IAM Proxy Server Bypasses Browser Cross-Domain Restrictions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Identity and Access Management (IAM) systems face challenges in enabling single sign-on across multiple information systems due to security restrictions in browsers, which prevent cross-domain submission of form data, thereby hindering automatic login to target applications.
Innovation Solution
The IAM system rewrites access requests to include proxy domain name information, allowing a proxy server to parse and determine the target application's domain name, and then obtains and sends login credentials to the application server, bypassing cross-domain submission restrictions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If the IAM system uses JavaScript script to submit account and password information to the target application server, then automatic login can be achieved, but browser security restrictions prevent cross-domain form submission
Solution Approach 1:
The patent introduces a proxy server as an intermediary between the IAM system and the target application server. The proxy server receives requests from the IAM system, forwards them to the target application server, and handles the domain name translation and authentication credential transmission. This mediator approach allows the IAM system to automatically authenticate users without direct cross-domain form submission, resolving the browser security restriction issue while maintaining automatic login functionality.
2Reliability
If users set different login passwords for each information system, then security risks are reduced, but it becomes difficult to remember and manage passwords
Solution Approach 1:
The patent implements a universal authentication mechanism where the IAM system serves as a single sign-on gateway for multiple target applications. Users authenticate once against the IAM system using their credentials, and the IAM system then provides authentication credentials for accessing various target applications. This multi-functional approach eliminates the need for users to manage separate passwords for each application while maintaining security through centralized authentication management.
3Adaptability or versatility
If the IAM system rewrites access requests to include proxy domain name information, then cross-domain submission restrictions are bypassed, but the system complexity increases
Solution Approach 1:
The patent segments the authentication and access control functions into separate components: the IAM system handles authentication credential generation, the proxy server handles request rewriting and domain name translation, and the target application servers handle the actual service logic. This segmentation allows each component to have well-defined responsibilities, making the overall system more manageable despite the added complexity of the request rewriting mechanism.
Data Source
AI summary
The disclosure provides a method, an apparatus, a computer device and storage medium for application access control. The method includes: receiving, by an IAM system, a first access request for accessing a target application managed by the IAM system; and rewriting, by the IAM system, the first access request to obtain a second access request comprising proxy domain name information; obtaining, by a proxy server, the second access request, and parsing the proxy domain name information to determine the domain name information of the target application; based on the need for login authentication information, obtaining login account information and obtaining login authentication information input by the user; and sending a login request to an application server corresponding to the target application.