OAuth/OIDC Registration Flow Using Context-Based Credential Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing OAuth and OIDC protocols are silent on how users obtain credentials during the authorization flow, leading to a poor user experience for those interacting with an authorization server for the first time, especially when they do not have credentials.

Innovation Solution

Implementing a platform, language, and cloud-agnostic OAuth or OIDC optimized registration module that identifies users based on context information, prompts for credentials if needed, and facilitates seamless credential creation or login, followed by generating token data for resource access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional OAuth/OIDC authorization flow is used, then security and standard compliance are improved, but user experience deteriorates for first-time users without credentials

Engineering Contradiction:

ImprovesecurityVSAvoiduser experience

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The system performs preliminary detection of user credentials status before the authorization flow begins. By identifying whether a user has credentials in advance (through context information analysis), the system can prepare the appropriate flow path, preventing the poor user experience that occurs when first-time users unexpectedly encounter authorization requirements without understanding how to proceed.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system dynamically adapts the authorization flow based on the detected credential status of the user. Instead of a static, one-size-fits-all authorization process, the flow transforms into different paths: one for authenticated users and another for first-time users, allowing the system to maintain security while providing appropriate guidance and registration options to users without credentials.

Inventive Principle:

Principle #15Dynamics

2Ease of manufacture

If separate registration flow is implemented before authorization, then credential management is improved, but process complexity and time consumption increase

Engineering Contradiction:

Improvecredential managementVSAvoidprocess complexity

Core Design Contradiction:

Ease of manufactureVSDevice complexity

Solution Approach 1:

The system merges the registration functionality with the authorization flow by detecting credential status and dynamically routing users. Instead of requiring a separate pre-registration step, the system combines credential creation and authorization into a unified flow where registration occurs naturally within the authorization context, reducing both process complexity and time consumption while maintaining proper credential management.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The authorization server is enhanced with multi-functionality, serving both as an authorization endpoint and a registration endpoint based on user needs. The same authorization infrastructure handles both authenticated users (standard flow) and unauthenticated users (guided registration flow), eliminating the need for separate registration systems and reducing overall process complexity.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Adaptability or versatility

If OAuth/OIDC protocol specifications are followed strictly, then standard compliance is improved, but adaptability to first-time user scenarios deteriorates

Engineering Contradiction:

Improveprotocol complianceVSAvoiduser experience

Core Design Contradiction:

Adaptability or versatilityVSEase of operation

Solution Approach 1:

The system introduces an intermediary detection and routing layer between the user and the authorization server. This intermediary component analyzes context information to detect credential status and mediates the interaction by directing first-time users to appropriate registration resources while guiding authenticated users through the standard authorization flow, thereby maintaining protocol compliance while adapting to diverse user scenarios.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS12531852B2System, method, and computer program for OAuth or OIDC optimized registration

Publication Date: 2026.01.20 JPMORGAN CHASE BANK NA

AI summary

Various methods, apparatuses/systems, and media for optimizing user experience for a customer who is interacting with an authorization server are disclosed. A resource server provides corresponding context information when passing the customer to an authorization server. The context information is used by the authorization server to identify the customer in context, and once identified, the authorization server determines whether the customer has credentials or not. When it is determined that the customer is not a new customer and has credentials, he/she is prompted to login. When it is determined that the customer is a new customer, he/she is prompted to create an account first and then create digital identity and associated credentials. Existing customer without credentials is prompted to follow a registration flow to provision credentials. Once credentials have been created, the customer is automatically logged in and the authorization flow continues to a consent step for completing a transaction.