OAuth Token Intermediary for Secure Application Job Triggering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computer systems, there is a challenge in ensuring secure calls between applications, particularly for shared-service applications like job schedulers, where malicious applications can impersonate the scheduler and gain unauthorized access to trigger jobs, leading to security vulnerabilities.
Innovation Solution
The implementation involves a security configuration file that grants authority to a shared-service application, using OAuth Client Credentials Flow and persistence operations between Cloud Foundry Service Brokers to authenticate and authorize applications, ensuring that only trusted entities can trigger job executions by including a token with the assigned authority.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a shared-service application is allowed to trigger jobs at multiple applications without authentication, then the ease of operation is improved, but the security is worsened as malicious applications can impersonate the scheduler
Solution Approach 1:
The patent introduces an OAuth token as an intermediary mechanism between the shared-service application and the called application. The token acts as a mediator that carries authority information, allowing the scheduler to trigger jobs securely without direct trust relationships. The token is issued by an authorization server and validates the identity and permissions of the calling application, thus resolving the security concern while maintaining operational ease.
2Reliability
If manual administrator operations are required to configure permissions, then the security is improved through controlled access, but the productivity is worsened due to increased manual work
Solution Approach 1:
The patent implements preliminary action by automatically granting authority to the shared-service application during the deployment phase. When the first application is deployed, the system proactively assigns the necessary authority to the second application (scheduler) based on deployment metadata, eliminating the need for manual post-deployment permission configuration. This automated preliminary action maintains security controls while significantly improving configuration efficiency.
3Ease of operation
If OAuth tokens are transmitted without verification, then the ease of operation is improved, but the security is worsened as tokens can be intercepted and misused
Solution Approach 1:
The patent implements feedback mechanisms through token verification. When the shared-service application triggers a job at the called application, the called application verifies the OAuth token's authenticity and validity before executing the job. This feedback loop ensures that intercepted or unauthorized tokens are rejected, maintaining security while keeping the authentication process simple for legitimate operations.
Data Source
AI summary
A security configuration file is received from a first application, the security configuration file including information of an authority. The first application assigns the authority to a second application to enable the second application to trigger jobs at the first application, and the second application provides shared services to a plurality of applications including the first application. A query is received from the second application and in response the authority is sent to the second application. A request for a token is received from the second application, the request including the authority. A token including the authority is sent to the second application. The second application sends the token to the first application when the second application triggers jobs at the first application.