Token Broker for Cross-Domain Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Internet-facing applications face challenges in secure access control, particularly when an application executing on a child frame, hosted on a different domain than the parent frame, is unable to request tokens from an identity provider due to browser restrictions on third-party cookies, hindering secure delegated access to resources.
Innovation Solution
A token brokering mechanism where a broker application executing in a top-level frame requests and receives tokens from an identity provider on behalf of applications running on descendant frames, enabling secure delegated remote access to resources while bypassing third-party cookie restrictions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If an application executes on a child frame hosted on a different domain, then the application can be embedded and reused across multiple parent frames, but the application is unable to request tokens from an identity provider due to browser restrictions on third-party cookies
Solution Approach 1:
A broker application is introduced as an intermediary between the embedded application and the identity provider. The broker executes in the parent frame's domain context, allowing it to communicate with the identity provider using first-party cookies while the embedded application runs in the child frame. The broker receives token requests from the embedded application, forwards them to the identity provider, and relays the responses back, thus mediating the authentication process and resolving the third-party cookie restriction issue.
2Reliability
If a broker application is introduced to request tokens on behalf of the embedded application, then secure delegated access can be achieved, but the system complexity increases
Solution Approach 1:
The broker application is designed to serve multiple purposes: it acts as an authentication intermediary for embedded applications, manages token requests and responses, maintains authentication state across different sessions, and handles communication with the identity provider. By consolidating these multiple functions into a single broker component, the system achieves secure delegated access while minimizing the increase in overall complexity that would result from implementing separate mechanisms for each function.
Data Source
AI summary
The disclosed technology is generally directed to web authentication. In one example of the technology, authentication of a broker with an identity provider is initiated. The broker is a first application that is executing in a top-level frame. At the broker, from a second application that is executing on a first descendent frame that is a descendant frame of the top-level frame, a token request is received. Via the broker, a first token is requested from the identity provider on behalf of the second application. The first token is associated with an authorization of secure delegated remote access of at least one resource by the second application. At the broker, from the identity provider, the first token is received. Via the broker, the first token is provided to the second application.