System and method for proxying federated authentication protocols

Patent metadata

Field	Value
Publication number	US-11323441-B2
Application number	US-202016934223-A
Country	US
Kind code	B2
Filing date	Jul 21, 2020
Priority date	Feb 22, 2013
Publication date	May 3, 2022
Grant date	May 3, 2022

Abstract

A system and method that include receiving a service provider identity request through a protocol; transmitting a proxy identity request to a configured identity provider; receiving an identity assertion; determining a proxy identity assertion based on the identity assertion; and transmitting the proxy identity assertion to the service provider.

First claim

What is claimed is:

1. A computer-implemented method comprising:
at one or more instances of a federated authentication proxy on a server:
receiving a service provider identity request from a service provider;
transmitting a proxy identity request based on the service provider identity request to a configured identity provider;
receiving an identity request assertion from the configured identity provider;
performing a second layer of authentication of the service provider identity request;
determining a proxy identity assertion based on the identity request assertion and results of the second layer of authentication; and
transmitting the proxy identity assertion to the service provider as a response to the service provider identity request.

2. The computer-implemented method of claim 1 , wherein:
the determining the proxy identity assertion includes determining that the service provider identity request is valid when the identity request assertion indicates that the service provider identity request is valid and the second layer of authentication of the service provider identity request is successful.

3. The computer-implemented method of claim 2 , wherein:
the determining the proxy identity assertion includes determining that the service provider identity request is not valid when either the identity request assertion indicates the service provider identity request is not valid or the second layer of authentication of the service provider identity request is unsuccessful.

4. The computer-implemented method of claim 1 , further comprising:
emulating a service provider in a first instance of the federated authentication proxy when receiving the service provider identity request and determining the proxy identity assertion; and
emulating an identity provider in a second instance of the federated authentication proxy when transmitting to and receiving from the configured identity provider.

5. The computer-implemented method of claim 4 , further comprising:
in association with a managing account, configuring the first instance and the second instance of the federated authentication proxy; and
prior to the transmitting the proxy identity request, selecting the second instance according to an identifier of the managing account from the first instance.

6. The computer-implemented method of claim 4 , wherein the first instance and the second instance of the federated authentication proxy are implemented using a security assertion markup language protocol (SAML).

7. The computer-implemented method of claim 4 , wherein the first instance and the second instance of the federated authentication proxy are implemented using an OpenID Connect protocol.

8. An apparatus comprising:
a non-transitory computer readable medium configured to store instructions; and
a processor configured to execute the instructions to implement one or more instances of a federated authentication proxy on a server and to perform:
receiving a service provider identity request from a service provider;
transmitting a proxy identity request based on the service provider identity request to a configured identity provider;
receiving an identity request assertion from the configured identity provider;
performing a second layer of authentication of the service provider identity request;
determining a proxy identity assertion based on the identity request assertion and results of the second layer of authentication; and
transmitting the proxy identity assertion to the service provider as a response to the service provider identity request.

9. The apparatus of claim 8 , wherein the processor is configured to perform the determining the proxy identity assertion by determining that the service provider identity request is valid when the identity request assertion indicates that the service provider identity request is valid and the second layer of authentication of the service provider identity request is successful.

10. The apparatus of claim 9 , wherein the processor is further configured to perform the determining the proxy identity assertion by determining that the service provider identity request is not valid when either the identity request assertion indicates the service provider identity request is not valid or the second layer of authentication of the service provider identity request is unsuccessful.

11. The apparatus of claim 8 , wherein the processor is further configured to perform:
emulating a service provider in a first instance of the federated authentication proxy when receiving the service provider identity request and determining the proxy identity assertion; and
emulating an identity provider in a second instance of the federated authentication proxy when transmitting to and receiving from the configured identity provider.

12. The apparatus of claim 11 , wherein the processor is further configured to perform:
in association with a managing account, configuring the first instance of the federated authentication proxy and the second instance of the federated authentication proxy; and
prior to the transmitting the proxy identity request, selecting the second instance according to an identifier of the managing account from the first instance.

13. The apparatus of claim 11 , wherein the processor is configured to implement the first instance and the second instance of the federated authentication proxy using a security assertion markup language protocol (SAML).

14. The apparatus of claim 11 , wherein the processor is configured to implement the first instance and the second instance of the federated authentication proxy using an OpenID Connect protocol.

15. A non-transitory computer readable medium storing instructions that, when executed by a processor of a proxy server, cause the processor to implement one or more instances of a federated authentication proxy and to perform:
receiving a service provider identity request from a service provider;
transmitting a proxy identity request based on the service provider identity request to a configured identity provider;
receiving an identity request assertion from the configured identity provider;
performing a second layer of authentication of the service provider identity request;
determining a proxy identity assertion based on the identity request assertion and results of the second layer of authentication; and
transmitting the proxy identity assertion to the service provider as a response to the service provider identity request.

16. The non-transitory computer readable medium of claim 15 , wherein the instructions to cause the processor to perform the determining include instructions to cause the processor to perform:
determining that the service provider identity request is valid when the identity request assertion indicates that the service provider identity request is valid and the second layer of authentication of the service provider identity request is successful.

17. The non-transitory computer readable medium of claim 16 , wherein the instructions to cause the processor to perform the determining further include instructions to cause the processor to perform:
determining that the service provider identity request is not valid when either the identity request assertion indicates the service provider identity request is not valid or the second layer of authentication of the service provider identity request is unsuccessful.

18. The non-transitory computer readable medium of claim 15 , further comprising instructions to cause the processor to perform:
emulating a service provider in a first in

Assignees

• Cisco Tech Inc

Inventors

• Oberheide Jon
• Song Douglas

Classifications

• H04L63/0884 Primary

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L63/0815

  providing single-sign-on or federations · CPC title