Intermediate Claim Transformation in Federated Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In complex WS-Federation systems, managing claim transformations between multiple Identity Providers and applications becomes excessively complex due to the need for exponential growth in transformation rules, leading to administrative burdens.
Innovation Solution
Implementing an intermediate claim transformation process that transforms security claims from account store-specific formats to an intermediate format and then to a federated format recognized by resource providers, reducing the number of required transformation rules from M×N to M+N.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a different claim transformation is defined for each pair of Identity Provider and application, then claim format compatibility is achieved, but the number of transformation rules grows exponentially (M×N)
Solution Approach 1:
The patent introduces an intermediate claim format that serves as a mediator between Identity Provider claim formats and application claim formats. Instead of creating direct transformation rules between every pair of formats (M×N), the system creates transformation rules from each Identity Provider format to the intermediate format (M rules) and from the intermediate format to each application format (N rules), reducing total rules to M+N. The intermediate format acts as a universal translation layer that enables indirect transformation between any two formats.
2Adaptability or versatility
If multiple Identity Providers and applications are added to the system, then system functionality and coverage are improved, but administrative complexity increases due to exponential growth of transformation rules
Solution Approach 1:
The intermediate claim format reduces administrative complexity by providing a stable, reusable transformation layer. When new Identity Providers or applications are added, only one new transformation rule needs to be created (from the new format to/from the intermediate format), rather than requiring rules for all existing partners. This linear scaling (M+N) versus exponential scaling (M×N) dramatically reduces the administrative burden of system expansion.
3Manufacturing precision
If direct claim transformation is performed between Identity Provider and application, then transformation accuracy is maintained, but system scalability is limited due to management burden
Solution Approach 1:
The intermediate claim format maintains transformation accuracy by providing a well-defined, structured format that preserves the semantic meaning of claims while enabling systematic transformation. The intermediate format includes standardized fields (subject, predicate, object) that ensure accurate representation of claim data during transformation. This structured approach enables scalable system deployment without sacrificing transformation fidelity.
Data Source
AI summary
Systems and methods directed at transforming security claims in a federated authentication system using an intermediate format. The systems and methods described herein are directed at transforming security claims in a federated authentication system using an intermediate format. The federated authentication system includes an identity provider and a resource provider. The identity provider receives a request for information from the resource provider to authenticate an account by an application associated with the resource provider. A security claim associated with the account is retrieved where the security claim is provided by an account store in a format specific to the account store. The security claim is transformed from the account store specific format to an intermediate format. The security claim is then transformed from the intermediate format to a federated format recognized by the resource provider. The transformed security claim is provided in a security token to the resource provider. A similar two step transformation process using intermediate claims can also be implemented by the resource provider to transform security claims provided by an identity provider from a federated format to formats recognized by the applications.