wherein the respective data format comprises at least one of a security assertion markup language (SAML) token and a Javascript™ object notation (JSON) web token (JWT).
7. The authentication and authorization framework of claim 4 , wherein the resource server is further configured to build the resource response by executing instructions that cause it to:
retrieve the access credentials from the authentication server, the access credentials comprising at least one of an identity token and an assertion;
initiate the authorization token class server by providing the at least one of the identity token and assertion to the authorization token class server;
receive the authorization indication from the authorization token class server; and
build the resource response based on the one or more of the access token and the authorization token.
8. The authentication and authorization framework of claim 7 , wherein the authorization token class server comprises:
a generation module configured to generate the one or more of the access token and the authorization token according to the authorization level using one or more hashing algorithms;
an expiration module configured to impose time limits on how long the one or more of the access token and the authorization token remains active; and
a refresh module configured to regenerate or reactive the one or more of the access token and the authorization token, upon expiration according to the time limits imposed by the expiration module, at any point during the one or more workflow journeys.
9. The authentication and authorization framework of claim 8 , wherein the authorization token class server comprises a signature module configured to generate and provide token signatures to the resource server; and wherein the resource server further comprises a validator class engine configured to validate the token signatures and token expirations.
10. The authentication and authorization framework of claim 9 , wherein the token signatures comprise one or more of grant types, roles, public keys and private keys.
11. The authentication and authorization framework of claim 2 , wherein the authentication server further comprises an authentication policy rules orchestration and authorization module storing the authentication policy rules, authentication credentials and associated authorization levels in the one or more memory devices,
the authentication server being further configured to:
receive the access credentials from resource server;
interrogate the authentication policy rules orchestration and authorization module using the received access credentials; and
return at least one of an authentication token and an authentication assertion.
12. The authentication and authorization framework of claim 11 , wherein the access to the one or more resources is based on two or more different sets of access credentials,
wherein the resource server is further configured to build resource responses for each of the one or more resources based on a single set of access credentials received from the user device, and
wherein the authentication server is further configured to associate the single set of access credentials with the two or more different sets of access credentials among the authentication credentials stored in the one or more memory devices, and return the at least one of the authentication token and authentication assertion based on each of the two or more different sets of access credentials for inclusion in the resource responses.
13. The authentication and authorization framework of claim 1 , wherein the one or more workflow journeys comprises progressing through at least two workflow journeys simultaneously.
14. The authentication and authorization framework of claim 4 , wherein the one or more resources are embodied across multiple networked systems.
15. The authentication and authorization framework of claim 1 , wherein the access credentials are linked to multiple users, such that authentication and authorization of the access credentials grants access to the multiple users for proceeding through the one or more workflow journeys simultaneously.
16. The authentication and authorization framework of claim 4 , wherein the one or more authentication and authorization requests are configured according to at least two different protocols.
17. The authentication and authorization framework of claim 1 , wherein the SSO multi-IdP engine is configured to operate in a polyglot micro-services architecture.
18. The authentication and authorization framework of claim 1 , wherein the one or more workflow journeys are each associated with a respective electronic lending product, the one or more workflow journeys being accessible through a lending as a service (LaaS) software application in communication with the SSO multi-IdP engine.
19. The authentication and authorization framework of claim 4 , wherein the SSO multi-IdP engine is configured to impose mutual authentication with each of the one or more resources before providing a respective resource response.
20. The authentication and authorization framework of claim 1 , wherein the access credentials comprise one or more of a username and password, biometric data and an authentication factor.