Authorization proxy platform

Patent metadata

Field	Value
Publication number	US-11216539-B2
Application number	US-201916381950-A
Country	US
Kind code	B2
Filing date	Apr 11, 2019
Priority date	Oct 19, 2018
Publication date	Jan 4, 2022
Grant date	Jan 4, 2022

Abstract

Techniques for brokering authorization between a user-facing service and a backend service are disclosed. A proxy service, operating independently of the user-facing service and the backend service, exposes an application programming interface (API) configured to receive requests from the user-facing services to perform functions of the plurality of backend services. The proxy service stores user authorization data that authorizes a user of a particular user-facing service to use a function of a backend service. The proxy service receives, via the API, a request to perform the function for an account associated with the user. Responsive to receiving to the request, the proxy service uses the user authorization data to access the backend service to perform the function for the account associated with the user.

First claim

What is claimed is:

1. One or more non-transitory machine-readable media storing instructions which, when executed by one or more processors, cause:
exposing, by a proxy service operating independently of a plurality of user-facing services and a plurality of backend services, an application programming interface (API) configured to receive requests from the plurality of user-facing services to perform a plurality of functions, respectively, of the plurality of backend services, wherein two or more of the plurality of the user-facing services are different from one another;
storing, by the proxy service, user authorization data that authorizes a user of a particular user-facing service in the plurality of user-facing services to use a first function of a first backend service in the plurality of backend services, wherein the first backend service uses a first authorization standard and a second backend service uses a second authorization standard different from the first authorization standard;
receiving, by the proxy service via the API, a first request to perform the first function of the first backend service for an account associated with the user;
responsive to receiving to the first request: accessing, by the proxy service using the user authorization data, the first backend service to perform the first function for the account associated with the user.

2. The one or more media of claim 1 , further storing instructions which, when executed by one or more processors, cause:
receiving, by the proxy service from the first backend service, a confirmation that the first backend service successfully completed performing the first function.

3. The one or more media of claim 2 , wherein the confirmation comprises an output of the first function.

4. The one or more media of claim 3 , further storing instructions which, when executed by one or more processors, cause:
responsive to receiving the output of the first function, using the output of the first function as input to a second function of one or more of: the first backend service; or the second backend service in the plurality of backend services.

5. The one or more media of claim 4 , wherein using the output of the first function as input to the second function is performed based at least on a plug-in application recipe (PIAR) executed by a PIAR management application associated with the proxy service.

6. The one or more media of claim 1 , further storing instructions which, when executed by one or more processors, cause:
receiving, by the proxy service from the particular user-facing service, a request to discover backend service options supported by the proxy service; and
responsive to the request to discover backend service options supported by the proxy service:
transmitting, by the proxy service to the particular user-facing service, data describing a plurality of backend service options supported by the proxy service,
wherein the plurality of backend service options comprises an option to use the first backend service.

7. The one or more media of claim 6 ,
wherein the particular user-facing service presents, to the user, a user interface comprising the plurality of backend service options, and
wherein the first request to perform the first function of the first backend service is based on a selection, by the user via the user interface, of the option to use the first backend service.

8. The one or more media of claim 1 , further storing instructions which, when executed by one or more processors, cause:
governing, by the proxy service, usage of the first backend service according to a usage policy associated with the first backend service.

9. The one or more media of claim 8 , further storing instructions which, when executed by one or more processors, cause:
receiving, by the proxy service, a second request to perform the first function of the first backend service for the account associated with the user;
responsive to a determination that performing the first function based on the second request would violate the usage policy: obtaining user input indicating whether to perform the first function in violation of the usage policy.

10. The one or more media of claim 8 , wherein the usage policy comprises one or more of: a data rate policy; a data cap policy; a legal policy restricting usage of the first function of the first backend service; or an overage charge policy.

11. The one or more media of claim 1 , further storing instructions which, when executed by one or more processors, cause:
registering the proxy service as a client, respectively, of each backend service in the plurality of backend services.

12. The one or more media of claim 1 , further storing instructions which, when executed by one or more processors, cause:
registering each user-facing service in the plurality of user-facing services, respectively, as clients of the proxy service.

13. The one or more media of claim 1 , further storing instructions which, when executed by one or more processors, cause:
obtaining, by the proxy service, an authorization code indicating that the user of the particular user-facing service is authorized to use the first function of the first backend service;
generating, by the proxy service, an authorization session identifier;
transmitting, by the proxy service to the particular user-facing service, the authorization session identifier, wherein the first request comprises the authorization session identifier;
responsive to the first request to perform the first function of the first backend service:
determining, by the proxy service, that the first request to perform the first function of the first backend service is authorized;

wherein accessing the first backend service to perform the first function for the account associated with the user comprises transmitting, by the proxy service to the first backend service, a second request to perform the first function of the first backend service;
receiving, by the proxy service from the first backend service, responsive to the second request to perform the first function of the first backend service, confirmation that the second request was authorized to perform the first function of the first backend service.

14. The one or more media of claim 13 , wherein obtaining the authorization code comprises:
receiving, by the proxy service from the particular user-facing service, a request to authorize the user to use the first function of the first backend service;
responsive to the request to authorize the user to use the first function of the first backend service:
transmitting, by the proxy service to the particular user-facing service, instructions for the user of the particular user-facing service to supply credentials to the first backend service,
wherein the first backend service supplies the authorization code after the user supplies credentials to the first backend service; and

receiving, by the proxy service from the first backend service, the authorization code indicating that the user of the particular user-facing service is authorized to use the first function of the first backend service.

15. The one or more media of claim 14 , wherein the request to authorize the user to use the first function of the first backend service comprises a scope of authorization corresponding to a subset of functionality exposed by the first backend service.

16. The one or more media of claim 13 , further storing instructions which, when executed by one or more processors, cause:
receiving, by the proxy service from the particular user-facing service, a callback unif

Assignees

• Oracle Int Corp

Inventors

• Chang Tuck
• Tirumalai Srikant Krishnapuram
• Zhang Zhengming

Classifications

• G06F21/34 Primary

  involving the use of external additional devices, e.g. dongles or smart cards · CPC title

• H04L67/562

  Brokering proxy services · CPC title

• H04L67/561

  Adding application-functional data or data for application control, e.g. adding metadata · CPC title

• G06F2221/2115

  Third party · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title