Intermediary Authentication for Java EE and OAuth Scope Integration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication and authorization mechanisms in Java EE and OAuth systems are cumbersome and error-prone when modifying protected applications to support access based on both user roles and scopes of rights, requiring complex configuration and multiple authentication methods.
Innovation Solution
A system that receives an access token from an application client, retrieves grant information including user roles, groups, and intersecting scopes of rights, and establishes a session based on these to determine accessible APIs, allowing seamless integration of Java EE and OAuth authentication mechanisms without modifying the protected application.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a protected application is modified to support both user roles and scopes of rights authentication, then the application can provide comprehensive access control, but the configuration becomes tiresome and error prone
Solution Approach 1:
The patent introduces an intermediary component that sits between the application client and the protected application. This intermediary handles the complex authentication logic by receiving access tokens, validating them against both user roles and scopes of rights, and establishing sessions without requiring the protected application to be modified. This mediator approach resolves the contradiction by externalizing the complex authentication mechanism.
Solution Approach 2:
The patent segments the authentication system into distinct components: access token validation, grant information retrieval, user role verification, scope of rights verification, and session establishment. By dividing the complex authentication process into separate, manageable segments, the system can support multiple authentication mechanisms without creating configuration errors in a single monolithic system.
2Adaptability or versatility
If Java EE specification is used for authentication and authorization, then user roles can be managed, but scopes of rights cannot be implemented
Solution Approach 1:
The patent merges Java EE's user role-based authentication with OAuth's scope-based authorization into a unified authentication mechanism. The system combines grant information from both paradigms, creating a hybrid approach that leverages the strengths of both specifications without requiring the protected application to be modified. This merging allows simultaneous support for user roles and scopes of rights.
Solution Approach 2:
The patent creates a universal authentication mechanism that can handle both user roles (from Java EE) and scopes of rights (from OAuth) through a single interface. The authentication system becomes multi-functional, supporting multiple authorization models without requiring separate implementation paths or application modifications.
3Adaptability or versatility
If OAuth mechanism is used for delegated authorization, then scopes of rights can be granted, but user roles cannot be recognized
Solution Approach 1:
The patent merges OAuth's delegated authorization mechanism with Java EE's user role recognition. The system combines scope validation and user role verification into a unified authentication flow, where both user roles and scopes of rights are recognized and enforced simultaneously without requiring separate authentication mechanisms.
4Ease of manufacture
If access control is implemented without modifying the protected application, then the application remains unchanged, but authentication and authorization must be handled externally
Solution Approach 1:
The patent uses an intermediary authentication system that handles all access control logic externally without modifying the protected application. The intermediary receives access tokens, validates them against user roles and scopes of rights, and establishes sessions, allowing the protected application to remain unchanged while comprehensive authentication and authorization are implemented.
Data Source
AI summary
A request from an application client is received at a protected application. The request includes an access token. A grant information associated with the received access token is retrieved. The grant information includes a plurality of intersecting scopes of rights granted to the application client. In another aspect, a session is established between the protected application and the application client. Furthermore, at least one scope of rights from the plurality of intersecting scopes of rights is determined to be mapped to at least one Application Programming Interface (API) from a number of APIs provided by the protected application.