Identity Provider Instance Discovery Service Automation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In federated environments, existing identity provider discovery methods are inefficient as they require manual user selection and do not automatically bind users to the optimal identity provider instance based on criteria such as proximity, load, or availability, leading to suboptimal authentication processes.
Innovation Solution
An identity provider instance discovery service (IdPIDS) automatically selects an identity provider instance from a set of instances based on criteria like user proximity, instance load, availability, and existing bindings, ensuring optimal instance selection for authentication processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If manual user selection of identity provider is used, then user flexibility is maintained, but authentication efficiency and automation are reduced
Solution Approach 1:
The discovery service automatically performs instance selection without requiring user intervention. The system self-determines the optimal identity provider instance based on predefined criteria such as user proximity, instance load, and availability, thereby automating the authentication routing process while maintaining operational simplicity for users.
Solution Approach 2:
The system continuously monitors instance status including load metrics and availability information, using this feedback to dynamically select the most appropriate identity provider instance. This feedback mechanism enables automated decision-making that adapts to current system conditions without manual user input.
2Reliability
If multiple identity provider instances are deployed for scalability, then system availability improves, but instance selection complexity increases
Solution Approach 1:
A discovery service acts as an intermediary between the service provider and multiple identity provider instances. This mediator handles the complexity of instance selection by evaluating multiple instances against predefined criteria and presenting a single recommended instance to the service provider, thereby simplifying the overall architecture while supporting multiple instances for improved reliability.
Solution Approach 2:
The system uses configurable selection criteria parameters such as user proximity, instance load thresholds, and availability requirements to manage the complexity of multi-instance selection. By adjusting these parameters, the system can optimize instance selection based on current conditions without increasing operational complexity.
3Productivity
If automatic instance selection based on multiple criteria is implemented, then authentication efficiency improves, but discovery service complexity increases
Solution Approach 1:
The discovery service is pre-configured with selection criteria and thresholds before operation. Instance evaluation rules, proximity calculations, and load assessment parameters are established in advance, allowing the service to quickly evaluate multiple instances and make automated selection decisions without complex real-time computations, thereby improving authentication throughput.
Solution Approach 2:
The instance selection process is segmented into distinct evaluation stages: proximity assessment, load evaluation, and availability verification. Each stage independently assesses a specific criterion, and the combined results determine the optimal instance. This segmentation simplifies the overall service architecture by breaking down the complex selection process into manageable, independent evaluation modules.
Data Source
AI summary
A method of discovering an identity provider instance according to this disclosure begins upon receipt from a service provider (or from a discovery service to which the service provider redirects the user) of a request for an IdP instance. Preferably, the request for an IdP instance is received as a Web services request following receipt at the service provider of an end user client request to access an application. In response to receiving the request, an IdP instance is selected, preferably using one or more criteria, such as user proximity, instance load, instance availability, the existence of a prior IdP binding, or the like. Following the selection, a response to the request is generated and returned to the requesting service provider. Preferably, the response is a redirect to the selected IdP instance.