Federated Identity Provider Architecture for SSO Performance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing single sign-on functionality in large software environments is challenging due to performance degradation of identity providers and the difficulty for multiple development teams to maintain them, especially when different software systems have varying needs.
Innovation Solution
A system where multiple local identity providers work with a master identity provider to offer single sign-on functionality, allowing each local provider to be specialized for specific web applications while sharing a master session for authentication across multiple systems, with the master identity provider being transparent to users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single identity provider is used for multiple systems, then single sign-on functionality is achieved, but performance degrades for large systems and maintenance becomes difficult
Solution Approach 1:
The patent divides the single identity provider into multiple local identity providers, each responsible for specific software systems. This segmentation reduces the load on each individual provider and improves overall system performance while maintaining single sign-on capability across the distributed systems.
Solution Approach 2:
The patent introduces a federation server as an intermediary between local identity providers and software systems. This mediator coordinates authentication requests across multiple providers, enabling single sign-on functionality without requiring each local provider to handle all authentication traffic independently, thus improving performance.
2Ease of operation
If a single identity provider is used for multiple systems, then single sign-on is enabled, but maintenance difficulty increases for multiple development teams
Solution Approach 1:
By segmenting the identity provider into multiple local providers, each development team can maintain their own provider for their specific system without interfering with other teams. This modular approach simplifies maintenance while preserving cross-system single sign-on capability through the federation server.
Solution Approach 2:
Each local identity provider is customized for specific software systems with local quality characteristics, allowing development teams to optimize maintenance for their particular systems while the federation server provides the common single sign-on functionality across all systems.
3Reliability
If multiple local identity providers are used, then performance improves and maintenance becomes easier, but system complexity increases
Solution Approach 1:
The federation server acts as a central coordinator that manages communication between multiple local identity providers and software systems. This intermediary layer abstracts the complexity of multiple providers from the software systems, allowing them to interact with a unified authentication interface while the federation server handles the complexity of coordinating multiple local providers.
Data Source
AI summary
A method includes, with a computing system associated with a first local identity provider of a plurality of local identity providers, receiving a first authentication request from a first web application of a user device. The method further includes, with the computing system, redirecting a browser associated with the first web application to a server system associated with a master identity provider. The method further includes, with the computing system, receiving from the browser, a master session identifier provided by the master identity provider, the master session identifier identifying a master single sign-on session that is available to the plurality of local identity providers. The method further includes, with the computing system, establishing a first local single sign-on session between the first local identity provider and the browser.