Reverse Proxy Access for Non-Federated Local Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for authenticating users to local applications within a computer network that do not support identity federation are complex and inefficient, as they require multiple local authentication servers, making federated authentication impossible for applications managed by different servers.
Innovation Solution
A method and system using an IDAAS server to authenticate users, generating an authentication message with a list of authorized applications and access rights, which is transmitted to a local authentication server via a reverse proxy, allowing identity federation for multiple local applications without requiring separate servers for each.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple local authentication servers are instantiated, one for each application, then each application can be managed independently, but the system becomes complex to manage and federated authentication becomes impossible for applications managed by different servers
Solution Approach 1:
The patent merges multiple authentication server functions into a single local authentication server that can manage multiple applications. The server maintains a list of authorized applications and uses a reverse proxy to route requests, eliminating the need for separate authentication servers for each application while enabling federated authentication across all applications.
Solution Approach 2:
The local authentication server is designed with multi-functionality to handle authentication for multiple different applications simultaneously. It receives authentication requests from any application, validates user credentials, and issues authentication tokens that can be used to access any of the authorized applications, making the server universal rather than application-specific.
2Device complexity
If a single local authentication server is used with a reverse proxy, then management is simplified, but the reverse proxy becomes a single application regardless of the number of applications managed
Solution Approach 1:
The reverse proxy acts as an intermediary between the local authentication server and multiple applications. It receives authentication requests from any application, forwards them to the authentication server, and routes the authentication tokens back to the appropriate application. This mediator approach allows the single authentication server to serve multiple applications without losing application-specific authentication capability.
3Adaptability or versatility
If separate local authentication servers are used for each application, then application-specific authentication is achieved, but it becomes impossible to use federated authentication for applications managed by different servers
Solution Approach 1:
By merging all authentication functions into a single local authentication server, the system enables federated authentication to work across all applications. The server maintains a unified list of authorized applications and issues authentication tokens that can be used to access any application, eliminating the fragmentation that prevented cross-application federated authentication.
Data Source
AI summary
The invention relates to a method (100) for managing access to a local application located in a computer network, said method (100) comprising an authentication phase (120) comprising the following steps:authenticating (130) said user by an IDAAS server located outside said computer network;in the event of successful authentication, generating (132) an authentication message comprising a first list of applications authorized for said user;transmitting (134) said authentication message to a local authentication server located in said network; andwhen said local application is mentioned in said first list, transmitting (142) an authorization data item associated with said user for said application, to a reverse proxy managing the access of said user to said application.The invention further relates to a computer program and a system implementing such a method.