Identity Broker Service for Multi-Protocol Authentication Federation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge lies in efficiently modifying existing authentication systems to accommodate different authentication protocols, which can be costly and introduce security vulnerabilities due to the variety of authentication protocols used by different identity providers.
Innovation Solution
A method where a first identity provider application creates a session with session data and sends an indication to a second identity provider application, allowing the second identity provider to authenticate the user using its protocol, and then the first identity provider authenticates the user using its own protocol, enabling identity federation across different services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If an existing service is modified to support a different authentication protocol, then authentication versatility is improved, but development costs and security risks increase
Solution Approach 1:
The patent introduces a broker service as an intermediary component that sits between the authentication requestor and multiple identity providers. This broker receives authentication requests, determines which identity provider to use based on configuration, and manages the authentication flow. By adding this intermediary layer, the system gains the ability to support multiple authentication protocols without modifying existing identity provider implementations, thus resolving the contradiction between versatility and modification cost.
Solution Approach 2:
The broker service is designed with multi-functional capabilities to handle different authentication protocols (SAML, OAuth, OpenID Connect) through a unified interface. It can authenticate users against multiple identity providers using different protocols while presenting a consistent authentication experience to clients. This universal design allows the system to support various authentication protocols without requiring separate specialized components for each protocol.
2Adaptability or versatility
If multiple authentication protocols are implemented directly in existing services, then authentication versatility is improved, but system complexity increases
Solution Approach 1:
The patent segments the authentication system into distinct functional components: the broker service, identity providers, and client applications. Each component has a specific responsibility - the broker manages protocol routing and coordination, identity providers handle protocol-specific authentication logic, and clients interact through a unified interface. This segmentation prevents any single service from becoming overly complex while maintaining support for multiple authentication protocols.
Solution Approach 2:
The broker acts as a mediator that abstracts the complexity of multiple authentication protocols from existing services. It handles protocol determination, parameter translation, and coordination between different authentication systems, allowing existing services to maintain their original simplicity while the system as a whole achieves multi-protocol capability.
3Reliability
If authentication services are customized for each identity provider, then authentication reliability is improved, but ease of operation deteriorates
Solution Approach 1:
The broker service implements automatic identity provider selection based on configured rules and request characteristics. It self-determines which identity provider to use for each authentication request without requiring manual intervention or complex configuration for each scenario. The system can automatically adapt to different authentication scenarios while maintaining reliable protocol-specific authentication through its configured identity provider mappings.
Data Source
AI summary
Methods and systems for authentication using multiple identity providers are described herein. A first identity provider may receive, e.g., from a second identity provider, an indication of an authentication request. The first identity provider may retrieve, from a storage device, session information associated with the request. The first identity provider may authenticate, using one or more first functions, based on the session information, and based on authentication credentials received from a user, the user. Based on the authentication, the first identity provider may modify the session information. The second identity provider may authenticate, based on the session information and using one or more second functions, the user. The one or more second functions may comprise providing the user a token based on the session information. The session information may be subsequently deleted.