Single Sign-On Account Mapping via SAML Assertions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in securely accessing sensitive data across multiple systems due to unreliable automated matching of user accounts and lack of seamless single sign-on functionality, especially when users represent multiple organizations.
Innovation Solution
Implementing a system login and single sign-on method that uses Security Assertion Markup Language (SAML) for identity assertion and validation, combined with self-mapping to establish reliable connections between user accounts across different systems, enabling secure access to protected applications while allowing users to select their affiliated organizations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If automated matching of user accounts across systems is implemented, then access efficiency is improved, but reliability of account matching deteriorates due to mismatches and errors
Solution Approach 1:
The system enables users to manually create and manage their own account mappings across different systems through a self-service interface. When automated matching fails or is unavailable, users can directly associate their accounts with the organizations they represent, ensuring both efficiency and reliability without requiring administrative intervention.
Solution Approach 2:
The patent introduces an intermediary mapping table that stores explicit associations between user accounts in different systems. This mapping table acts as a mediator that resolves uncertainties in automated matching by providing pre-established, verified account relationships, thereby improving reliability while maintaining automated access efficiency.
2Ease of operation
If single sign-on functionality is implemented across multiple systems, then ease of operation is improved, but system complexity increases due to integration requirements
Solution Approach 1:
The patent extracts the complex identity management and account mapping logic from individual applications and centralizes it in a dedicated identity management system. This separate module handles authentication and account resolution, allowing applications to maintain simple, clean code while still providing seamless single sign-on functionality across multiple systems.
Solution Approach 2:
The identity management system implements a universal authentication mechanism that works across multiple different systems and applications. By creating a common framework that handles various authentication scenarios (automated matching, manual mapping, organization selection), the system achieves single sign-on convenience without requiring separate integration solutions for each application.
3Object-affected harmful factors
If strict access control policies are enforced based on user identities, then security is improved, but ease of operation deteriorates due to multiple login requirements
Solution Approach 1:
The system performs preliminary account mapping and organization association during the authentication process itself, before the user needs to access specific resources. By pre-establishing the user's identity and organizational affiliations during login, the system maintains strict access control policies while eliminating the need for additional logins or security prompts during subsequent operations.
Data Source
AI summary
Systems and methods for system login and single sign-on are described. A first application of a first system receives a request to access a protected application of a second system. An assertion is generated in response to the request. The assertion asserts an identity in the first system of a user generating the request. The assertion is validated and first account information corresponding to the assertion is extracted. The first account information is information of a first account of the user in the first system. Second account information is determined that is information of a second account of the user in the second system. A mapping is generated between the first account and the second account using the first account information and the second account information. The mapping is used to provide access to the protected application by the requestor.