Gatekeeper Cookie for Multi-Tenant Single Sign-Out
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant document and information sharing systems, users face the inconvenience of needing to individually sign out of each tenant account when signing out of the system, which complicates the single sign-on and single sign-out process.
Innovation Solution
The implementation of a method that uses cookies to manage user authentication, issuing a gatekeeper cookie for non-vanity domains and vanity domain cookies to track user sessions, allowing for single sign-on and single sign-out across multiple tenant accounts by determining the presence of a root name or domain in the URL to associate and clear cookies accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a user signs out of a multi-tenant document and information sharing system, then the user needs to individually sign out of each tenant account, but this increases the complexity and time required for the sign-out process
Solution Approach 1:
The patent segments the sign-out process by introducing two types of cookies: a root cookie that identifies the user's authentication state at the root domain level, and sub-domain cookies that track authentication state at individual tenant account levels. This segmentation allows the system to selectively clear only the necessary cookies based on the user's current authentication context, rather than requiring manual sign-out from each tenant account individually.
Solution Approach 2:
The patent introduces cookies as intermediary elements that mediate between the user's authentication state and the multiple tenant accounts. The root cookie acts as a primary intermediary that, when cleared, automatically triggers the clearing of associated sub-domain cookies through the gatekeeper mechanism. This intermediary system simplifies the sign-out process by providing a single action point that cascades through the entire authentication hierarchy.
2Measurement precision
If the system issues separate cookies for each tenant account, then user authentication tracking becomes more precise, but the device complexity increases
Solution Approach 1:
The patent merges the root domain authentication state with sub-domain authentication states by establishing a hierarchical relationship between root cookies and sub-domain cookies. The root cookie serves as a parent identifier that automatically generates and manages corresponding sub-domain cookies. This merging approach maintains precise tracking across multiple tenant accounts while reducing overall system complexity by consolidating management through the single root cookie mechanism.
Solution Approach 2:
The root cookie serves multiple functions: it identifies the user's authentication state at the root domain level, automatically generates sub-domain cookies for multiple tenant accounts, and acts as a central control point for clearing all associated authentication cookies during sign-out. This multi-functionality reduces the need for separate management mechanisms for each tenant account, thereby reducing device complexity while maintaining precise authentication tracking.
Data Source
AI summary
A method for sign-on and sign-out for a computer system. The method includes receiving a first sign-on request for the computer system and obtaining, from the first sign-on request, a first user identifier where the first user identifier corresponds to a first user for the computer system. The method then includes obtaining, from the first sign-on request, a first uniform resource locator (URL) and determining whether the first URL includes a first root name for the computer system. When a determination is made that the first URL includes the first root name for the computer system a first cookie associated with the first user is issued and a first sub-domain name is obtained from the first URL. Also, a second cookie may be issued associated with the first sub-domain name and, when the first cookie and the second cookie are issued, the first user may sign-on to the computer system. In one or more embodiments, the method may include receiving a sign-out request.