Authentication mechanism for domain redirection of a representational state transfer (REST)-compliant client
View Patent ↗An initial server responds to a request with a redirection object describing the a different server to which the request should be redirected, and providing additional information about authenticating to the other server. The redirection object includes a session check variable indicating whether a forms-based authentication process may need to be performed, a session URI through which the client may determine whether the client was previously authenticated to the other server, and optionally a forms URI through which the client may initiate a forms-based authentication process. If the session check variable indicates that the other server may require forms based authentication, and an authenticated session does not exist between the client and the other server, and the client has a forms URI for the other server, then the client opens a Web browser, and directs the Web browser to the forms URI to complete a forms-based authentication process.
1. A method of domain redirection, comprising:
receiving, at a first server system in a first authentication domain, an original request having a method and a body, the original request transmitted to the first server system in a message from a client program executing on a client system;
parsing, by the first server system, the received original request, wherein the parsing identifies at least one portion of the original request that requires resources from a second authentication domain, the second authentication domain separate from the first authentication domain;
generating, by the first server system in response to the parsing identifying the portion of the original request that requires resources from the second authentication domain, in a memory of the first server system, a redirection object, wherein the generating includes storing an identifier of a second server system in the redirection object, the second server system located in the second authentication domain, and storing a session check flag in the redirection object, the session check flag indicating whether the client system may be required to perform forms-based authentication prior to re-submitting the original request to the second server system; and
transmitting a response containing the redirection object from the first server system to the client system.
2. The method of claim 1 , further comprising:
wherein generating the redirection object by the first server system includes storing a first value in the session check flag, the first value indicating that the client system may be required to perform forms-based authentication prior to resubmitting the original request to the second server system;
receiving, by the client system, the response containing the redirection object;
extracting, by the client program, the session check flag from the redirection object;
opening, on the client system by the client program, in response to finding the first value in the session check flag of the redirection object, a Web browser program; and
directing, by the client program, the Web browser to perform a forms-based authentication process with regard to the second server system; and
receiving, by the client program, a code indicating that the forms-based authentication process is complete; and
re-submitting, by the client program in response to receiving the code indicating that the forms-based authentication process is complete, the original request to the second server system.
3. The method of claim 2 , further comprising:
wherein generating the redirection object by the first server system further includes storing a session check resource identifier in the redirection object;
extracting, by the client program, the session check resource identifier from the redirection object;
checking, by the client program, whether an authenticated session currently exists between the client system and the second authentication server, by transmitting a session check request message using the session check resource identifier from the redirection object;
receiving, by the client program, in response to the session check request message, an authentication challenge response; and
wherein the client program opens the Web browser on the client system only in the event that both the following conditions are met
i) the session check flag of the redirection object stores the first value, and
ii) the client program receives an authentication challenge in response to the session check request message.
4. The method of claim 2 , further comprising:
wherein generating the redirection object by the first server system further includes storing a session check resource identifier in the redirection object;
extracting, by the client program, the session check resource identifier from the redirection object;
checking, by the client program, whether an authenticated session currently exists between the client system and the second authentication server, by transmitting a session check request message using the session check resource identifier from the redirection object;
receiving, by the client program, in response to the session check request message, an authentication challenge response;
determining, by the client program, whether the redirection object includes a forms resource identifier indicating a location to which requests for forms-based authentication are to be directed prior to re-submitting the original request to the second server system; and
wherein the client program opens the Web browser on the client system only in the event that the following three conditions are all met
i) the session check flag of the redirection object stores the first value,
ii) the client program receives an authentication challenge in response to the session check request message, and
iii) the redirection object includes a forms resource identifier indicating a location to which requests for forms-based authentication are to be directed prior to re-submitting the original request to the second server system.
5. The method of claim 3 , further comprising:
wherein generating the redirection object by the first server system further includes storing a forms resource identifier in the redirection object;
extracting, by the client program, the forms resource identifier from the redirection object; and
wherein directing the Web browser to perform the forms-based authentication process with regard to the second server includes the client program navigating the Web browser using the forms resource identifier from the redirection object.
