Maintaining session stickiness across authentication and authorization channels for access management

Patent metadata

Field	Value
Publication number	US-11050730-B2
Application number	US-201815987631-A
Country	US
Kind code	B2
Filing date	May 23, 2018
Priority date	Sep 27, 2017
Publication date	Jun 29, 2021
Grant date	Jun 29, 2021

Abstract

Techniques are described that enable maintaining of session stickiness across authentication and authorization channels in an access management system, through the use an identifier for an access manager from a plurality of access managers. The access manager authenticates a user of a client device based on an authentication request. In response to response to successful authentication of the user, the access manager creates a session. The access manager also generates the identifier and causes the identifier to be stored for the session. The access manager can then receive a second request, which is sent to the access manager based on identifying the access manager using the stored identifier.

First claim

What is claimed is:

1. A computer-implemented method comprising:
authenticating, by a first access manager, implemented using a computer system comprising at least one hardware processor and a memory, a user of a client device based on an authentication request received from the client device, wherein the first access manager is part of a plurality of access managers available for processing authentication requests;
creating, by the first access manager, a session in response to successful authentication of the user;
generating, by the first access manager, an identifier that identifies the first access manager;
generating, by the first access manager, a token that is either an authentication token or an authorization token, the token including the identifier that identifies the first access manager;
sending, by the first access manager, to an access management agent for storage, the token including the identifier that identifies the first access manager;
receiving, by the first access manager and from the access manager agent, a second request received from the client device for authentication or authorization of the user during the session, wherein the second request is received by the first access manager based on the identifier in the stored token identifying the first access manager; and
processing; by the first access manager, the second request to authenticate or authorize the user of the client device while maintaining the same session.

2. The method of claim 1 ,
wherein it is determined, based on the identifier being stored for the session, that, from among the plurality of access managers available for processing authentication requests, the first access manager is to be used for processing the second request, wherein the second request is sent from the access management agent to the first access manager in response to the determining.

3. The method of claim 1 , wherein the access managers in the plurality of access managers belong to different server clusters in a data center, and wherein the identifier includes information identifying a server cluster to which the first access manager belongs.

4. The method of claim 1 , wherein the access managers in the plurality of access managers belong to different data centers, and wherein the second request is sent to a data center of the first access manager based on the identifier.

5. The method of claim 1 , wherein the first access manager receives the authentication request over a first channel and the second request over a second channel, and wherein the first channel and the second channel use different communication protocols.

6. The method of claim 5 , wherein the first channel uses Hypertext Transfer Protocol (HTTP) and the second channel uses Oracle Access Protocol (OAP).

7. The method of claim 1 , wherein the second request is a request to re-authenticate the user or a request to authorize the user to access a resource.

8. The method of claim 1 , wherein the identifier indicates an order in which the access managers in the plurality of access managers are to be contacted for handling subsequent authentication or authorization requests.

9. The method of claim 1 , wherein the second request includes the identifier, and wherein the second request is processed by a load balancer to direct the second request to the first access manager based on the identifier as provided in the second request.

10. The method of claim 1 , wherein the access management agent sends the token to the client device, the client device stores the token, and the client device provides the token in the second request.

11. The method of claim 1 , wherein the second request is a request to authorize the user to access a resource at a computer system that is separate from the first access manager, and further comprising:
in response to processing the second request, granting, by the first access manager, access to the resource at the computer system that is separate from the first access manager.

12. A system, comprising:
a first access manager, implemented using a computer system comprising at least one hardware processor and a memory, wherein the first access manager is configured to:
authenticate a user of a client device based on an authentication request received from the client device, wherein the first access manager is part oft plurality of access managers available for processing authentication requests;
create a session in response to successful authentication of the user;
generate an identifier that identifies the first access manager;
generate a token that is either an authentication token or an authorization token, the token including the identifier that identifies the first access manager;
send, to an access management agent for storage, the token including the identifier that identifies the first access manager;
receive from the access management agent, a second request received from the client device for authentication or authorization of the user during the session, wherein the second request is received by the first access manager based on the identifier in the stored token identifying the first access manager; and
process the second request to authenticate or authorize the user of the client device while maintaining the same session.

13. The system of claim 12 , further comprising:
the access management agent configured to:
send the authentication request to the first access manager;
store the identifier for the session after receiving the identifier from the first access manager;
determine, based on the identifier being stored for the session, that, from among the plurality of access managers, the first access manager is to be used for processing the second request; and
in response to determining, send the second request to the first access manager.

14. The system of claim 12 , further comprising:
a data center, wherein the access managers in the plurality of access managers belong to different server clusters in the data center, and wherein the identifier includes information identifying a server cluster to which the first access manager belongs.

15. The system of claim 12 , further comprising:
a first data center including the first access manager, wherein at least some of the access managers in the plurality of access managers belong to a second data center, and wherein the second request is sent to the first data center based on the identifier.

16. The system of claim 12 , wherein the first access manager is further configured to receive the authentication request over a first channel and the second request over a second channel, and wherein the first channel and the second channel use different communication protocols.

17. The system of claim 16 , wherein the first channel uses Hypertext Transfer Protocol (HTTP) and the second channel uses Oracle Access Protocol (OAP).

18. The system of claim 12 , wherein the second request includes the token.

19. The system of claim 12 , further comprising:
a load balancer configured to direct the second request to the first access manager based on the identifier being included in the second request.

20. A non-transitory computer-readable storage medium storing a plurality of instructions that, when executed by one or more processors of a computer system, cause the one or more processors to:
authenticate, by a first access manager, a user of a client device based on an authentication request received from the client device, wherein the first access manager is part of a plurality of access managers av

Assignees

• Oracle Int Corp

Inventors

• Mathew Stephen
• Koottayi Vipin Anaparakkal
• Martin Madhu

Classifications

• H04L63/18

  using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215) · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/0815 Primary

  providing single-sign-on or federations · CPC title

• H04L63/168

  above the transport layer · CPC title