Ticket Generator for Seamless SSO Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed and federated systems, users are often prompted to re-enter login credentials when accessing resources protected by a Single Sign-On (SSO) environment after logging in to an alternate authentication environment, defeating the purpose of single sign-on.
Innovation Solution
The solution involves generating a ticket from the alternate authentication environment with authenticated credentials, which is then forwarded to the SSO provider to obtain a token, allowing seamless access to SSO resources without additional login prompts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users log in to an alternate authentication environment, then they can access resources protected by that environment, but they are prompted to re-enter login credentials when attempting to access resources protected by an SSO environment
Solution Approach 1:
The patent introduces a ticket generator as an intermediary component that bridges the alternate authentication environment and the SSO environment. When a user logs in to the alternate authentication environment, the ticket generator captures the authenticated credentials and generates a ticket containing these credentials. This ticket is then automatically submitted to the SSO provider, which validates it and generates an SSO token. The user receives this token without manually re-entering credentials, thus the intermediary ticket generator resolves the contradiction by eliminating the time-consuming credential re-entry while maintaining secure authentication across both environments
2Adaptability or versatility
If credentials are passed from alternate authentication environment to SSO environment, then seamless access is achieved, but additional authentication infrastructure is required
Solution Approach 1:
The ticket generator is designed as a universal component that can operate with multiple types of authentication environments and SSO providers. It implements a standardized interface for capturing credentials from the alternate authentication environment and generating tickets in a format that can be validated by the SSO provider. This multi-functionality allows the same ticket generator infrastructure to support various authentication schemes (such as Kerberos, NTLM, or custom authentication mechanisms) and different SSO protocols (such as SAML, OAuth, or custom token formats), thereby achieving cross-environment access without proportionally increasing infrastructure complexity
Data Source
AI summary
In a computer system, some resources may be protected within an SSO environment, and other resources may be protected in an alternate authentication environment. A user logged into an alternate authentication environment will again be prompted for login credentials when accessing an SSO protected resource. To avoid additional login prompts, credentials authenticated by the alternate authentication environment are used by the SSO environment to identify the user. The credentials are collected from the alternate authentication environment and provided to the SSO resource in the form of a ticket. The SSO resource forwards the ticket to an SSO provider. The SSO provider identifies the user within a user store using the credentials in the ticket. If the SSO provider identifies the user, the SSO provider generates a token and provides the token to the SSO resource. The token is authenticated by the SSO resource and access is granted to the user.