Cookie based state propagation for a multi-tenant identity cloud service

Patent metadata

Field	Value
Publication number	US-11023555-B2
Application number	US-201916550685-A
Country	US
Kind code	B2
Filing date	Aug 26, 2019
Priority date	Sep 16, 2016
Publication date	Jun 1, 2021
Grant date	Jun 1, 2021

Abstract

Embodiments provide cloud based identity management to authenticate a user. At a first authentication layer, embodiments receive a request from the user to be authenticated, where the request is received from a browser application on a user computer, and create at least one cookie, where the cookie includes state information of the request and is adapted to be stored on the browser application. At the first authentication layer, embodiments first redirect the request to a second authentication layer. At the second authentication layer, embodiments receive the cookie from the browser application and authenticate the user, and second redirect the request to the first authentication layer, where the second redirecting includes providing a result of the authenticating as a query parameter.

First claim

What is claimed is:

1. A non-transitory computer readable medium having instructions stored thereon that, when executed by one or more processors, cause the processors to provide cloud based identity management to authenticate a user, the authentication comprising:
at a first authentication layer, receiving a request from the user to be authenticated, wherein the request is received from a browser application on a user computer;
at the first authentication layer, creating or updating at least one cookie, wherein the cookie includes information about the user and is adapted to be stored on the browser application;
at the first authentication layer, first redirecting the request to a second authentication layer;
at the second authentication layer, receiving the cookie from the browser application and authenticating the user based at least on the information about the user on the cookie; and
at the second authentication layer, second redirecting the request to the first authentication layer, wherein the second redirecting comprises providing a Uniform Resource Locator (URL) that includes a result of the authenticating as a query parameter.

2. The non-transitory computer readable medium of claim 1 , wherein the first authentication layer comprises Security Assertion Markup Language (SAML) authentication functionality and the second authentication layer comprises single sign on (SSO) authentication functionality.

3. The non-transitory computer readable medium of claim 1 , wherein the first authentication layer comprises a first microservice and the second authentication layer comprises a second microservice.

4. The non-transitory computer readable medium of claim 1 , wherein the information about the user comprises metadata.

5. The non-transitory computer readable medium of claim 1 , wherein the result of the authenticating is not stored on the cookie when the request is redirected to the first authentication layer.

6. The non-transitory computer readable medium of claim 1 , wherein the result of the authenticating is stripped from the cookie at the second authentication layer.

7. The non-transitory computer readable medium of claim 1 , wherein the at least one cookie comprises a request cookie for authentication requests and a session cookie for a user session and corresponding states.

8. The non-transitory computer readable medium of claim 1 , wherein the cookie comprises state information in a format specific to the first authentication layer that cannot be read by other authentication layers.

9. A method of providing cloud based identity management to authenticate a user, the method comprising:
at a first authentication layer, receiving a request from the user to be authenticated, wherein the request is received from a browser application on a user computer;
at the first authentication layer, creating or updating at least one cookie, wherein the cookie includes information about the user and is adapted to be stored on the browser application;
at the first authentication layer, first redirecting the request to a second authentication layer;
at the second authentication layer, receiving the cookie from the browser application and authenticating the user based at least on the information about the user on the cookie; and
at the second authentication layer, second redirecting the request to the first authentication layer, wherein the second redirecting comprises providing a Uniform Resource Locator (URL) that includes a result of the authenticating as a query parameter.

10. The method of claim 9 , wherein the first authentication layer comprises Security Assertion Markup Language (SAML) authentication functionality and the second authentication layer comprises single sign on (SSO) authentication functionality.

11. The method of claim 9 , wherein the first authentication layer comprises a first microservice and the second authentication layer comprises a second microservice.

12. The method of claim 9 , wherein the information about the user comprises metadata.

13. The method of claim 9 , wherein the result of the authenticating is not stored on the cookie when the request is redirected to the first authentication layer.

14. The method of claim 9 , wherein the result of the authenticating is stripped from the cookie at the second authentication layer.

15. The method of claim 9 , wherein the at least one cookie comprises a request cookie for authentication requests and a session cookie for a user session and corresponding states.

16. The method of claim 9 , wherein the cookie comprises state information in a format specific to the first authentication layer that cannot be read by other authentication layers.

17. A system for providing cloud based identity and access management that authenticates a user, the system comprising:
a first authentication layer comprising one or more processors; and
a second authentication layer comprising one or more processors;
the first authentication layer adapted to receive a request from the user to be authenticated, wherein the request is received from a browser application on a user computer, create or update at least one cookie, wherein the cookie includes stats information about the user and is adapted to be stored on the browser application, and first redirecting the request to a second authentication layer;
the second authentication layer adapted to receive the cookie from the browser application and authenticate the user based at least on the information about the user on the cookie, and second redirecting the request to the first authentication layer, wherein the second redirecting comprises providing a Uniform Resource Locator (URL) that includes a result of the authenticate as a query parameter.

18. The system of claim 17 , wherein the first authentication layer comprises Security Assertion Markup Language (SAML) authentication functionality and the second authentication layer comprises single sign on (SSO) authentication functionality.

19. The system of claim 17 , wherein the first authentication layer comprises a first microservice and the second authentication layer comprises a second microservice.

20. The system of claim 17 , wherein the result of the authenticating is not stored on the cookie when the request is redirected to the first authentication layer.

Assignees

• Oracle Int Corp

Inventors

• Carru Damien
• Uchil Mrudul Pradeep
• SANKESARA Bhavik
• Xia Risheng

Classifications

• H04L67/5682 Primary

  Policies or rules for updating, deleting or replacing the stored data · CPC title

• H04L67/53

  using third party service providers · CPC title

• H04L63/0815

  providing single-sign-on or federations · CPC title

• G06F16/957

  Browsing optimisation, e.g. caching or content distillation · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title