Composite Identity Token for Multi-Service Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users in virtual, cloud-based environments face the inconvenience of repeatedly authenticating with different identity providers to access services from various relying parties, as their unique tokens are specific to each provider, leading to a lack of single sign-on experience across multiple services.
Innovation Solution
A composite identity server generates and manages a composite token that combines claims from multiple identity providers, allowing users to access services from different relying parties without re-authentication, and provides on-demand retrieval of tokens for insufficient access scenarios, including support for two-factor authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users authenticate with each identity provider separately to access services from different relying parties, then each service can verify user identity through its specific identity provider, but users must repeatedly complete authentication procedures for each service
Solution Approach 1:
The patent merges multiple identity provider tokens into a single composite token that contains claims from multiple identity providers. This composite token is then used to access services from different relying parties, eliminating the need for repeated authentication while maintaining the reliability of identity verification through multiple trusted providers.
Solution Approach 2:
The composite token serves multiple functions by enabling access to services from different relying parties that each use different identity providers. A single token performs the authentication function across multiple service boundaries, providing universal access without requiring separate authentication procedures for each service.
2Ease of operation
If a single authentication token is used across multiple services, then users experience single sign-on convenience, but the token may not be sufficient to access services from identity providers other than the one that issued the token
Solution Approach 1:
The composite token combines claims from multiple identity providers into a single token structure, making it adaptable to services from different relying parties while maintaining the ease of single sign-on operation. The merged claims provide the necessary versatility to access multiple services without sacrificing operational simplicity.
Solution Approach 2:
The patent creates a composite authentication token that integrates claims from multiple identity providers, analogous to composite materials that combine different substances to achieve properties that individual materials cannot provide alone. This composite structure enables the token to work across multiple service boundaries with different identity providers.
3Reliability
If users re-authenticate with each identity provider for each service, then each service can ensure secure access through its specific authentication protocol, but the overall system complexity and user burden increase
Solution Approach 1:
The composite token acts as an intermediary that carries verified identity claims from multiple identity providers. Instead of users directly interacting with multiple authentication systems, the composite token mediates the authentication process, reducing system complexity while maintaining the security guarantees of each underlying identity provider through their respective claims.
Data Source
AI summary
Methods, systems, computer-readable media, and apparatuses may provide creation and management of composite tokens for use with services in a virtual environment without the user having to re-authenticate each time the user accesses a different service. A composite identity server may receive a request to upgrade a first authentication token for a user. The composite identity server may redirect a user agent to an identity provider for authentication and, in response, may receive a second authentication token for the user. The composite identity server may send the second authentication token to a federated microservice and, in response, may receive one or more claims of the second authentication token designated for inclusion in a composite token. The composite identity server may generate a composite token including the one or more claims of the first authentication token and one or more claims of the second authentication token.