Dynamic User Group Provisioning via SAML Assertion Parsing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer network systems face inefficiencies in managing user authentication and access control, particularly in environments with a large number of users, tenants, and roles, where static provisioning of user groups is required, leading to complex logic and reduced efficiency in single-sign on (SSO) processes.
Innovation Solution
A controller is configured to create, modify, and preprocess assertions, such as SAML assertions, to efficiently map user attributes to existing or dynamically provisioned user groups, using the Keystone identity service within the OpenStack platform, thereby streamlining the authentication process and eliminating the need for static user group provisioning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If static provisioning of user groups is used, then user authentication can be performed, but the system complexity increases and efficiency decreases in environments with large numbers of users, tenants, and roles
Solution Approach 1:
The patent implements dynamic user group provisioning where user groups are created and modified based on real-time attributes from SAML assertions rather than static pre-defined groups. The system dynamically determines user group membership by evaluating attributes such as tenant, role, and department from authentication tokens, allowing the user group structure to adapt automatically to changing user attributes and access requirements.
Solution Approach 2:
The system changes the parameters of user group provisioning from fixed static definitions to dynamic attribute-based definitions. By using SAML assertion attributes (tenant ID, role, department, etc.) as parameters for user group determination, the system transforms the user group management model to be flexible and adaptive, reducing complexity in large-scale multi-tenant environments.
2Reliability
If static user group provisioning is required, then access control can be implemented, but the logic complexity increases for Keystone's first-match rules processing
Solution Approach 1:
The system implements self-service access control where the authentication system automatically determines user group membership based on SAML assertion attributes without requiring complex manual configuration or matching rules. The user groups self-organize based on user attributes, eliminating the need for intricate first-match rules processing and reducing logical complexity while maintaining reliable access control.
3Productivity
If dynamic provisioning of user groups is implemented, then authentication efficiency improves, but additional processing steps are required
Solution Approach 1:
The system performs preliminary extraction and evaluation of user attributes from SAML assertions during the authentication process itself, before user group membership needs to be determined. By pre-processing the attribute data and organizing it in a structured format, the system prepares the information needed for efficient dynamic user group provisioning, reducing the processing burden during subsequent access control operations.
Data Source
AI summary
A controller may be used to create and process an assertion, in some cases, to implement single-sign on (SSO) in a computer network. In some examples, the controller includes processing circuitry coupled to a storage device. The processing circuitry is configured to create the assertion, where the assertion includes information indicative of a set of attributes and parse the assertion to determine the set of attributes. Additionally, the processing circuitry is configured to determine if each attribute of the set of attributes maps to a plurality of primary user groups stored in the storage device. Based on determining that an attribute of the set of attributes does not map to at least one primary user group of the plurality of primary user groups, the processing circuitry is configured to create a set of secondary user groups and a set of secondary user group names corresponding to the attribute.