Identity Federation Module for Web Application Token Translation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing identity federation systems require web application developers to manage complex security tokens and infrastructure, distracting them from core business functions and necessitating continuous updates, with HTTP header tokens becoming cumbersome to handle.
Innovation Solution
An identity federation and security token translation module that allows direct integration with web applications or IIS, enabling token management without code changes, by requesting and validating tokens from a security token service, building a custom security principal object, and storing it in a data cache, thus isolating security management from application development.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a web service proxy server is used for identity federation, then security token management is achieved, but developer complexity and maintenance burden increase
Solution Approach 1:
The patent introduces an identity federation module as an intermediary component that sits between the web application and the security token service. This module handles all security token management operations, translating vendor-specific tokens into a standardized format that the web application can consume. By positioning this intermediary layer, the complex security management logic is isolated from the web application code, allowing developers to focus on business logic while the module handles security complexity.
Solution Approach 2:
The patent segments the security management functionality into a separate, modular identity federation component that can be independently configured and maintained. This segmentation allows the security token management to be handled by a dedicated module rather than being embedded throughout the web application codebase, reducing overall system complexity and improving maintainability.
2Reliability
If vendor specific security tokens are used, then authentication is achieved, but adaptability and ease of operation decrease
Solution Approach 1:
The patent implements a universal token translation mechanism that can handle multiple vendor-specific security token formats (such as SAML, JWT, OAuth) and convert them into a unified internal representation. The identity federation module provides a single interface that works with various token types, making the system adaptable to different authentication providers without requiring changes to the web application code. This multi-functionality allows the same module to support diverse authentication mechanisms while maintaining consistent behavior.
3Loss of information
If HTTP header tokens are used for user identification, then user access information is transmitted, but token size becomes too large and difficult to handle
Solution Approach 1:
The patent extracts the detailed user profile and fine-grained access control information from the HTTP header tokens and stores it in server-side session state or database. The HTTP headers contain only essential authentication identifiers, while the identity federation module retrieves detailed user information from secure storage as needed. This extraction reduces token size and simplifies header transmission while maintaining full access control capabilities through server-side data retrieval.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An identity federation and security token translation module and method for operable engagement with a web application or an internet information service (IIS). A first server includes computer-executable instructions defining the identity federation and security token translation module for managing and facilitating a creation of a custom security principal object for a user requesting access to the web application. A data cache stores the custom security principal object in a non-transitory computer readable media. The identity federation and security token translation module may be changed without making changes to the web application or the IIS.