Service provider access
A method and apparatus for enabling a user to access a service provider is described. The user sends a request from a browser to a proxy server. The proxy server modifies the request by adding data (such as a URL) relating to a location of an identity provider able to provide user credentials for the user and forwards the modified request to the service provider. The modification of the access request may occur before the request is sent to the service provider or in response to an authentication request from the service provider. The data relating to the location of the identity provider may be provided as a header (e.g. an http header).
1. A method comprising:
receiving, at a proxy server, a request from a user device for access to a service provider;
modifying, at the proxy server, the request by adding data identifying a location of an identity provider able to provide user credentials for a user of the user device; and
forwarding, from the proxy server, the modified request to the service provider,
wherein the modifying is performed by the proxy server, where the proxy server is different from the user device.
2. A method as claimed in claim 1 , wherein the modifying the request is performed in response to the request for access to the service provider.
3. A method as claimed in claim 1 , wherein the modifying the request is performed in response to the service provider indicating a lack of user authorization.
4. A method as claimed in claim 1 , wherein the data identifying the location of the identity provider added to the request are provided as a header.
5. A method as claimed in claim 1 , wherein the data identifying the location of the identity provider added to the request are provided as a uniform resource locator.
6. A method as claimed in claim 1 , wherein the data identifying the location of the identity provider are provided by the identity provider in response to a request.
7. A method as claimed claim 1 , further comprising:
setting a user identity in response to receiving the request from the user device for access to the service provider.
8. A method as claimed in claim 7 , wherein the user identity is determined based on settings provided by the user device.
9. The method as claimed in claim 1 , further comprising:
receiving at the proxy server a request for authentication in response to the modified request; and
providing user credentials in response to receiving the request for authentication.
10. The method as claimed in claim 1 , wherein the identity provider and the proxy server are co-located with each other.
11. An apparatus comprising:
a first input configured to receive a service access request from a user device; and
a first output configured to send a modified service access request to a service provider,
wherein the apparatus is configured to generate said modified service access request by adding data identifying a location of an identity provider able to provide user credentials for a user of the user device to the service access request received from said user device,
wherein the apparatus is different from the user device, and
wherein said apparatus is a proxy server.
12. An apparatus as claimed in claim 11 , wherein the apparatus is configured to add said data identifying the location of the identity provider on receipt of the service access request from said user device.
13. An apparatus as claimed in claim 11 , further comprising a second input configured to receive signals from said service provider, wherein the apparatus is configured to add said data identifying the location of the identity provider in response to the service provider requesting user authorization.
14. An apparatus as claimed in claim 11 , wherein the data identifying the location of the identity provider is provided as a header.
15. An apparatus as claimed in claim 11 , further comprising the identity provider.
16. A system comprising a service provider and a proxy server, wherein:
the proxy server is configured to receive a service access request from a user device;
the proxy server is configured to modify the request by adding data identifying a location of an identity provider able to provide user credentials for a user of the user device and to send the modified service access request to the service provider;
the service provider is configured to redirect the user device to the identity provider for the purposes of user authentication,
wherein the proxy server is different from the user device.
17. A non-transitory computer-readable medium encoding a computer program product comprising:
an input configured to receive, at a proxy server, a service access request from a user device; and
an output configured to send, from the proxy server, a modified service access request to a service provider,
wherein the computer program product is configured to add data identifying a location of an identity provider able to provide user credentials for a user of the user device to the service access request received from said user device, and
wherein said modified service access request is performed by said proxy server, where said proxy server is different from said user device.