Method and system for user session discovery

Patent metadata

Field	Value
Publication number	US-9965613-B2
Application number	US-201113095631-A
Country	US
Kind code	B2
Filing date	Apr 27, 2011
Priority date	Dec 3, 2010
Publication date	May 8, 2018
Grant date	May 8, 2018

Abstract

Systems and methods are described to validate user connections to one or more application servers within a multi-tenant application system. A domain-level cookie at the client identifies any active connections for that client. As the client requests a connection to a particular application, the cookie is provided to a validation server that determines if any previously-established sessions with the multi-tenant system exist, and/or if such sessions remain active. If an active session already exists, then the client can be redirected to a particular server to continue the previously-established session. If no valid prior sessions are available, then the client can be validated and a new connection to an appropriate server can be established, as appropriate.

First claim

What is claimed is:

1. A computer-implemented method executable by a session validation system to validate sessions between a client device and any of a plurality of servers operating within a common domain on a network, the computer-implemented method comprising:
receiving, by the session validation system, a request that is redirected to the session validation system by an OAuth authentication system in response to successful authentication of the client device by the OAuth authentication system, wherein the OAuth authentication system operates on a different domain than the common domain;
in response to the request that is redirected from the OAuth authentication system, obtaining a cookie corresponding to the common domain from the client device at the session validation system, wherein the cookie comprises a server identification that indicates one of the plurality of servers operating within the common domain having a previously-established session with the client device, and wherein the cookie further comprises other information identifying other sessions between the client device and other ones of the plurality of servers operating within the common domain;
placing a query from the session validation system to the one of the plurality of servers that is indicated by the server identification in the cookie to thereby determine if the previously-established session between the client device and the indicated server operating on the common domain is still valid;
if the previously-established session with the indicated server operating on the common domain is still valid, the session validation system redirecting the client device to the indicated server that previously handled the previously-established session with the client device to thereby continue the previously-established session between the client device and the indicated server operating on the common domain, and wherein the previously-established session is terminated by the indicated server in response to a disconnect message sent from the client to the identified one of the plurality of servers operating on the common domain, and wherein the indicated server terminates its previously-established session with the client device by sending a replacement cookie corresponding to the common domain to the client device, and wherein the replacement cookie sent to the client device by the identified server no longer identifies the previously-established session between the client device and the identified server but leaves the other information in the cookie about other sessions with other ones of the plurality of servers operating in the common domain intact; and
if the previously-established session with the indicated server is not still valid, the session validation system validating an OAuth authorization token that was generated by the OAuth authentication system and delivered to the client device for relaying to the session validation system and, if the OAuth authorization token received from the client is valid, the session validation system establishing a new session between the client and one of the plurality of servers operating within the common domain.

2. The computer-implemented method of claim 1 further comprising redirecting the client device to establish a new session with one of the plurality of servers if the previously-established session is no longer valid.

3. The computer-implemented method of claim 2 further comprising validating the request to confirm that the client device is authorized to establish the new session with the one of the plurality of servers.

4. The computer-implemented method of claim 3 wherein the validating is not performed if the previously-established session is still valid.

5. The computer-implemented method of claim 3 wherein the validating comprises processing an access token obtained from an authorization service.

6. The computer-implemented method of claim 1 wherein the session validation system and each of the plurality of servers resides within a common domain of a network.

7. The computer-implemented method of claim 6 wherein the session validation system resides on a first subdomain of the common domain, and wherein each of the plurality of servers resides on separate subdomain of the common domain.

8. The computer-implemented method of claim 7 wherein the cookie is a domain cookie that is associated with the common domain, and wherein the information contained within the cookie comprises a user identification and a server identification of the identified server.

9. The computer-implemented method of claim 1 wherein the contacting comprises providing the information contained in the cookie to a service endpoint associated with the identified server.

10. The method of claim 1 wherein the identified server terminates the previously-established session without redirecting the client back to the session validation system.

11. A computer-implemented method executable by a session validation system to process sessions between a client and any of a plurality of servers operating on a common domain, the computer-implemented method comprising:
receiving a request from the client at the session validation system, wherein the request is redirected from an OAuth authorization service operating on a different domain from the common domain, wherein the OAuth authorization service generates an OAuth authorization token and provides the generated OAuth authorization token to the client;
in response to the request redirected from the OAuth authorization service, the session validation system processing a cookie associated with the common domain that is obtained from the client to recognize a plurality of previously-established sessions between the client and different servers of the plurality of servers operating within the common domain that are each identified by information contained in the cookie;
for each of the previously-established sessions with servers operating within the common domain, the session validation system contacting the server identified by the information contained in the cookie to thereby determine if the previously-established session with the server is still valid;
if the previously-established session is still valid, the session validation system redirecting the client to the same server identified by the information in the cookie that previously handled the previously-established session with the client to thereby continue the previously-established session with the server, and wherein, when the session is terminated, and wherein the previously-established session is terminated by the server identified by the information in the cookie in response to a disconnect message sent from the client, and wherein the server handling the previously-established session terminates the previously-established session with the client by sending a replacement cookie that is associated with the common domain to the client, wherein the replacement cookie no longer identifies the previously-established session with the server operating within the domain but that otherwise leaves the information in the cookie about other sessions with other ones of the plurality of servers operating within the common domain intact; and
if none of the previously-established sessions are still valid, the session validation system validating a copy of the OAuth authorization token that is received from the client and, if the OAuth authorization token received from the client is authorized, the session validation system establishing a new session between the client and one of the plurality of servers operating within the common domain.

12. The computer-implemented method of claim 11 wherein if more

Assignees

• Lee Jong
• Salesforce Com Inc

Inventors

• Lee Jong

Classifications

• H04W4/003

  Electricity · mapped topic

• G06F21/41 Primary

  where a single sign-on provides access to a plurality of computers · CPC title

• H04L67/14

  Session management (for real-time applications in data packet communications networks H04L65/1066) · CPC title

• H04W4/60

  Subscription-based services using application servers or record carriers, e.g. SIM application toolkits · CPC title