SSO Disposition Engine Centralizes Routing Logic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current single sign-on (SSO) systems face challenges in routing unauthorized SSO requests, as each federated web application defines its own rules and parameters, leading to inefficiencies and lack of centralized management.
Innovation Solution
An SSO disposition engine determines where to route unauthorized SSO requests based on criteria such as user roles, source URLs, and device types, using an XML-based configuration file to direct requests to appropriate services, thereby centralizing the decision-making process and managing requests across multiple web services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If each federated web application defines its own routing rules and parameters, then the system allows flexible routing decisions at the application level, but the system complexity increases and centralized management is lost
Solution Approach 1:
The patent introduces a centralized disposition engine as an intermediary component that receives SSO requests, evaluates routing criteria, and determines the appropriate destination service. This mediator consolidates the routing decision-making function that was previously distributed across multiple federated web applications, thereby reducing system complexity while preserving routing flexibility through configurable evaluation criteria.
2Device complexity
If a centralized disposition engine is introduced to manage SSO requests, then centralized management and reduced complexity are achieved, but the system requires additional infrastructure components
Solution Approach 1:
The disposition engine performs preliminary evaluation of SSO requests against predefined criteria before routing them to destination services. By pre-configuring evaluation criteria and performing assessments in advance, the system streamlines the request processing flow and avoids ad-hoc decision-making at each federated application, thereby improving overall processing efficiency despite the added infrastructure.
3Measurement precision
If SSO requests are routed based on multiple criteria, then accurate request disposition is achieved, but the evaluation process becomes more complex and time-consuming
Solution Approach 1:
The patent segments the routing decision-making process into distinct evaluation criteria that can be independently assessed. The disposition engine evaluates multiple criteria (such as user identity, resource type, security requirements) in a structured sequence, allowing for accurate request disposition while managing processing time through systematic breakdown of the evaluation task into manageable segments.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Systems and methods are described for evaluating disposition of an SSO request. In one example, the method includes receiving the SSO request, the SSO request for accessing a secure service, the request having been denied authorization to access a first service, determining, based upon one or more criteria, where to direct the SSO request, and routing the SSO request to a second service, the routing based on the determining where to direct the SSO request.