Single Logout Microservice for Multi-Protocol Identity Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current identity management systems in cloud environments face challenges in providing secure access across diverse devices and user types, with inconsistencies in security between on-premise and cloud environments leading to potential security breaches, especially when managing access for employees, customers, and partners.
Innovation Solution
A cloud-based identity and access management system implementing single sign-on (SSO) functionality through a microservices architecture, which generates protocol-specific tokens and uses cookies for secure access and logout across multiple applications, ensuring unified security controls across on-premise and cloud environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple separate authentication systems are used for on-premise and cloud applications, then each system can be optimized for its specific protocol, but security inconsistencies and management complexity increase
Solution Approach 1:
The patent merges multiple separate authentication systems into a unified SSO framework that handles both on-premise and cloud applications through a single authentication instance. The SLO implementation consolidates logout operations across different protocols (SAML, OAuth, OIDC) into one coordinated process, eliminating security inconsistencies while managing complexity through standardized microservice architecture.
Solution Approach 2:
The SSO system is designed with universal functionality to support multiple authentication protocols simultaneously. The microservice architecture enables the same core SSO infrastructure to handle diverse protocols (SAML, OAuth, OIDC) through protocol-specific adapters, achieving security consistency across different application types without requiring separate authentication systems.
2Ease of operation
If a unified SSO system is implemented across multiple protocols, then access management is simplified, but the complexity of coordinating logouts across different protocols increases
Solution Approach 1:
The logout coordination complexity is segmented by implementing protocol-specific logout microservices that handle individual protocol logouts independently. The SLO microservice divides the overall logout process into discrete protocol-handling units, allowing each protocol (SAML, OAuth, OIDC) to be managed separately while maintaining unified coordination through the central SLO entry point.
Solution Approach 2:
The SLO microservice acts as an intermediary that mediates between the user's logout request and the various protocol-specific authentication systems. It receives the logout request, coordinates the sequence of logouts across different protocols, and manages the propagation of logout state through cookies and redirects, simplifying the overall process while handling protocol complexity behind the scenes.
3Reliability
If protocol-specific tokens are generated for each application, then application security is optimized, but maintaining consistent security policies across applications becomes difficult
Solution Approach 1:
The system applies local quality by generating protocol-specific tokens with protocol-appropriate security characteristics while maintaining centralized policy control. Each protocol (SAML, OAuth, OIDC) receives tokens optimized for its specific requirements, yet all tokens are governed by unified security policies enforced through the microservice architecture, allowing both optimization and consistency.
Solution Approach 2:
The microservice architecture enables parameter changes by allowing security policy parameters to be adjusted centrally while automatically propagating changes to all protocol-specific token generation processes. This allows consistent security policies to be maintained across different protocols without requiring separate policy management for each application type.
Data Source
AI summary
A cloud-based identity and access management system that implements single sign-on (“SSO”) receives a first request for an identity management service configured to allow for accessing applications. Embodiments send the first request to a first microservice, where the first microservice performs the identity management service by generating a token. The first microservice generates the token at least in part by sending a second request to a SSO. The SSO microservice implements an SSO and generates a cookie that includes a global state and is used for communicating with different microservices. Embodiments receive a single log-out (SLO) of the SSO and use the cookie to iteratively log-out of the applications, where, after each log-out of an application of a first protocol, a redirect is performed to the SSO microservice to trigger log-out of applications of a different protocol.