Federation Server SSO via ID Federation Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
As the number of web applications increases, the authentication server faces a significant burden in managing user IDs and passwords, requiring excessive computational resources to facilitate Single Sign-On (SSO) across multiple applications.
Innovation Solution
A federation server configures and manages ID federations between itself and multiple applications, receiving authentication requests from one application and sending them to another, allowing seamless SSO without the need for the federation server to store and manage user credentials for all applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If an authentication server is used to manage user IDs and passwords for multiple web applications, then Single Sign-On functionality is achieved, but the computational resources and management burden increase drastically
Solution Approach 1:
The patent segments the authentication system into multiple independent authentication servers, each responsible for a specific web application. Instead of one server managing all applications, each application has its own dedicated authentication server that handles only its user credentials, dividing the management burden into smaller, manageable units.
Solution Approach 2:
The patent introduces a federation mechanism as an intermediary layer between authentication servers and web applications. This federation system enables different authentication servers to trust and recognize each other's authentication results, allowing Single Sign-On across applications without requiring one server to manage all credentials directly.
2Adaptability or versatility
If the number of web applications increases, then the scope of SSO coverage expands, but the burden of managing user credentials increases
Solution Approach 1:
The system segments credential management by assigning each web application its own authentication server. This segmentation allows the system to scale to multiple applications without increasing the complexity of any single server, as each server only manages credentials for its specific application.
Solution Approach 2:
The federation mechanism provides a universal interface that works across all web applications. By establishing federation relationships between authentication servers, the system achieves multi-application SSO coverage through a standardized federation protocol that can be extended to any number of applications.
3Reliability
If a single authentication server manages all user credentials, then centralized control is achieved, but the computational load becomes excessive
Solution Approach 1:
The patent divides the centralized authentication function into multiple distributed authentication servers. Each server maintains local control over its application's user credentials, eliminating the need for a single server to handle all authentication operations and reducing the computational load on each individual server.
Solution Approach 2:
The federation mechanism acts as an intermediary that enables centralized control across distributed servers. Through federation relationships and mutual trust agreements, the system achieves coordinated authentication control without requiring one server to bear the full computational burden of managing all credentials.
Data Source
AI summary
A computer readable medium having instructions embodied therewith, the instructions executable by a processor or programmable circuitry of a federation server to cause the processor or programmable circuitry to perform operations including configuring a plurality of identification (ID) federations between the federation server and a plurality of applications such that each of the plurality of ID federations is between the federation server and one of the plurality of applications, receiving a first authentication request for authenticating a user who has been authenticated on a first application of the plurality of applications using an ID federation between the first application and the federation server from among the plurality of ID federations, and sending a second authentication request to a second application of the plurality of applications for authenticating the user using an ID federation between the federation server and the second application from among the plurality of ID federations.