OAuth Access Token Session Management via JWT
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Single Sign-On (SSO) and Open Authorization (OAuth) technologies do not seamlessly integrate, leading to challenges in session management across mixed application environments, particularly in cloud computing where OAuth access tokens lack session management capabilities.
Innovation Solution
The integration of OAuth with SSO using a JSON Web Token (JWT) that stores a session identifier, allowing session management to be performed during access token issuance, enabling OAuth access tokens to inherit SSO session properties like idle timeout and revocation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If OAuth access tokens are used for cloud resource access, then authorization capability is provided, but session management capability is lost
Solution Approach 1:
The patent merges OAuth access tokens with SSO session identifiers by embedding the session identifier within the access token structure. This combination allows the access token to carry both authorization information and session management information, enabling cloud applications to leverage enterprise SSO session management capabilities while maintaining OAuth authorization functionality.
Solution Approach 2:
The patent introduces an access token issuer as an intermediary component that bridges the OAuth authorization system and the SSO session management system. This issuer validates both the OAuth authorization request and the embedded SSO session identifier, then issues access tokens that contain references to valid SSO sessions, enabling session management in cloud environments.
2Reliability
If SSO cookies are used for enterprise application access, then session management is enabled, but compatibility with cloud resources is lost
Solution Approach 1:
The patent extracts the session identifier from the SSO cookie and embeds it within the OAuth access token. This extraction allows the session management capability to be transferred from the cookie-based SSO system to the token-based OAuth system, enabling cloud applications to access session management functionality without relying on SSO cookies.
Solution Approach 2:
The patent changes the parameter representation of session information by transitioning from cookie-based session identifiers to token-embedded session identifiers. This parameter change enables the session management mechanism to work within the OAuth protocol framework, making it compatible with cloud resource access patterns while maintaining session management capabilities.
3Ease of operation
If OAuth and SSO are used separately, then each protocol functions independently, but integration and seamless access are prevented
Solution Approach 1:
The patent makes the access token multi-functional by enabling it to serve both OAuth authorization purposes and SSO session management purposes. The access token issuer validates both authorization credentials and session identifiers, and the issued token contains embedded session information, allowing a single token to fulfill multiple functions across different protocols and environments.
Data Source
AI summary
Techniques are described for providing session management functionalities using an access token (e.g., an Open Authorization (OAuth) access token). Upon successful user authentication, a session (e.g., a single sign-on session) is created for the user along with a user identity token that includes information identifying the session. The user identity token is presentable in an access token request sent to an access token issuer authority (e.g., an OAuth server). Upon receiving the access token request, the user identity token is parsed to identify and validate the session against information stored for the session. The validation can include various session management-related checks. If the validation is successful, the token issuer authority generates the access token. In this manner, the access token that is generated is linked to the session. The access token can then be used by an application to gain access to a protected resource.