Cross-protocol federated single sign-on (F-SSO) for cloud enablement

Patent metadata

Field	Value
Publication number	US-9560036-B2
Application number	US-83230710-A
Country	US
Kind code	B2
Filing date	Jul 8, 2010
Priority date	Jul 8, 2010
Publication date	Jan 31, 2017
Grant date	Jan 31, 2017

Abstract

A method to enable access to resources hosted in a compute cloud begins upon receiving a registration request to initiate a user's registration to use resources hosted in the compute cloud. During a registration process initiated by receipt of the registration request, a federated single sign-on (F-SSO) request is received. The F-SSO request includes an assertion (e.g., an HTTP-based SAML assertion) having authentication data (e.g., an SSH public key, a CIFS username, etc.) for use to enable direct user access to a resource hosted in the compute cloud. Upon validation of the assertion, the authentication data is deployed within the cloud to enable direct user access to the compute cloud resource using the authentication data. In this manner, the cloud provider provides authentication, single sign-on and lifecycle management for the user, despite the “air gap” between the HTTP protocol used for F-SSO and the non-HTTP protocol used for the user's direct access to the cloud resource.

First claim

The invention claimed is:

1. A method to manage access to resources hosted in a shared pool of configurable computing resources, comprising:
receiving a registration request to initiate a user's registration to use resources hosted in the shared pool of configurable computing resources;
during a registration process initiated by receipt of the registration request, receiving a federated single sign-on (F-SSO) request, the F-SSO request having an assertion associated therewith that includes authentication data for use to enable direct user access to a resource hosted in the shared pool of configurable computing resources;
attempting to validate the assertion using a software component executing on a hardware element;
upon validation of the assertion, deploying the authentication data within the shared pool of configurable computing resources to enable direct user access to the resource.

2. The method as described in claim 1 wherein the assertion is a Hypertext Transfer Protocol (HTTP)-based Security Assertion Markup Language (SAML) assertion.

3. The method as described in claim 2 wherein the authentication data is a public key of a key pair.

4. The method as described in claim 3 further generating the key pair during the registration process.

5. The method as described in claim 3 wherein the key pair is a key pair associated with a non-HTTP file transfer protocol.

6. The method as described in claim 5 wherein the non-HTTP data transfer protocol is Secure Shell (SSH) or File Transfer Protocol (FTP).

7. The method as described in claim 2 wherein the authentication data includes a username.

8. The method as described in claim 7 wherein the username is associated with a non-HTTP file storage protocol.

9. The method as described in claim 8 wherein the non-HTTP file storage protocol is Common Internet File System (CIFS) or Network File System (NFS).

10. Apparatus to manage access to resources hosted in a shared pool of configurable computing resources, comprising:
a processor;
computer memory holding computer program instructions that when executed by the processor perform a method comprising:
receiving a registration request to initiate a user's registration to use resources hosted in the shared pool of configurable computing resources;
during a registration process initiated by receipt of the registration request, receiving a federated single sign-on (F-SSO) request, the F-SSO request having an assertion associated therewith that includes authentication data for use to enable direct user access to a resource hosted in the shared pool of configurable computing resources;
attempting to validate the assertion;
upon validation of the assertion, deploying the authentication data within the shared pool of configurable computing resources to enable direct user access to the resource.

11. The apparatus as described in claim 10 wherein the assertion is a Hypertext Transfer Protocol (HTTP)-based Security Assertion Markup Language (SAML) assertion.

12. The apparatus as described in claim 11 wherein the authentication data is a public key of a key pair.

13. The apparatus as described in claim 12 wherein the method further generates the key pair during the registration process.

14. The apparatus as described in claim 12 wherein the key pair is a key pair associated with a non-HTTP file transfer protocol.

15. The apparatus as described in claim 14 wherein the non-HTTP data transfer protocol is Secure Shell (SSH) or File Transfer Protocol (FTP).

16. The apparatus as described in claim 11 wherein the authentication data includes a username.

17. The apparatus as described in claim 16 wherein the username is associated with a non-HTTP file storage protocol.

18. The apparatus as described in claim 17 wherein the non-HTTP file storage protocol is Common Internet File System (CIFS) or Network File System (NFS).

19. A computer program product in a non-transitory computer readable storage medium for use in a data processing system to manage access to resources hosted in a shared pool of configurable computing resources, the computer program product holding computer program instructions which, when executed by the data processing system, perform a method comprising:
receiving a registration request to initiate a user's registration to use resources hosted in the shared pool of configurable computing resources;
during a registration process initiated by receipt of the registration request, receiving a federated single sign-on (F-SSO) request, the F-SSO request having an assertion associated therewith that includes authentication data for use to enable direct user access to a resource hosted in the shared pool of configurable computing resources;
attempting to validate the assertion;
upon validation of the assertion, deploying the authentication data within the shared pool of configurable computing resources to enable direct user access to the resource.

20. The computer program product as described in claim 19 wherein the assertion is a Hypertext Transfer Protocol (HTTP)-based Security Assertion Markup Language (SAML) assertion.

21. The computer program product as described in claim 20 wherein the authentication data is a public key of a key pair.

22. The computer program product as described in claim 21 wherein the method further generates the key pair during the registration process.

23. The computer program product as described in claim 21 wherein the key pair is a key pair associated with a non-HTTP file transfer protocol.

24. The computer program product as described in claim 23 wherein the non-HTTP data transfer protocol is Secure Shell (SSH) or File Transfer Protocol (FTP).

25. The computer program product as described in claim 20 wherein the authentication data includes a username.

26. The computer program product as described in claim 25 wherein the username is associated with a non-HTTP file storage protocol.

27. The computer program product as described in claim 26 wherein the non-HTTP file storage protocol is Common Internet File System (CIFS) or Network File System (NFS).

28. The method as described in claim 1 further including performing an additional lifecycle management operation with respect to the user and the resource after validating the assertion.

29. The apparatus as described in claim 10 wherein the method further includes performing an additional lifecycle management operation with respect to the user and the resource after validating the assertion.

30. The computer program product as described in claim 19 wherein the method further includes performing an additional lifecycle management operation with respect to the user and the resource after validating the assertion.

31. The method as described in claim 1 wherein the shared pool of configurable resources includes multiple standard protocols for resource access or storage, and wherein the method further includes provisioning a credential to at least one other resource in the shared pool using one of the multiple standard protocols.

32. The apparatus as described in claim 10 wherein the shared pool of configurable resources includes multiple standard protocols for resource access or storage, and wherein the method further includes provisioning a credential to at least one other resource in the sh

Assignees

• Hinton Heather M
• Bade Steven A
• Linton Jeb
• Rodriguez Peter
• IBM

Inventors

• Hinton Heather M
• Bade Steven A
• Linton Jeb
• Rodriguez Peter

Classifications

• H04L9/3228 Primary

  One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key · CPC title

• H04L63/0815 Primary

  providing single-sign-on or federations · CPC title