Identity Provider Account Provisioning Optimization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for managing user accounts in hosted applications often result in over-provisioning, where accounts are created before actual use, and deprovisioning is not efficiently handled, leading to resource wastage and inefficiency.
Innovation Solution
A method where an identity provider, sharing a trust relationship with the application provider, receives authentication requests, determines access rights, and triggers provisioning or deprovisioning of user accounts only when necessary, using existing protocols and interfaces to optimize account management without requiring intervention from the application provider.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If user accounts are provisioned when users obtain access rights, then users can access the application when needed, but more accounts are provisioned than actually use the application leading to resource wastage
Solution Approach 1:
The system performs preliminary provisioning of user accounts when users obtain access rights, but optimizes resource usage by implementing deprovisioning mechanisms that remove accounts when users no longer need access, thus preparing the system in advance while avoiding permanent resource allocation
Solution Approach 2:
The account provisioning system transitions from static permanent allocation to dynamic temporary allocation, where accounts are created and removed based on real-time access rights and usage patterns, allowing the system to adapt its resource allocation continuously
2Productivity
If on-the-fly provisioning solutions are implemented, then account creation is optimized for actual use, but these solutions require installation on the application vendor side and depend on application provider goodwill
Solution Approach 1:
The patent introduces an identity provider as an intermediary component that mediates between the user and the hosted application, handling the complex provisioning and deprovisioning logic centrally rather than requiring modifications to each application vendor's system
Solution Approach 2:
The identity provider serves multiple functions including authentication, authorization, account provisioning, and account deprovisioning within a single unified system, eliminating the need for separate on-the-fly provisioning solutions at each application vendor
3Reliability
If user rights and roles manager is used for provisioning, then deprovisioning is performed when rights loss is known, but provisioning cannot be optimized accurately for actual use
Solution Approach 1:
The system implements a feedback mechanism where the identity provider continuously monitors user access patterns and rights changes, using this feedback information to dynamically adjust provisioning decisions and optimize account creation and removal timing based on actual usage
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
A method for managing user accounts (CU) in an application (APP) of an application provider (1), comprising the following steps, carried out by an identity provider (2) having a trust relationship with the application provider (1): receiving (24, 44) a request for proof of authentication (PAT) in order to authenticate a user (USR) attempting to access the application (APP), said user (USR) being registered with the identity provider (2) - obtaining (25, 45), from a local database (3), data about the user (USR), said data comprising authentication data (DAT) and access rights data (DAC) - authenticating (26, 46) the user (USR) by means of the authentication data (DAT) - determining (27, 47) the right to access the application (APP) by the user (USR), by means of the access rights data (DAC) - determining (28, 48) the existence or absence of a user account (CU) associated with the user (USR), by querying an external database (4) managed by the application provider (1) - if the user (USR) has the right to access the application (APP) and there is no user account (CU) associated with the user (USR): - triggering (29) the provisioning of the user account (CU) at an entity (1, 9) - generating (30) a proof of authentication (PAT) associated with the user (USR) - sending (31) said proof of authentication (PAT) to the application provider (1).