Method for authentication with identity providers

Patent metadata

Field	Value
Publication number	US-12363091-B2
Application number	US-201916575438-A
Country	US
Kind code	B2
Filing date	Sep 19, 2019
Priority date	Nov 8, 2018
Publication date	Jul 15, 2025
Grant date	Jul 15, 2025

Abstract

The present disclosure relates to a method for authentication with identity providers via a federating authorization server, wherein the federating authorization server has at least one interface to at least one identity provider. Each identity provider is configured to validate user identities using a respective validation method. The method comprises: receiving login data via a webpage, the login data indicating at least an identity provider and a user. The validation method of the indicated identity provider may be determined using the login data. An update of the content of the webpage may be caused for enabling the determined validation method. Identity information of the user may be provided via the updated webpage and verifying the identity information using the determined validation method.

First claim

What is claimed is:

1. A method for authentication with identity providers via a federating authorization server, wherein the federating authorization server has at least one interface to at least one identity provider, each identity provider being configured to validate user identities using one or more validation methods, the method comprising:
receiving login data via a login form of a webpage, the login data indicating at least an identity provider and a user;
determining the validation method of the indicated identity provider for the indicated user using the login data;
causing an update of the content of the webpage for enabling the determined validation method, the update including modifying the login form, wherein modifying the login form includes modifying an interface element to cause a redirection, when selected, to the indicated identity provider in accordance with the determined validation method; and
causing provision of identity information of the user via the updated webpage and verifying the identity information using the determined validation method.

2. The method of claim 1 , further comprising in response to the identity information being validated by the indicated identity provider, providing, upon request, an access key to a web server of the user for enabling access to one or more resource servers via the web server.

3. The method of claim 1 , wherein the redirection comprises retrieving another webpage of the indicated identity provider, and wherein the provision of the identity information is from the other webpage.

4. The method of claim 1 , wherein the identity information is provided to the indicated identity provider via the federating authorization server in accordance with the determined validation method.

5. The method of claim 1 , wherein the receiving of login data comprises: requesting a target webpage from a web server, receiving the webpage if the web server is authorized by the federating authorization server.

6. The method of claim 5 , further comprising:
upon receiving the request of the target webpage, sending by the web server credentials data to the federating authorization server for authentication of the web server as a truthful web server;
in response to the web server being authenticated, receiving by the web server an authorization indicative of a time period; and
enabling access to the webpage during the time period.

7. The method of claim 6 , wherein the enabling access comprises providing a temporary secret that has a living duration equal to the time period.

8. The method of claim 6 , further comprising requesting by the web server from the federating authorization server a list of identity providers; and receiving a list of identity providers in response to the request, wherein the webpage indicates the received list of the plurality of identity providers, and wherein the indicated identity provider is a selected provider of the list.

9. A computer program product comprising a computer-readable storage medium having computer-readable program code embodied therewith, the computer-readable program code executable by a processor to perform a method comprising:
receiving login data via a login form of a webpage, the login data indicating at least an identity provider and a user;
determining the validation method of the indicated identity provider for the indicated user using the login data;
causing an update of the content of the webpage for enabling the determined validation method, the update including modifying the login form, wherein modifying the login form includes changing an interface element to cause a redirection, when selected, to the indicated identity provider in accordance with the determined validation method; and
causing provision of identity information of the user via the updated webpage and verifying the identity information using the determined validation method.

10. The computer program product of claim 9 , wherein the method further comprises in response to the identity information being validated by the indicated identity provider, providing, upon request, an access key to a web server of the user for enabling access to one or more resource servers via the web server.

11. The computer program product of claim 9 , wherein the redirection comprises retrieving another webpage of the selected identity provider, and wherein the provision of the identity information is from the other webpage.

12. The computer program product of claim 9 , wherein the identity information is provided to the indicated identity provider via the federating authentication server in accordance with the determined validation method.

13. The computer program product of claim 9 , wherein the receiving of login data comprises: requesting a target webpage from a web server, receiving the webpage if the web server is authorized by the federating authorization server.

14. The computer program product of claim 13 , wherein the method further comprises:
upon receiving the request of the target webpage, sending by the web server credentials data to the federating authorization server for authentication of the web server as a truthful web server;
in response to the web server being authenticated, receiving by the web server an authorization indicative of a time period; and
enabling access to the webpage during the time period.

15. The computer program product of claim 14 , wherein the enabling access comprises providing a temporary secret that has a living duration equal to the time period.

16. The computer program product of claim 14 , wherein the method further comprises requesting by the web server from the federating authorization server a list of identity providers; and receiving a list of identity providers in response to the request, wherein the webpage indicates the received list of the plurality of identity providers, and wherein the indicated identity provider is a selected provider of the list.

17. A federating authorization server comprising at least one interface to at least one identity provider, each identity provider being configured to validate user identities using one or more validation methods, the server comprising a memory and a processor configured to execute program instructions stored in the memory to perform operations comprising:
receiving login data via a login form of a webpage, the login data indicating at least an identity provider and a user;
determining the validation method of the indicated identity provider for the indicated user using the login data;
causing an update of the content of the webpage for enabling the determined validation method, the update including modifying the login form, wherein modifying the login form includes changing an interface element to cause a redirection, when selected, to the indicated identity provider in accordance with the determined validation method; and
causing provision of identity information of the user via the updated webpage and verifying the identity information using the determined validation method.

18. The method of claim 1 , wherein modifying the login form includes showing an additional field in the login form.

Assignees

• IBM

Inventors

• Smolny Martin
• Dürr Thomas
• Beck Michael
• Ochs Georg

Classifications

• H04L63/062

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/108

  when the policy decisions are valid for a limited amount of time · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title