Multitenant Resource Broker for Secure Single Sign-On
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multitenant environments, existing solutions struggle to implement single sign-on authentication securely without compromising native security boundaries, often granting users visibility into other domains, which poses a security risk and complicates resource management.
Innovation Solution
A method and system that maintain a domain information cache to resolve user credentials to their associated authentication server, allowing for secure single sign-on access to authorized resources without requiring users to specify their domain, while preserving independent security boundaries across managed domains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If single sign-on authentication is implemented in a multitenant setting, then user access efficiency is improved, but security boundaries between domains are compromised
Solution Approach 1:
The patent introduces a resource broker as an intermediary component between clients and resources. The broker handles authentication and authorization decisions, enabling single sign-on while maintaining security boundaries. Each domain has its own authentication server that authenticates users independently, and the broker mediates access requests to ensure users can access resources across domains without compromising their security boundaries.
2Ease of operation
If users are given visibility into other domains for single sign-on, then authentication convenience is improved, but security risks increase
Solution Approach 1:
The patent implements local quality by maintaining independent authentication servers for each domain and allowing users to be authenticated in their home domain without automatically gaining visibility into other domains. The resource broker enforces access control policies that permit or deny access to specific resources based on user credentials and domain relationships, ensuring that authentication convenience does not translate to unauthorized visibility.
3Reliability
If independent security boundaries are maintained across domains, then security is improved, but single sign-on implementation becomes more complex
Solution Approach 1:
The resource broker serves multiple functions: it acts as an authentication intermediary, an authorization decision point, and a resource access mediator. This universal component handles diverse authentication scenarios across multiple domains through a single unified architecture, reducing implementation complexity while maintaining independent security boundaries. The broker can work with different authentication servers and domain configurations without requiring domain-specific custom code.
Data Source
AI summary
In one embodiment, a method includes maintaining a domain information cache. The method further includes receiving credentials from a client system. The credentials correspond to a user of the client system. The method also includes storing the credentials in a security cookie. In addition, the method includes, based, at least in part, on the domain information cache, resolving the credentials to an authentication server associated with a domain of the user. Also, the method includes authenticating, using the credentials, an identity of the user with the authentication server. Additionally, the method includes, responsive to successful authentication, building a list of groups and users to which the user belongs. Moreover, the method includes compiling a list of authorized resources to which the user has access. In addition, the method includes providing the list of authorized resources to the client system.