JWT Artifact Wrapping for Secure SSO Token Transmission
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In a distributed system, security tokens used for Single Sign On (SSO) services may fail to pass through gateways that require authentication or validation, preventing seamless SSO due to the inability of gateways to retrieve or validate tokens with artifacts, which are only resolvable by specific connection servers.
Innovation Solution
Embedding the artifact within a JSON Web Token (JWT) access token, ensuring the artifact is extracted and resolved between the connection server and identity provider, allowing the assertion to permit access to resources without exposing security information to gateways.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security tokens are sent directly through gateways for SSO service, then authentication information can be transmitted, but gateways cannot validate tokens with artifacts and block the transmission
Solution Approach 1:
The patent introduces an intermediary resolution service that sits between the gateway and the connection server. This service receives artifact resolution requests from the gateway, forwards them to the connection server, and returns the resolved security token assertions. This intermediary layer allows the gateway to validate tokens without needing direct access to the connection server's artifact resolution capability, thus enabling reliable SSO transmission through the gateway.
2Reliability
If artifacts are made resolvable by gateways, then token validation can occur, but sensitive user information may be exposed to untrusted intermediaries
Solution Approach 1:
The patent segments the artifact resolution process into two distinct phases: (1) The gateway validates the token structure and extracts the artifact reference without accessing the actual user information, and (2) The resolution service separately retrieves the full security token assertions from the connection server using the artifact. This segmentation allows validation to occur without exposing sensitive user data to the gateway, as the gateway only handles the non-sensitive artifact reference.
Solution Approach 2:
The resolution service acts as a trusted intermediary that the gateway cannot bypass. The gateway sends artifact resolution requests to this service, which then communicates with the connection server to obtain the actual token assertions. This intermediary architecture ensures that even if the gateway is untrusted, it cannot directly access sensitive user information stored on the connection server, as all access must go through the controlled resolution service.
3Object-affected harmful factors
If artifacts are resolved only by connection servers, then security is maintained, but gateways cannot validate security tokens
Solution Approach 1:
The patent introduces a resolution service as an intermediary that the gateway can call to validate tokens. This service maintains the security model by requiring all artifact resolution to go through it, while simultaneously enabling gateway validation by providing a public interface for token verification. The gateway validates tokens by requesting artifact resolution through this service, which then obtains the actual token assertions from the connection server and returns them to the gateway for validation.
Data Source
AI summary
Disclosed is a system and technique for validating a user for a single sign on without exposing secure information about the user to any part of the system except the connection server and the identity provider. In the technique, instead of relying directly on a SAML assertion, the technique uses an artifact representing the assertion and wraps the artifact in an access token. The access token is able to carry the artifact through one or more gateways on its way to a connection server without revealing any security information. Upon the access token being verified by either the gateway or the connection server, the artifact can be extracted from the access token and verification of the user for the single sign on can proceed between only the connection server and the identity provider.