OAuth Callback URL Substitution via Proxy Service

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing OAuth protocols require re-registration of applications with a trusted identity service whenever the application hosting site changes, leading to increased demand for computer resources, network bandwidth, and developer intervention, which is impractical in dynamic computing environments.

Innovation Solution

Implementing a proxy service that manages application hosting site changes by registering a publicly-addressable proxy server during initial registration, allowing the proxy server to forward authentication messages and access tokens to dynamically assigned application nodes, thus eliminating the need for re-registration.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If OAuth protocol requires re-registration whenever application hosting site changes, then application authentication reliability is maintained, but computer resource consumption and network bandwidth usage increase significantly

Engineering Contradiction:

Improveapplication authentication reliabilityVSAvoidcomputer resource consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent introduces a callback URL substitution mechanism that acts as an intermediary between the application and the OAuth service. Instead of directly re-registering the application when the hosting site changes, the system substitutes the callback URL through a standardized process, reducing the need for full re-registration and thereby decreasing computer resource consumption while maintaining authentication reliability.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If OAuth protocol requires re-registration whenever application hosting site changes, then application authentication reliability is maintained, but network bandwidth consumption increases

Engineering Contradiction:

Improveapplication authentication reliabilityVSAvoidnetwork bandwidth consumption

Core Design Contradiction:

ReliabilityVSLoss of energy

Solution Approach 1:

The callback URL substitution mechanism serves as an intermediary that reduces network traffic. When the application hosting site changes, instead of performing a complete re-registration that involves extensive data transmission, the system only needs to substitute the callback URL, significantly reducing network bandwidth consumption while preserving authentication reliability.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If OAuth protocol requires re-registration whenever application hosting site changes, then application authentication reliability is maintained, but developer intervention is required frequently

Engineering Contradiction:

Improveapplication authentication reliabilityVSAvoiddeveloper operation ease

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The callback URL substitution mechanism acts as an intermediary that automates the adaptation process when hosting sites change. Instead of requiring developers to manually re-register applications, the system handles the URL substitution automatically, reducing the frequency and complexity of developer intervention while maintaining authentication reliability.

Inventive Principle:

Principle #24Intermediary (Mediator)

4Adaptability or versatility

If application hosting site changes dynamically, then system adaptability improves, but OAuth authentication fails due to URL mismatch

Engineering Contradiction:

Improvesystem adaptabilityVSAvoidOAuth authentication reliability

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent implements a dynamic callback URL substitution mechanism that allows the system to adapt to changing hosting sites. The callback URL can be dynamically updated without requiring full re-registration, enabling the system to maintain OAuth authentication reliability even as the application hosting site changes dynamically.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The callback URL substitution mechanism serves as an intermediary layer between the static OAuth registration and the dynamic hosting site changes. This intermediary allows the system to maintain the original registration while adapting to new hosting locations through URL substitution, resolving the conflict between adaptability and authentication reliability.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS10841313B2Substituting callback URLs when using OAuth protocol exchanges

Publication Date: 2020.11.17 NUTANIX INC

AI summary

Systems for computer security. A proxy service implements methods for substituting callback uniform resource locators (URLs) when using an OAuth protocol exchange to authenticate an application. A proxy service is established at a first uniform resource locator to carry out communications between one or more identity access management servers and a plurality of application hosting sites. At least one of the plurality of application hosting sites has a second uniform resource locator that is different from the first uniform resource locator. An identity access management server will register the application and the first uniform resource locator. From any hosting site, the application is invoked, upon which invocation, the application carries out at least a portion of the OAuth protocol exchange with the IAM. The proxy service at the first uniform resource locator receives an authentication message from the IAM and then redirects the authentication message to the application hosting site.