Access Manager Session Stickiness via Identifier Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access management systems in enterprise networks face inefficiencies due to the lack of session stickiness across authentication and authorization channels, leading to resource-intensive and time-consuming processes when transferring session information across different data centers.
Innovation Solution
Implementing an identifier stored in a token to direct subsequent requests to the same access manager that created the session, maintaining session stickiness by using an access management agent to intercept and route requests based on this identifier, thereby avoiding the need to recreate or transfer session information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If session information is transferred across different data centers, then authentication and authorization can be performed, but resource consumption and processing time increase
Solution Approach 1:
The system segments session management by creating separate session stores for different data centers, with each access manager routing requests to the appropriate session store. This segmentation prevents unnecessary cross-data-center transfers while maintaining authentication reliability through localized session handling.
Solution Approach 2:
A session store acts as an intermediary component between access managers and user sessions. The session store receives session information from access managers and provides it back when needed, eliminating the need for direct cross-data-center communication and reducing transfer time while maintaining reliability.
2Reliability
If session information is transferred across different data centers, then authentication and authorization can be performed, but resource consumption increases
Solution Approach 1:
By segmenting session storage across multiple localized session stores in different data centers, the system minimizes cross-data-center data transfers. Each access manager routes requests to the appropriate local session store, reducing energy consumption for data transfer while maintaining authentication reliability through proper session routing.
Solution Approach 2:
The session store serves as an intermediary that localizes session data access. Instead of transferring session information across data centers for every authentication request, the session store provides localized access to session data, significantly reducing the energy required for data transfer while maintaining authentication reliability.
3Productivity
If multiple access managers are used for load distribution, then system capacity increases, but session stickiness is lost requiring session transfers
Solution Approach 1:
The system segments session management by creating dedicated session stores for each data center and implementing routing logic that maintains session stickiness within data centers. Multiple access managers can distribute load while sessions remain localized, eliminating transfer time overhead while maintaining high authentication throughput through parallel processing capabilities.
Solution Approach 2:
The routing mechanism incorporates feedback by examining session identifiers in requests and dynamically routing them to the appropriate session store based on the session's origin data center. This feedback-based routing maintains session stickiness across multiple access managers, allowing load distribution without session transfers and preserving both productivity and response time.
4Adaptability or versatility
If session information is transferred across data centers, then access to distributed resources is enabled, but security risks increase
Solution Approach 1:
By segmenting session storage into localized session stores within each data center, the system enables distributed resource access through proper session routing while minimizing cross-data-center data transfers. This segmentation reduces the attack surface for security threats during transmission and maintains versatility by allowing access to resources across the distributed system through authenticated session validation.
Solution Approach 2:
The session store acts as a secure intermediary that validates and manages session information locally. Instead of transferring session data across data centers, the session store provides secure local access control, reducing security risks associated with data transmission while maintaining adaptability for distributed resource access through centralized session validation logic.
Data Source
AI summary
Techniques are described that enable maintaining of session stickiness across authentication and authorization channels in an access management system, through the use an identifier for an access manager from a plurality of access managers. The access manager authenticates a user of a client device based on an authentication request. In response to response to successful authentication of the user, the access manager creates a session. The access manager also generates the identifier and causes the identifier to be stored for the session. The access manager can then receive a second request, which is sent to the access manager based on identifying the access manager using the stored identifier.