Single Sign-On System Using Redirect Token Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional single sign-on systems require user ID mapping between cooperating Web sites, leading to maintenance issues and lack of flexibility, especially when a user lacks a user ID on the destination site, preventing seamless access.
Innovation Solution
A single sign-on system that allows users to access a destination Web site using their user ID from a source Web site, without requiring mapping, by utilizing a redirect token and log-in cookie mechanism, enabling secure access even if the user ID is not stored on the destination site.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user ID mapping is implemented between cooperating Web sites, then single sign-on authentication can be achieved, but the system becomes troublesome to maintain and lacks flexibility when new Web sites seek cooperation
Solution Approach 1:
The patent introduces a redirect token as an intermediary mechanism between the first Web site and second Web site. Instead of directly mapping user IDs between systems, the first Web site generates a redirect token containing user information that is temporarily stored and used by the second Web site for authentication. This mediator approach eliminates the need for complex user ID mapping tables while maintaining reliable single sign-on functionality.
Solution Approach 2:
The patent extracts the essential authentication information from the user ID and places it into a redirect token. Rather than requiring the second Web site to store and manage the complete user ID mapping, only the necessary authentication data is extracted and embedded in the redirect token, reducing maintenance complexity while preserving authentication reliability.
2Reliability
If user ID mapping is maintained between Web sites, then authentication can work, but maintenance burden increases every time user IDs are added or changed
Solution Approach 1:
The system enables self-service authentication where the second Web site automatically obtains and validates user authentication information through the redirect token mechanism. The first Web site automatically generates and manages the redirect tokens, eliminating the need for manual user ID mapping maintenance. The system serves itself by automatically handling authentication data exchange without requiring administrative intervention for each user ID change.
3Reliability
If user ID mapping is required, then existing users can authenticate, but new users without stored user IDs cannot log in, reducing system flexibility
Solution Approach 1:
The patent implements a dynamic authentication system where the redirect token is created on-demand when a user attempts to access the second Web site from the first Web site. Unlike static user ID mapping that requires pre-existing entries, the dynamic redirect token mechanism can accommodate any user from the first Web site, including new users, by generating authentication credentials at the moment of access request. This dynamic approach significantly increases system flexibility while maintaining authentication reliability.
Data Source
AI summary
Even if a user ID of a target user is not stored in a cooperation destination Web site, it is possible to access the cooperation destination Web site by use of a user ID of a cooperation source Web site. According to a typical embodiment, a cooperation source application calls up a log-in API of a cooperation destination Web server, based on information including the user ID. The log-in API records the information including the user ID as redirect information, creates a redirect token, and adds the redirect token to a URL of a guide application to send the URL. Based on the sent URL, the cooperation source application redirects access to the guide application. When the redirect information identified by the redirect token included in the URL is recorded, the guide application creates a log-in cookie based on the user ID included in the redirect information, and redirects the access to a cooperation destination application.