Proxy Web Service for Cloud Authentication Translation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based application execution platforms often lack support for group nesting and impose restrictions on the number of groups a user can belong to, making it difficult to manage access control using traditional membership-based authentication protocols like Microsoft Windows Active Directory.
Innovation Solution
An access management system that includes a proxy web service to translate authorization headers from membership-based authentication protocols into a format compatible with cloud-based platforms, allowing seamless access management without requiring changes to existing application code, and enabling the use of access control lists and response caching.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional membership-based authentication protocols (e.g., Active Directory) are used for cloud-based application execution platforms, then user authentication and group membership management are supported, but cloud platform restrictions (maximum number of groups, no group nesting) prevent seamless integration
Solution Approach 1:
The patent introduces a proxy web service as an intermediary component between client systems and the cloud-based application execution platform. This proxy service translates membership-based authentication protocols (like Active Directory) into cloud-compatible authentication formats, enabling traditional authentication mechanisms to work seamlessly with cloud platforms that have restrictions on group nesting and maximum group numbers.
2Productivity
If cloud platform authentication restrictions are enforced (maximum groups per user, no nesting), then platform scalability is improved, but existing application code requiring membership-based protocols cannot be deployed without modification
Solution Approach 1:
The proxy web service creates a virtual copy of the membership-based authentication environment within the cloud platform. By translating authentication headers and maintaining group membership information in the proxy layer, existing application code can access cloud-hosted applications as if it were running in a traditional on-premises environment with full Active Directory support, eliminating the need for code modifications.
3Reliability
If authentication translation is performed for every request, then protocol compatibility is maintained, but processing latency increases
Solution Approach 1:
The proxy web service performs preliminary authentication translation by establishing and caching authentication contexts before actual application requests are processed. By pre-translating membership information and maintaining authenticated sessions in the proxy layer, the system avoids repeated translation operations for each request, significantly reducing authentication processing latency while maintaining protocol compatibility.
Data Source
AI summary
A method and system for managing requests from a customer system domain, the requests for access to an application executed by a web service in a cloud computing environment. In one embodiment, an access management system includes an authentication layer and an authorization layer. The authentication layer includes a proxy web service to receive a request for access to an application according to a membership-based authentication protocol and generate an object to be passed to an interface of the web-based execution platform. A second object is generated including user identity and membership information. The second object is configured with a protocol that enables processing by the web-based execution platform. The web-based execution platform receives the second object, extracts the authentication information in the second protocol, and translates the authentication information of the second object back into the first object as in the original request. Using the first object, the application determines a validity of the request.