Maintaining session stickiness across authentication and authorization channels for access management

Patent metadata

Field	Value
Publication number	US-11658958-B2
Application number	US-202117325636-A
Country	US
Kind code	B2
Filing date	May 20, 2021
Priority date	Sep 27, 2017
Publication date	May 23, 2023
Grant date	May 23, 2023

Abstract

Techniques are described that enable maintaining of session stickiness across authentication and authorization channels in an access management system, through the use an identifier for an access manager from a plurality of access managers. The access manager authenticates a user of a client device based on an authentication request. In response to response to successful authentication of the user, the access manager creates a session. The access manager also generates the identifier and causes the identifier to be stored for the session. The access manager can then receive a second request, which is sent to the access manager based on identifying the access manager using the stored identifier.

First claim

What is claimed is:

1. A computer-implemented method comprising:
receiving, by an access management agent implemented using a computer system comprising at least one hardware processor and a memory, from a first access manager, a token that includes an identifier that identifies the first access manager, wherein the token is either an authentication token or an authorization token, and wherein the first access manager created a session and generated the token in response to successful authentication of a user based on a first request;
storing, by the access management agent, for the session, the token that includes the identifier that identifies the first access manager, wherein the first access manager is part of a plurality of access managers, and wherein the access managers in the plurality of access managers belong to different data centers, the first access manager belonging to a first data center;
receiving, by the access management agent, from the user during the session, a second request for authentication or authorization of the user;
determining, by the access management agent, based on the identifier that identifies the first access manager included in the token being stored for the session, that, from among the plurality of access managers, the first access manager is to be used for processing the second request; and
in response to the determining, sending, by the access management agent, to the first data center of the first access manager, the second request for authentication or authorization of the user, wherein the first access manager processes the second request to authenticate or authorize the user.

2. The method of claim 1 , further comprising:
generating, by the access management agent, the first request that is an authentication request; and
sending, by the access management agent, the first request to the first access manager.

3. The method of claim 2 , further comprising:
receiving, by the access management agent, from the user, a user request for a protected resource;
determining, by the access management agent, that authentication is needed;
sending, by the access management agent, to the user, a request for credential information; and
receiving, by the access management agent, from the user, the credential information, wherein the credential information is included in the first request.

4. The method of claim 1 , wherein the first access manager generates the identifier that identifies the first access manager.

5. The method of claim 1 , wherein the second request for authentication or authorization of the user includes the token, and wherein the first access manager processes the second request based on the token.

6. The method of claim 1 , wherein the access managers in the plurality of access managers belong to different server clusters, and wherein the identifier that identifies the first access manager includes information identifying a server cluster to which the first access manager belongs.

7. The method of claim 1 , wherein the second request for authentication or authorization of the user is a request to re-authenticate the user.

8. The method of claim 1 , wherein the second request for authentication or authorization of the user is a request to authorize the user to access a resource.

9. A system, comprising:
an access management agent implemented using a computer system comprising at least one hardware processor and a memory, wherein the access management agent is configured to:
receive, from a first access manager, a token that includes an identifier that identifies the first access manager, wherein the token is either an authentication token or an authorization token, and wherein the first access manager created a session and generated the token in response to successful authentication of a user based on a first request;
store, for the session, the token that includes the identifier that identifies the first access manager, wherein the first access manager is part of a plurality of access managers, and wherein the access managers in the plurality of access managers belong to different data centers, the first access manager belonging to a first data center;
receive, from the user during the session, a second request for authentication or authorization of the user;
determine, based on the identifier that identifies the first access manager included in the token being stored for the session, that, from among the plurality of access managers, the first access manager is to be used for processing the second request; and
in response to the determining, send, to the first data center of the first access manager, the second request for authentication or authorization of the user, wherein the first access manager processes the second request to authenticate or authorize the user.

10. The system of claim 9 , further comprising:
the first access manager configured to:
authenticate the user;
create the session in response to the successful authentication of the user;
generate the token that includes the identifier that identifies the first access manager;
send, to the access management agent for storage, the token including the identifier that identifies the first access manager;
receive, from the access management agent, the second request for authentication or authorization of the user; and
process the second request to authenticate or authorize the user.

11. The system of claim 9 ,
wherein the access managers in the plurality of access managers belong to different server clusters, and wherein the identifier that identifies the first access manager includes information identifying a server cluster to which the first access manager belongs.

12. The system of claim 9 , further comprising:
the first data center including the first access manager, wherein at least some of the access managers in the plurality of access managers belong to a second data center.

13. The system of claim 9 , further comprising:
a load balancer configured to direct the second request to authenticate or authorize the user to the first access manager based on the identifier that identifies the first access manager being included in the second request.

14. The system of claim 9 , wherein the second request includes the token, and wherein the token includes session information.

15. The system of claim 9 , wherein the access management agent is further configured to send the first request to the first access manager over a first channel and to send the second request to the first access manager over a second channel, and wherein the first channel and the second channel use different communication protocols.

16. The system of claim 15 , wherein the first channel uses Hypertext Transfer Protocol (HTTP) and the second channel uses Oracle Access Protocol (OAP).

17. A non-transitory computer-readable storage medium storing a plurality of instructions that, when executed by one or more processors of a computer system, cause the one or more processors to:
receive, from a first access manager, a token that includes an identifier that identifies the first access manager, wherein the token is either an authentication token or an authorization token, and wherein the first access manager created a session and generated the token in response to successful authentication of a user based on a first request;
store, for the session, the token that includes the identifier that identifies the first access manager, wherein the first access manager is part of a plurality of access managers, and wherein the access managers in the plurality of access managers belon

Assignees

• Oracle Int Corp

Inventors

• Mathew Stephen
• Koottayi Vipin Anaparakkal
• Martin Madhu

Classifications

• H04L63/18

  using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215) · CPC title

• H04L63/168

  above the transport layer · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/0815 Primary

  providing single-sign-on or federations · CPC title