6. The method of claim 3 , further comprising:
wherein generating the redirection object by the first server system further includes storing a token resource identifier in the redirection object;
extracting, by the client program, the token resource identifier from the redirection object; and
obtaining, by the client program prior to re-submitting the original request to the second server system, an authentication cookie representing an authentication session established with regard to the second server through the forms-based authentication process, by transmitting a token request message including the token resource identifier from the redirection object.
7. The method of claim 2 , further comprising:
wherein generating the redirection object by the first server system includes extracting a request method from the original request and storing the request method from the original request into a request method component of the redirection object, and extracting a request body from the original request and storing the request body from the original request into a request body component of the redirection object;
extracting, by the client program, the identifier of the second server, the request method component, and the request body component from the redirection object; and
wherein resubmitting the original request includes generating and transmitting a request message containing the identifier of the second server system from the redirection object, the request method component from the redirection object, and the request body component from the redirection object.
8. The method of claim 5 , further comprising:
maintaining, by the first server system, a directory of entries, each entry corresponding to one of a plurality of authentication domains, wherein each entry includes, with regard to the corresponding one of the authentication domains
i) a location of a server to which requests for resources located in the corresponding authentication domain are to be directed,
ii) an indication of whether forms-based authentication may be required to access resources in the corresponding authentication domain,
iii) a location to which requests to determine whether an authenticated session currently exists with the corresponding authentication domain are to be directed, and
iv) a location to which requests for forms-based authentication in the corresponding authentication domain are to be directed; and
wherein generating the redirection object by the first server system is responsive to an entry in the directory corresponding to the second authentication domain.
9. A system for domain redirection, comprising:
a first server system in a first authentication domain, comprising processing circuitry, and memory coupled to the processing circuitry, the memory storing instructions which, when carried out by the processing circuitry, cause the first server system to:
receive an original request having a method and a body, the original request transmitted to the first server system in a message from a client program executing on a client system,
parse the received original request, at least in part by identifying at least one portion of the original request that requires resources from a second authentication domain, the second authentication domain separate from the first authentication domain,
generate, in response to identifying the portion of the original request that requires resources from the second authentication domain, in a memory of the first server system, a redirection object, at least in part by storing an identifier of a second server system in the redirection object, the second server system located in the second authentication domain, and storing a session check flag in the redirection object, the session check flag indicating whether the client system may be required to perform forms-based authentication prior to re-submitting the original request to the second server system, and
transmit a response containing the redirection object from the first server system to the client system.
10. The system of claim 9 , further comprising:
wherein the instructions stored in the first server system memory, when carried out by the first server system processing circuitry, cause the first server system to generate the redirection object by further storing a first value in the session check flag, the first value indicating that the client system may be required to perform forms-based authentication prior to resubmitting the original request to the second server system;
wherein the client system comprises processing circuitry and memory coupled to the processing circuitry, the memory storing instructions of the client program which, when carried out by the processing circuitry, cause the client system to
receive the message containing the redirection object from the first server system,
extract the session check flag from the redirection object,
open, on the client system, in response to finding the first value in the session check flag of the redirection object, a Web browser program,
direct the Web browser to perform a forms-based authentication process with regard to the second server system,
receive a code indicating that the forms-based authentication process is complete, and
resubmit, in response to receiving the code indicating that the forms-based authentication process is complete, the original request to the second server system.
11. The system of claim 10 , further comprising:
wherein the instructions stored in the server system memory, when carried out by the server system processing circuitry, further cause the server system to generate the redirection object at least in part by storing a session check resource identifier in the redirection object; and
wherein the client program instructions stored in the client system memory, when carried out by the client system processing circuitry, further cause the client system to
extract the session check resource identifier from the redirection object,
check whether an authenticated session currently exists between the client system and the second authentication server by transmitting a session check request message using the session check resource identifier from the redirection object,
receive, in response to the session check request message, an authentication challenge response, and
open the Web browser on the client system only in the event that both the following conditions are met
i) the session check flag of the redirection object stores the first value, and
ii) the client program receives an authentication challenge in response to the session check request message.
