System and method of federated authentication with reverse proxy

Abstract

A Security Assertion Markup Language (SAML) conversation is intercepted in an enhanced Reverse Proxy server computer located in the path between a user and a server computer that provide cloud application services to the user. During authentication, the SAML assertion signature is modified in the enhanced Reverse Proxy such that the enhanced Reverse Proxy and the user can share an encryption key. The modified assertion signature permits a common session key to be shared by the enhanced Reverse Proxy and a targeted application in the server, thus enabling the user to be authenticated, and subsequently to communicate via the enhanced Reverse Proxy in a secure session with an application in the server.

Description

RELATED APPLICATIONS[0001]The present application claims benefit from the U.S. provisional application Ser. No. 61 / 479,634 filed on Apr. 27, 2012, entire contents of which are incorporated herein by reference.FIELD OF THE INVENTION[0002]The present invention relates to client-server communication in a network, and in particular to user authentication when client-server communication is mediated by a proxy.BACKGROUND OF THE INVENTION[0003]In computer networks, a Reverse Proxy is a type of proxy server that retrieves resources on behalf of a client from one or more servers. These resources are then returned to the client as though they originated from the Reverse Proxy itself. The user browser navigates to a Universal Resource Locator (URL) in a Hypertext Transfer Protocol (HTTP) message for example HTTP: / / www.mydomain.com. The Reverse Proxy at that address, in turn, makes a request to the real web server resources on behalf of the user, for example HTTP: / / www.saas.com. In order for a...

AI Technical Summary

Benefits of technology

[0010]It is an objective of the invention to provide an enhanced reverse proxy which allows federated single sign-on to be used with cloud applications.

[0015]in the reverse proxy computer, replacing the URL with a modified URL, and returning the modified URL to the client device, thereby enabling the client to access the resource.

Problems solved by technology

As a result, most cloud applications cannot use simultaneously both a federated SSO strategy, which normally requires direct communications between the Identity Provider for the enterprise and the Cloud application, and a Reverse Proxy, which would interrupt this direct communications for SSO.

A new challenge is to use a Reverse Proxy server to act as a gateway to a heterogeneous mix of web servers, each with a unique URL / Domain, and a set of disparate services.

The limited capabilities of existing Reverse Proxy servers would require the setup of separate reverse proxies on a cloud by cloud basis.

Images