Intercepting Proxy for Federated SSO in Cloud Reverse Proxies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Reverse Proxy servers are inadequate for managing access to a heterogeneous mix of web servers with unique URLs and disparate services, particularly in cloud environments, as they struggle to operate simultaneously with federated Single Sign-On (SSO) strategies, requiring separate setups for each cloud and hindering direct communication between Identity Providers and cloud applications.
Innovation Solution
A modified Reverse Proxy system, referred to as PerspecSys Reverse Proxy, acts as an Intercepting Proxy, inserting itself into the authentication conversation between the SSO Identity Provider and the Cloud application, enabling federated SSO while managing access by converting and encrypting assertions, and modifying URLs to facilitate secure access across multiple service providers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a conventional Reverse Proxy is used to manage access to cloud applications, then access control and monitoring are provided, but federated Single Sign-On (SSO) functionality is blocked and direct communication between Identity Providers and cloud applications is interrupted
Solution Approach 1:
The patent implements an Intercepting Proxy that acts as a mediator between the client, Reverse Proxy, and cloud applications. The Intercepting Proxy captures authentication requests, modifies them to bypass the Reverse Proxy's URL rewriting, and forwards them directly to the cloud applications, enabling federated SSO while maintaining access control through the Reverse Proxy for non-authentication traffic
Solution Approach 2:
The system segments the proxy functionality into two distinct components: a conventional Reverse Proxy for access control and URL rewriting, and an Intercepting Proxy for SSO authentication. This segmentation allows each component to perform its specific function without interfering with the other, resolving the contradiction between access control and SSO compatibility
2Reliability
If separate Reverse Proxies are set up for each cloud application to manage access, then access control is maintained, but system complexity increases and scalability is reduced
Solution Approach 1:
The Intercepting Proxy is designed as a universal solution that can handle authentication for multiple cloud applications simultaneously. It intercepts and modifies authentication requests for any cloud application behind the Reverse Proxy, eliminating the need for separate proxy setups for each application and reducing overall system complexity
3Ease of operation
If the Reverse Proxy rewrites all URLs to its own address, then proxy functionality is maintained, but direct communication paths for authentication are lost
Solution Approach 1:
The Intercepting Proxy performs preliminary action by capturing authentication requests before they reach the Reverse Proxy's URL rewriting logic. It modifies the requests to preserve original URL information and directs them through an alternative path that bypasses the rewriting, ensuring that authentication communications maintain their original destination information
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
A Security Assertion Markup Language (SAML) conversation is intercepted in an enhanced Reverse Proxy server computer located between a user and a server computer that provides cloud application services to the user. During authentication, the SAML assertion signature is modified in the enhanced Reverse Proxy such that the modified assertion signature permits the user to be authenticated, and subsequently to communicate via the enhanced Reverse Proxy in a secure session with an application in the server. The Reverse Proxy is configured to access hosts of multiple domains for handling client requests. A request from a client to any of the supported hosts in the cloud is addressed to the domain of the reverse proxy server, including a path formatted to include the target host domain coded as a short form name which is converted in the Reverse Proxy to the URL of the target host.