Inter-Domain Access Tokens Without a Common Identity Provider
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing single sign-on (SSO) techniques assume that different systems use the same identity provider (IDP) for authentication, failing to address backend access between different domains without involving a common IDP, which is necessary for inter-domain authorization.
Innovation Solution
A method that allows a first device in a first domain to initiate a new browser session on a second device in a second domain, generating a user access token for the second device's backend, and securely transferring it to the first device's backend, enabling operations without user credentials or a common IDP in the authorization flow.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If existing SSO techniques are used assuming all systems use the same IDP, then authentication is simplified within a single domain, but inter-domain backend access cannot be enabled without involving a common IDP
Solution Approach 1:
The patent introduces an access token as an intermediary mechanism that enables communication between different domains without requiring a common IDP. The access token acts as a mediator carrying authentication and authorization information between the first domain's backend and the second domain's backend, resolving the contradiction by enabling inter-domain access while maintaining domain independence
Solution Approach 2:
The patent segments the authentication and authorization functions across different domains. Instead of requiring a single common IDP for all domains, each domain maintains its own IDP and authentication flow, while using access tokens to bridge the gaps between domains. This segmentation enables inter-domain access without increasing overall system complexity
2Ease of operation
If a common IDP is required for all domains, then authentication consistency is maintained, but backend access between different domains without common IDP involvement is prevented
Solution Approach 1:
The access token serves as a reliable intermediary that carries authentication information from one domain to another. It ensures that backend access operations can proceed with proper authentication and authorization while maintaining the independence of individual domain IDPs, thus preserving both ease of operation and authentication reliability
3Productivity
If user credentials are required for each domain access, then authentication security is maintained, but user experience and access efficiency deteriorate
Solution Approach 1:
The patent performs preliminary authentication actions within each domain using their respective IDPs before enabling backend access. The access token is generated in advance containing necessary authentication and authorization information, allowing subsequent backend access operations to proceed efficiently without requiring users to re-authenticate or provide credentials repeatedly, thus improving productivity while maintaining security
Data Source
AI summary
Techniques are provided for inter-domain access using an identity provider. One method comprises receiving, by a first domain, a request from a device of a second domain, different than the first domain, that requires the first domain to perform an operation on the second domain; providing, by the first domain, in response to the received request, (i) an access identifier, (ii) a destination identifier of the first domain and (iii) a redirection instruction, wherein the redirection instruction redirects the device to an identity provider associated with the second domain to validate the device, and wherein the second domain, in response to the device being validated, generates an access token; receiving, by the first domain, from the second domain, using the destination identifier of the first domain, the access token and the access identifier; and performing, by the first domain, the operation on the second domain using the access token.