Centralized Authentication Gateway for Multi-Server SSO
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users are forced to interface with multiple authentication servers when accessing different resource servers, preventing Single Sign On (SSO) functionality due to varying security levels and protocols.
Innovation Solution
Centralize authentication processes using a centralized authentication server that analyzes scope data to route requests to the appropriate authentication server, managing multiple authentication servers and providing tokens for access to resource servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If different resource servers use different authentication servers with different security levels and protocols, then each resource server can maintain its own security requirements, but users are forced to interface with multiple authentication servers and cannot achieve Single Sign On functionality
Solution Approach 1:
The patent introduces a gateway server as an intermediary between users and multiple authentication servers. The gateway server receives authentication requests from users, determines which authentication server to route to based on the requested resource server, and manages the authentication process centrally. This allows users to interact with a single gateway interface while the gateway handles communications with multiple different authentication servers behind the scenes, thus maintaining diverse security requirements while simplifying user operations.
2Adaptability or versatility
If different resource servers delegate authentication to different authentication servers, then each authentication server can implement different authentication protocols, but users must constantly re-authenticate with different authentication servers
Solution Approach 1:
The gateway server is designed with multi-functionality to handle multiple authentication protocols simultaneously. It can receive authentication requests using different protocols from users, determine the appropriate target authentication server, and manage the authentication process. This universal approach allows the system to support diverse authentication protocols while providing a consistent user interface, enabling users to authenticate once through the gateway and access multiple resource servers without re-authentication.
3Ease of operation
If a centralized authentication system is implemented, then users can achieve Single Sign On functionality, but the system complexity increases due to the need to manage multiple authentication servers and scope data
Solution Approach 1:
The patent segments the authentication system into distinct functional components: the gateway server that handles user interactions and protocol translations, scope data that defines resource access permissions, and multiple authentication servers that maintain their own security implementations. This segmentation allows the gateway to manage complexity centrally while keeping individual authentication servers relatively simple, and enables the system to provide Single Sign On functionality without requiring complete centralization of all authentication logic.
Data Source
AI summary
Methods and systems for centralizing disparate authentication servers using scopes are described herein. A computing device may receive, from a client device, a first access request comprising authentication credentials and first scope data. The computing device may then send, to at least one first authentication server associated with the at least one first resource server, a first token request. The computing device may then receive a first token and provide that token to the client device. The computing device may then receive, from the client device, a second access request comprising second scope data. The computing device may send, to at least one second authentication server associated with the at least one second resource server, a second token request. The computing device may then receive a second token and provide that token to the client device.