OpenID Authentication Fallback Using Multiple Identity Providers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In OpenID systems, users cannot be authenticated when the identity provider is unavailable, preventing access to OpenID web sites due to the lack of security authentication functionality.
Innovation Solution
A method where a relying party receives a login request, reads a list of associated identity providers, identifies a first available provider, generates an OpenID identifier, and transmits an authentication request to authenticate the user, with the option to retry with other providers if the initial one is unavailable.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the system uses a single identity provider for authentication, then the authentication process is simple and direct, but the system becomes unavailable when that identity provider is unavailable
Solution Approach 1:
The patent segments the identity provider functionality by maintaining multiple identity providers in a list associated with each username. Instead of relying on a single identity provider, the system divides the authentication responsibility across multiple providers, allowing fallback to alternative providers when the primary one is unavailable.
Solution Approach 2:
The system performs preliminary action by pre-configuring a list of multiple identity providers associated with each username before authentication is needed. This list is stored in advance, so when authentication is required, the system can immediately attempt to use the first available provider without delay.
2Productivity
If the system attempts to authenticate with the first available identity provider, then authentication can proceed quickly when that provider is available, but authentication fails completely when that provider is unavailable
Solution Approach 1:
The patent implements dynamics by making the identity provider selection adaptive rather than static. The system dynamically selects which identity provider to use based on real-time availability, attempting providers in sequence until one responds. This dynamic approach maintains fast authentication when providers are available while ensuring success by falling back to alternatives when needed.
Solution Approach 2:
The system uses feedback from the identity provider's response (or lack thereof) to determine the next action. When the first available provider is unavailable, the system receives negative feedback (timeout or error) and uses that information to proceed to the next provider in the list, continuing this process until authentication succeeds or all providers are exhausted.
3Reliability
If the system maintains a list of multiple identity providers for each username, then authentication availability improves when providers are unavailable, but the complexity of provider management and selection increases
Solution Approach 1:
The system implements self-service by automatically managing the selection of identity providers without requiring user intervention. The relying party server autonomously attempts authentication with providers in the pre-configured list, selecting and attempting each provider in sequence based on their availability, thereby simplifying the user experience while maintaining high reliability.
Data Source
AI summary
A method and computer program product for enabling authentication of an OpenID user when a requested identity provider is unavailable. A relying party receives a login request from the OpenID user, where the login request includes a username. The relying party reads a list of trusted identity providers that are associated with the received username and selects one of those identity providers. The relying party generating an OpenID identifier using an identification (e.g., Uniform Resource Locator) of the selected identity provider and the username. The relying party transmits an authentication request (request to authenticate the OpenID user) to the selected identity provider using the formed OpenID identifier. If the selected identity provider is unavailable, then the relying party selects another identity provider from the list of identity providers that are associated with the received username and repeats the above process.