Identity Cloud Authentication Plug-in Control Flow

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing cloud-based identity systems lack flexibility in authentication processes and do not provide users with the ability to customize the login control flow or manage sessions effectively, relying on backend API calls that limit control over login orchestration.

Innovation Solution

The implementation of customizable plug-ins that can be triggered at various points during the authentication process, such as pre-login, post-login, pre-logout, and post-logout, allowing users to inject their own code and configurations to manage authentication decisions and session control.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a closed-control authentication flow is used in identity systems, then authentication can be performed systematically, but flexibility is lost and users cannot customize login control flow or influence login decisions

Engineering Contradiction:

Improveauthentication flow controlVSAvoidauthentication customization

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The authentication flow is segmented into distinct phases (pre-authentication, authentication, post-authentication) with defined entry and exit points. Plug-ins can be registered for specific phases, allowing customization without disrupting the overall systematic flow. The system divides control into modular segments that can be independently configured.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Plug-ins act as intermediary components between the user and the authentication system. They provide a mechanism for users to inject custom code that influences authentication decisions without directly modifying the core authentication flow. The plug-in architecture serves as a mediator layer that enables customization while preserving system integrity.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If back end API calls are used for pre-authentication and post-authentication control, then some control is provided, but complete control for login orchestration and session management is not achieved

Engineering Contradiction:

Improvepre-authentication controlVSAvoidlogin orchestration control

Core Design Contradiction:

Ease of operationVSAdaptability or versatility

Solution Approach 1:

The system transitions from static back-end API calls to dynamic plug-ins that can be executed at multiple points in the authentication flow. Plug-ins can be triggered based on runtime conditions and can dynamically influence authentication outcomes. The control mechanism becomes adaptable rather than fixed, allowing for more versatile login orchestration.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system enables preliminary actions through pre-authentication plug-ins that execute before the main authentication process. Users can perform preparatory tasks such as setting up session parameters, validating credentials preliminarily, or configuring authentication context before the actual authentication occurs, providing complete control over login orchestration.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If standard identity solutions are implemented, then authentication can be performed, but users cannot create sessions on the user browser or clear data during logout

Engineering Contradiction:

Improveauthentication functionalityVSAvoidsession management control

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The plug-in architecture enables users to write and deploy their own code for session management. Users can create custom session handling logic, implement browser-specific session creation, and define custom logout behaviors. The system allows users to serve their own session management needs through plug-ins rather than relying on fixed provider functionality.

Inventive Principle:

Principle #25Self-service

4Adaptability or versatility

If users are given the ability to inject custom code and configurations, then complete control over authentication is achieved, but system security and provider risks may increase

Engineering Contradiction:

Improveauthentication controlVSAvoidsystem security risks

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The system implements feedback mechanisms where plug-in executions are monitored and their results fed back to the authentication system. The system can validate plug-in outputs, enforce security policies on plug-in behavior, and adjust authentication flow based on plug-in feedback. This closed-loop control allows custom code execution while maintaining security through continuous validation and policy enforcement.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS12238101B2Customizing authentication and handling pre and post authentication in identity cloud service

Publication Date: 2025.02.25 ORACLE INT CORP

AI summary

Techniques are provided for customizing authentication and for handling pre-authentication and post-authentication plug-ins in an access management system. Users may want to access a protected resource, such as an application, and apply customizations to the protected resource. The customizations can be applied through the use of plug-ins, such as pre-authentication and post-authentication plug-ins. After it is determined that the user has permissions to apply a specified plug-in, analysis is performed to ensure that the plug-in complies with system requirements and that the criteria for implementing the plug-in has been satisfied. A browser session and control of the application can then be forwarded to the user.