12. The system of claim 10 , further comprising:
wherein the instructions stored in the server system memory, when carried out by the server system processing circuitry, further cause the server system to generate the redirection object at least in part by storing a session check resource identifier in the redirection object; and
wherein the client program instructions stored in the client system memory, when carried out by the client system processing circuitry, further cause the client system to
extract the session check resource identifier from the redirection object,
check whether an authenticated session currently exists between the client system and the second authentication server by transmitting a session check request message using the session check resource identifier from the redirection object,
receive, in response to the session check request message, an authentication challenge response,
determine whether the redirection object includes a forms resource identifier indicating a location to which requests for forms-based authentication are to be directed prior to re-submitting the original request to the second server system, and
open the Web browser on the client system only in the event that the following three conditions are all met
i) the session check flag of the redirection object stores the first value,
ii) the client program receives an authentication challenge in response to the session check request message, and
iii) the redirection object includes a forms resource identifier indicating a location to which requests for forms-based authentication are to be directed prior to re-submitting the original request to the second server system.
13. The system of claim 11 , further comprising:
wherein the instructions stored in the server system memory, when carried out by the server system processing circuitry, further cause the server system to generate the redirection object at least in part by storing a forms resource identifier in the redirection object; and
wherein the client program instructions stored in the client system memory, when carried out by the client system processing circuitry, further cause the client system to
extract the forms resource identifier from the redirection object, and
direct the Web browser to perform the forms-based authentication process with regard to the second server further by the client program navigating the Web browser using the forms resource identifier from the redirection object.
14. The system of claim 11 , further comprising:
wherein the instructions stored in the server system memory, when carried out by the server system processing circuitry, further cause the server system to generate the redirection object at least in part by storing a token resource identifier in the redirection object; and
wherein the client program instructions stored in the client system memory, when carried out by the client system processing circuitry, further cause the client system to
extract the token resource identifier from the redirection object, and
obtain, prior to re-submitting the original request to the second server system, an authentication cookie representing an authentication session established with regard to the second server through the forms-based authentication process, by transmitting a token request message including the token resource identifier from the redirection object.
15. The system of claim 10 , further comprising:
wherein the instructions stored in the server system memory, when carried out by the server system processing circuitry, further cause the server system to generate the redirection object at least in part by extracting a request method from the original request and storing the request method from the original request into a request method component of the redirection object, and extracting a request body from the original request and storing the request body from the original request into a request body component of the redirection object; and
wherein the client program instructions stored in the client system memory, when carried out by the client system processing circuitry, further cause the client system to
extract the identifier of the second server, the request method component, and the request body component from the redirection object, and
resubmitting the original request by generating and transmitting a request message containing the identifier of the second server system from the redirection object, the request method component from the redirection object, and the request body component from the redirection object.
16. The system of claim 13 , further comprising:
wherein the server system memory further stores a directory of entries, each entry corresponding to one of a plurality of authentication domains, wherein each entry includes, with regard to the corresponding one of the authentication domains
i) a location of a server to which requests for resources located in the corresponding authentication domain are to be directed,
ii) an indication of whether forms-based authentication may be required to access resources in the corresponding authentication domain,
iii) a location to which requests to determine whether an authenticated session currently exists with the corresponding authentication domain are to be directed, and
iv) a location to which requests for forms-based authentication in the corresponding authentication domain are to be directed; and
wherein the client program instructions stored in the client system memory, when carried out by the client system processing circuitry, further cause the client system to generate the redirection object based on an entry in the directory corresponding to the second authentication domain.
17. A computer program product, comprising:
a non-transitory computer readable medium which stores a set of instructions for domain redirection, the set of instructions, when carried out by computer circuitry, causing the computer circuitry to perform a method of:
receiving, at a first server system in a first authentication domain, an original request having a method and a body, the original request transmitted to the first server system in a message from a client program executing on a client system;
parsing, by the first server system, the received original request, wherein the parsing identifies at least one portion of the original request that requires resources from a second authentication domain, the second authentication domain separate from the first authentication domain;
generating, by the first server system in response to the parsing identifying the portion of the original request that requires resources from the second authentication domain, in a memory of the first server system, a redirection object, wherein the generating includes storing an identifier of a second server system in the redirection object, the second server system located in the second authentication domain, and storing a session check flag in the redirection object, the session check flag indicating whether the client system may be required to perform forms-based authentication prior to re-submitting the original request to the second server system; and
transmitting a response containing the redirection object from the first server system to the client system.