Local Identity Provider for Offline Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In hybrid industrial software environments, on-premises systems face operational risks when disconnected from the cloud, as they rely on cloud-based authentication and authorization to function, leading to potential safety issues and production losses.
Innovation Solution
Implementing a local identity provider on the on-premises system to cache user identities and subscription information, enabling fallback authentication and authorization when cloud connectivity is lost, thus ensuring continuous plant-floor operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cloud-based authentication is used for centralized management, then authorization control is improved, but system availability deteriorates when cloud connectivity is lost
Solution Approach 1:
The authentication system is segmented into two independent components: cloud-based authentication service and local identity provider. The local identity provider is cached on-premises and can independently authenticate users when cloud connectivity is unavailable, while still syncing with the cloud when connected. This segmentation allows the system to maintain authentication capability locally without compromising centralized management when online.
Solution Approach 2:
The local identity provider data is preliminarily cached on the on-premises system during periods when cloud connectivity is available. This preliminary action stores authentication data locally in advance, enabling the system to perform authentication operations independently when cloud connectivity is lost, thus resolving the contradiction between centralized control and local availability.
2Ease of operation
If on-premises systems require cloud connectivity for authentication, then centralized security management is improved, but operational continuity deteriorates during network outages
Solution Approach 1:
The local identity provider acts as an intermediary between users and the cloud authentication service. When cloud connectivity is available, it mediates by forwarding authentication requests to the cloud. When connectivity is lost, it independently mediates authentication using cached data, ensuring operational continuity without sacrificing authentication reliability.
3Reliability
If local authentication is implemented for offline operation, then system availability is improved, but security control deteriorates
Solution Approach 1:
The authentication system dynamically adapts its operation mode based on cloud connectivity status. When connected, it operates in cloud-dependent mode with full centralized security control. When disconnected, it dynamically switches to offline mode using the local identity provider, maintaining system availability while accepting temporary local authentication, thus balancing security and availability dynamically rather than statically.
Data Source
AI summary
After receiving a request to authenticate a user of a system, which is local to the user and connected to a cloud's platform, the cloud's local identity provider authenticates the user based on identifying the user's cloud identity from cloud identities associated with subscriptions to access an application. The cloud's usage service authorizes the cloud-authenticated user to access the application based on the subscription associated with the user's cloud identity. The system matches the user's system identity with the user's cloud identity. If the system is not connected to the cloud's platform, the system's identity manager authenticates the user based on identifying the user's system identity from system identities matched with cloud identities. The system's usage service authorizes the system-authenticated user to access the application based on the subscription associated with the cloud identity matched with the user's system identity.