Authenticating and authorizing api calls with multiple factors
View Patent ↗A method for authenticating and authorizing a user identifier to access a service is disclosed. The service is activated by a service application programming interface which requires a two-factor authorization to initiate execution of the service for the requesting user identifier. The method receives, by the service API, a service request together with first and second data for a first and a second authentication method, confirming a correctness of the first data as a first identity pass key using the first authentication method, confirming a correctness of the second data as a second identity pass key using the second authentication method and the first identity pass key is input to the second authentication method, and the second authentication method differs from the first authentication method. Having received the confirmed correctness of both the first identity pass key and the second identity pass key, executing the service.
1. A computer-implemented method for authenticating and authorizing a user identifier to access a service secured by an identity access management system, wherein said service is activated through a service application programming interface that requires a two-factor authorization to initiate execution of said service for said requesting user identifier, wherein said method comprises:
generating, by an identity access management system, a client certificate, wherein said client certificate corresponds to a client device, and wherein said client certificate constitutes first data;
receiving, by one or more processors, a service request together with said first data for a first authentication method and second data for a second authentication method, wherein said service request connects with an application programming interface of said service;
confirming, by the one or more processors, a correctness of said first data as a first identity pass key using said first authentication method;
generating, by the identity access management system, upon confirming the correctness of said first data, an application programming interface key, wherein said application programming interface key constitutes said second data;
confirming, by the one or more processors, a correctness of said second data as a second identity pass key using said second authentication method, wherein a confirmed first identity pass key is included as input to said second authentication method, and wherein said second authentication method differs from said first authentication method; and
executing, by the one or more processors, said service, in response to receipt of said confirmed correctness of both said first identity pass key and said second identity pass key wherein based on a first policy of the first identity pass key and a second policy of the second identity pass key of the identity access management system said first identity pass key and said second identity pass key authorize a first action based on the first policy and a second action based on the second policy of said service.
2. The method according to claim 1 , wherein said first authentication method and said second authentication method are selected from a group consisting of a client security certificate, a security token, and an application programming interface key, and wherein said first authentication method is different from said second authentication method.
3. The method according to claim 1 , wherein said first authentication method uses a mutual transport layer security (mTLS) standard.
4. The method according to claim 1 , wherein confirmation of said correctness of said first data and said second data is performed by an identity access management system.
5. The method according to claim 1 , wherein confirmation of said correctness of said first data and confirmation of said correctness of said second data is performed by a selection from a group consisting of said requested service and a separate service in communicative contact with said requested service.
6. The method according to claim 1 , wherein said requested service is executed in a cloud computing environment.
7. The method according to claim 1 , wherein a client security certificate originates from an identity access management system and serves as an identity pass key.
8. The method according to claim 7 , wherein said client security certificate is user generated.
9. The method according to claim 1 , wherein said requested service is a combined service, and wherein a security service is integrated into said combined service and comprises an mTLS endpoint of said first authorization method.
10. The method according to claim 9 , wherein said security service further comprises an inner security service for an authentication using a selection from a group consisting of a token and an application programming interface key.
11. An authentication and authorization system for authenticating and authorizing a user identifier to access a service secured by an identity access management system, wherein said service is being activated through a service application programming interface, which requires a two-factor authorization to initiate execution of said service for said requesting user identifier, the system comprising:
one or more computer processors;
one or more computer-readable storage media, communicatively coupled to said one or more processors, wherein said one or more computer readable storage media stores program code portions that, when executed, enable said one or more processors to:
generate, by an identity access management system, a client certificate, wherein said client certificate corresponds to a client device, and wherein said client certificate constitutes first data;
receive a service request together with said first data for a first authentication method and second data for a second authentication method, wherein said service request connects with an application programming interface of said service;
confirm a correctness of the first data as a first identity pass key using said first authentication method;
generate, by the identity access management system, upon confirming the correctness of said first data, an application programming interface key, wherein said application programming interface key constitutes said second data;
confirm a correctness of said second data as a second identity pass key using said second authentication method, wherein a confirmed first identity pass key is included as input to said second authentication method, and wherein said second authentication method differs from said first authentication method; and
execute said service in response to receipt of said confirmed correctness of both said first identity pass key and said second identity pass key wherein based on a first policy of the first identity pass key and a second policy of the second identity pass key of the identity access management system said first identity pass key and said second identity pass key authorize a first action based on the first policy and a second action based on the second policy of said service.
12. The system according to claim 11 , wherein said first authentication method and said second authentication method are selected from a group consisting of a client security certificate, a security token, and an application programming interface key, and wherein said first authentication method is different from said second authentication method.
13. The system according to claim 11 , wherein said first authentication method uses a mutual transport layer security (mTLS) standard.
14. The system according to claim 11 , wherein confirming the correctness of the first data and the second data is performed by the identity access management system.
15. The system according to claim 11 , wherein confirmation of said correctness of said first data and said second data is performed by a selection from a group consisting of said requested service and a separate service in communicative contact with said requested service.
16. The system according to claim 11 , wherein a client security certificate originates from an identity access management system and serves as an identity pass key.
17. The system according to claim 16 , wherein said client security certificate is user generated.
18. The system according to claim 11 , wherein said requested service is a combined service, and wherein a security service is integrated into said combined service and comprises an mTLS endpoint of said first authorization method.
19. The system according to claim 18 , wherein said security service also comprises an inner security service for an authentication via a token or an application programming interface key.
20. A computer program product for authenticating and authorizing a user identifier to access a service, wherein said service is being secured by an identity access management system, and wherein said service is activated by a service application programming interface, which requires a two-factor authorization to initiate execution of said service for the requesting user identifier, said computer program product comprising:
a computer readable storage medium having program instructions embodied therewith, the program instructions being executable by one or more computer processors to cause the one or more computer processors to:
generate, by an identity access management system, a client certificate, wherein said client certificate corresponds to a client device, and wherein said client certificate constitutes first data;
receive a service request together with said first data for a first authentication method and second data for a second authentication method, wherein said service request connects with an application programming interface of said service;
confirm a correctness of said first data as a first identity pass key using said first authentication method;
generate, by the identity access management system, upon confirming the correctness of said first data, an application programming interface key, wherein said application programming interface key constitutes said second data;
confirm a correctness of said second data as a second identity pass key using said second authentication method, wherein a confirmed first identity pass key is included as input to said second authentication method, and wherein said second authentication method differs from said first authentication method; and
execute said service in response to receipt of said confirmed correctness of both said first identity pass key and said second identity pass key wherein based on a first policy of the first identity pass key and a second policy of the second identity pass key of the identity access management system said first identity pass key and said second identity pass key authorize a first action based on the first policy and a second action based on the second policy of said service.