Identity Provider Discovery Proxy Using Publish-Subscribe Caching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing identity provider instance discovery services in federated environments rely on a 'pull-based' approach, which can be inefficient and time-consuming, especially in geographically distributed setups, as they require frequent requests to external services for instance location and availability information.
Innovation Solution
Integration of a discovery service proxy within the F-SSO environment that caches instance assignments and uses a publication-subscription model to proactively receive updates from an external identity provider instance discovery service, reducing the need for frequent requests and enhancing response times.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If a pull-based approach is used for identity provider instance discovery, then the service can obtain instance location and availability information, but the time required to identify the appropriate identity provider instance increases
Solution Approach 1:
The discovery service proxy pre-fetches and caches identity provider instance information before it is actually needed. By proactively retrieving instance location and availability data in advance and storing it locally, the system eliminates the need for time-consuming pull-based requests at the moment of discovery, thus reducing identification time while improving efficiency
Solution Approach 2:
A discovery service proxy is introduced as an intermediary component between the service provider and the identity provider instances. This proxy maintains a local cache of instance information and handles discovery requests locally when possible, reducing the time and overhead of direct pull-based queries to external services while maintaining accurate instance information
2Reliability
If frequent requests are made to external services for instance information, then the cache remains updated, but the system becomes less efficient and more time-consuming
Solution Approach 1:
Instead of making frequent pull-based requests, the system implements periodic push-based updates where the identity provider instance discovery service sends information to the proxy at predetermined intervals. This maintains reliable, up-to-date instance information in the cache while eliminating the time waste of frequent active polling requests
Solution Approach 2:
The system establishes a feedback mechanism where the identity provider instance discovery service actively pushes updates to the proxy when instance information changes. This feedback loop ensures the cache remains accurate and current without requiring frequent requests from the proxy, thus maintaining reliability while reducing time consumption
Data Source
AI summary
A proxy is integrated within an F-SSO environment and interacts with an external identity provider (IdP) instance discovery service. The proxy proxies IdP instance requests to the discovery service and receives responses that include the IdP instance assignments. The proxy maintains a cache of the instance assignment(s). As new instance requests are received, the cached assignment data is used to provide appropriate responses in lieu of proxying these requests to the discovery service, thereby reducing the time needed to identify the required IdP instance. The proxy dynamically maintains and manages its cache by subscribing to updates from the discovery service. The updates identify IdP instance changes (such as servers being taken offline for maintenance, new services being added, etc.) occurring within the set of geographically-distributed instances that comprise the IdP service. The updates are provided via a publication-subscription model such that the proxy receives change notifications proactively.