OAuth Authorization Server Decoupling Third-Party Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing OAuth implementations are limited to co-located authorization and authentication servers, making it difficult to separate and reuse authentication/authorization services with third-party servers, which restricts flexibility and customization in accessing protected resources.
Innovation Solution
A system and method that enable communication with remote, non-co-located third-party authentication servers through a custom authentication/authorization flow, allowing integration of various authentication mechanisms and enabling operators to use custom identity management systems or delegate authentication services, thereby supporting granular control over access to subscriber information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If OAuth implementations use co-located authorization and authentication servers, then the system maintains simplicity and strong coupling, but it becomes difficult to separate and reuse authentication services with third-party servers
Solution Approach 1:
The patent divides the previously coupled authorization and authentication servers into separate, independent components. The authorization server handles OAuth token issuance while the authentication server verifies credentials, allowing them to be deployed independently or as third-party services without affecting each other's functionality.
Solution Approach 2:
The patent introduces an intermediary authentication server that acts as a bridge between the OAuth authorization flow and third-party authentication mechanisms. This intermediary component enables communication between the authorization server and external authentication services without requiring direct integration, thus maintaining system simplicity while enabling versatility.
2Adaptability or versatility
If OAuth protocol uses standardized authorization flow, then the system maintains compatibility and ease of operation, but it lacks flexibility in supporting custom authentication mechanisms
Solution Approach 1:
The patent implements a dynamic authentication system where the authentication server can adapt its verification methods based on the type of credentials presented. It supports multiple authentication mechanisms (passwords, certificates, biometrics, third-party tokens) and automatically selects the appropriate verification process, maintaining ease of operation while providing extensive flexibility.
Solution Approach 2:
The authentication server is designed with universal functionality to handle diverse authentication mechanisms through a unified interface. It can verify various credential types (passwords, certificates, third-party tokens) using the same authorization flow, allowing custom authentication mechanisms to be integrated without complicating the operational process.
3Adaptability or versatility
If authentication and authorization are strongly coupled, then the system maintains integrity and reliability, but it becomes hard to separate and reuse services
Solution Approach 1:
The patent segments the authentication and authorization functions into separate servers with well-defined interfaces. The authorization server maintains integrity by strictly validating tokens issued through the OAuth flow, while the authentication server independently verifies credentials. This segmentation allows service reuse without compromising authorization integrity, as each component operates within its designated security boundaries.
Solution Approach 2:
The authentication server acts as an intermediary that preserves authorization integrity while enabling service separation. It verifies authentication credentials and communicates results to the authorization server through standardized OAuth protocols, ensuring that the authorization flow maintains its integrity even when authentication is performed by a separate, reusable service.
Data Source
AI summary
In accordance with various embodiments, systems and methods that provide for authorization of access to protected resources. Such a system can include a plurality of applications, executing on one or more application servers. The system can also include an authorization server which is operable to interface with one or more remote and/or non-co-located third party authentication servers. Each application can (a) receive a request for authorization to access a controlled resource; (b) redirect the request for authorization to a configurable authentication endpoint identifying a third party authentication server; (c) receive authorization information from the third party authorization server; and (d) issue an authorization code for access to the protected resource.