Seamless transition between web and api resource access

Patent metadata

Field	Value
Publication number	US-2020007531-A1
Application number	US-201816022068-A
Country	US
Kind code	A1
Filing date	Jun 28, 2018
Priority date	Jun 28, 2018
Publication date	Jan 2, 2020
Grant date	—

Abstract

The present disclosure relates generally to access control, and more particularly, to techniques for seamless transition between world wide web (WEB) resource access and application programming interface (API) resource access on an enterprise network with security restrictions. One technique includes receiving a request for access to a first resource, determining the first resource is a WEB resource, creating an authentication cookie and a bearer token that are tied together using a common identifier, and providing access to the WEB resource based on the authentication cookie. The technique may further include receiving a call for access to a second resource, where the call includes the bearer token in a header of the call, determining the second resource is an API resource, initiating a token exchange of the bearer token for an access token; and providing access to the API resource based on the access token.

First claim

What is claimed is:

1 . A method comprising:
receiving, at a computing system, a request for access to a first resource; determining, by the computing system, the first resource is a world wide web (WEB) resource based on a first resource pattern; validating, by the computing system, credentials of a user for access to the WEB resource, wherein the credentials are validated based on an authentication scheme associated with the WEB resource; upon validation of the credentials, creating, by the computing system, an authentication cookie and a bearer token, wherein the authentication cookie and the bearer token are tied together using a common identifier; providing, by the computing system, access to the WEB resource based on the authentication cookie; receiving, at the computing system, a call for access to a second resource, wherein the call includes the bearer token in a header of the call; determining, by the computing system, the second resource is an application programming interface (API) resource based on a second resource pattern; validating, by the computer system, the bearer token, wherein the bearer token is validated based on the common identifier in the bearer token matching the common identifier of the authentication cookie; upon validation of the bearer token initiating, by the computing system, a token exchange of the bearer token for an access token; and providing, by the computing system, access to the API resource based on the access token.

2 . The method of claim 1 , wherein the common identifier is a session identifier.

3 . The method of claim 2 , further comprising upon validation of the credentials, creating, by the computing system, a session with the session identifier, wherein the providing access to the WEB resource and the providing access to the API resource occur in the session identified by the session identifier.

4 . The method of claim 3 , further comprising determining, by the computing system, that the user is authorized to access the WEB resource.

5 . The method of claim 4 , wherein the access token is a different token from the bearer token and does not include the common identifier.

6 . A non-transitory computer-readable memory storing a plurality of instructions executable by one or more processors, the plurality of instructions comprising instructions that when executed by the one or more processors cause the one or more processors to perform processing comprising:
receiving a request for access to a first resource; determining the first resource is a world wide web (WEB) resource based on a first resource pattern; validating credentials of a user for access to the WEB resource, wherein the credentials are validated based on an authentication scheme associated with the WEB resource; upon validation of the credentials, creating an authentication cookie and a bearer token, wherein the authentication cookie and the bearer token are tied together using a common identifier; providing access to the WEB resource based on the authentication cookie; receiving a call for access to a second resource, wherein the call includes the bearer token in a header of the call; determining the second resource is an application programming interface (API) resource based on a second resource pattern; validating the bearer token, wherein the bearer token is validated based on the common identifier in the bearer token matching the common identifier of the authentication cookie; upon validation of the bearer token initiating a token exchange of the bearer token for an access token; and providing access to the API resource based on the access token.

7 . The non-transitory computer-readable memory of claim 1 , wherein the common identifier is a session identifier.

8 . The non-transitory computer-readable memory of claim 7 , further comprising upon validation of the credentials, creating, by the computing system, a session with the session identifier, wherein the providing access to the WEB resource and the providing access to the API resource occur in the session identified by the session identifier.

9 . The non-transitory computer-readable memory of claim 8 , wherein the processing further comprises determining, that the user is authorized to access the WEB resource.

10 . The non-transitory computer-readable memory of claim 9 , wherein the access token is a different token from the bearer token and does not include the common identifier.

11 . A method comprising:
receiving, at a computing system, a first call for a bearer token; validating, by the computing system, credentials of a user for access to the bearer token, wherein the credentials are validated based on an authentication scheme associated with the bearer token; upon validation of the credentials, creating, by the computing system, a bearer token, wherein the bearer token includes a common identifier; receiving, at the computing system, a second call for access to a first resource, wherein the second call includes the bearer token in a header of the call; determining, by the computing system, the first resource is an application programming interface (API) resource based on a first resource pattern; validating, by the computer system, the bearer token, wherein the bearer token is validated based on the common identifier in the bearer token; upon validation of the bearer token initiating, by the computing system, a token exchange of the bearer token for an access token; providing, by the computing system, access to the API resource based on the access token; receiving, at the computing system, a request for access to a second resource, wherein the request includes the bearer token in a header of the request; determining, by the computing system, the second resource is a world wide web (WEB) resource based on a second resource pattern; validating, by the computer system, the bearer token, wherein the bearer token is validated based on the common identifier in the bearer token; upon validation of the bearer token, creating, by the computing system, an authentication cookie, wherein the authentication cookie and the bearer token are tied together using the common identifier; and providing, by the computing system, access to the WEB resource based on the authentication cookie.

12 . The method of claim 11 , wherein the common identifier is a session identifier.

13 . The method of claim 12 , further comprising upon validation of the credentials, creating, by the computing system, a session with the session identifier, wherein the providing access to the WEB resource and the providing access to the API resource occur in the session identified by the session identifier.

14 . The method of claim 13 , further comprising determining, by the computing system, that the user is authorized to access the WEB resource.

15 . The method of claim 14 , wherein the access token is a different token from the bearer token and does not include the common identifier.

16 . The method of claim 15 , wherein the validating the bearer token for access to the WEB resource is an implicit authenticate process of the user for access to the WEB resource and includes determining that the WEB resource is protected.

Assignees

• Oracle Int Corp

Inventors

• Koottayi Vipin Anaparakkal
• Mathew Stephen

Classifications

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L67/146

  Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding · CPC title

• H04L67/141

  Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/0815 Primary

  providing single-sign-on or federations · CPC title