Web SSO Intercepting Filter for Common URL Patterns
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web single sign-on (SSO) applications face challenges in managing web applications that use the same URLs for both authenticated and unauthenticated flows, as they cannot determine whether a particular URL from a web application should be protected or not, leading to difficulties in enabling SSO for such applications.
Innovation Solution
A method is introduced to manage web SSO applications using a common set of URLs by defining protected and unprotected URL resource patterns, configuring display logic, and employing an intercepting filter to redirect unauthorized users to protected URLs, allowing for the registration of URL patterns without requiring new sets of URLs for each resource.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If URL pattern-matching is used to determine protected resources in Web SSO applications, then authentication can be enforced for distinct URL flows, but web applications using the same URLs for both authenticated and unauthenticated flows cannot be properly protected
Solution Approach 1:
The patent segments the URL handling by introducing servlet mappings that separate protected and unprotected URL patterns. Each servlet mapping is associated with specific URL patterns and authentication requirements, allowing the system to differentiate between authenticated and unauthenticated flows even when using common URLs. The intercepting filter then applies the appropriate mapping based on the request context.
Solution Approach 2:
The patent implements dynamic URL protection by configuring display logic that can change servlet mapping behavior based on runtime conditions. The system dynamically determines whether a URL should be protected or unprotected based on the current flow context, user state, and configuration, rather than using static URL-to-protection mappings. This allows the same URL to be protected in one scenario but unprotected in another.
2Reliability
If separate URL sets are used for authenticated and unauthenticated flows, then SSO can effectively manage protection, but web applications requiring common URLs cannot be SSO enabled
Solution Approach 1:
The patent makes the servlet mapping mechanism universal by allowing it to handle both protected and unprotected URLs through a single configuration framework. The intercepting filter and servlet mapping system can accommodate multiple URL patterns including wildcards, making it adaptable to various web application architectures. This universal approach eliminates the need for separate SSO configurations for different URL schemes.
Solution Approach 2:
The patent introduces servlet mappings and intercepting filters as intermediary layers between the URL request and the authentication enforcement. These intermediaries examine the request, determine the appropriate protection level based on configured patterns, and either enforce authentication or allow direct access. This intermediary mechanism provides a flexible bridge between URL patterns and authentication requirements.
3Reliability
If the SSO application contains logic to determine URL protection, then authentication can be enforced, but the SSO application cannot handle applications where protection status varies by scenario
Solution Approach 1:
The patent applies preliminary action by pre-configuring servlet mappings with their associated URL patterns and authentication requirements before runtime. The display logic is pre-configured with the rules for determining when to apply protected versus unprotected mappings. During runtime, the system simply evaluates requests against these pre-established configurations rather than making complex decisions, reducing runtime complexity while maintaining flexible protection control.
Data Source
AI summary
A method of managing a web single sign-on (SSO) application with a common set of uniform resource locators (URLs) includes defining a first servlet mapping including a description of a protected URL resource pattern, defining a second servlet mapping including a description of an unprotected URL resource pattern, determining display logic support to establish if display logic of the web SSO application supports both the first servlet mapping and the second servlet mapping, configuring the display logic of the web SSO application based on the determination, defining an intercepting filter, and registering URL patterns for the common set of URLs in the intercepting filter, the URL patterns including definitions of the protected URL resource pattern and the unprotected URL resource pattern.