Token-Based SSO for Windows Web Apps

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Single sign-on (SSO) authentication is limited in its portability across different platform types, particularly failing to provide seamless access to non-windows based applications like SAP, where users must manually log in to windows-hosted applications due to the inability of windows-hosted systems to recognize identities from non-windows based SSO credentials.

Innovation Solution

A method and system that utilizes token-based authentication to create a cookie from a token-based authentication system, which is then decoded and validated by a custom-built windows application to grant access to windows-hosted web applications, allowing for single sign-on across multiple platform types by determining if a service account connection is used and querying configuration managers for credentials.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If single sign-on authentication is implemented for windows-based applications, then user access convenience is improved, but compatibility with non-windows based applications (such as SAP) deteriorates

Engineering Contradiction:

Improveuser access convenienceVSAvoidplatform compatibility

Core Design Contradiction:

Ease of operationVSAdaptability or versatility

Solution Approach 1:

The patent implements a universal authentication mechanism that can handle both windows-based SSO authentication and non-windows based application authentication through a common token validation interface. The system uses a standardized token format that can be validated across different platform types, allowing the same authentication infrastructure to serve multiple platform requirements simultaneously.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The patent introduces a token validation service as an intermediary component that sits between the authentication systems and applications. This mediator receives authentication requests, validates tokens against the authentication service, and returns authentication results, enabling seamless communication between windows-based and non-windows based applications without requiring platform-specific authentication implementations.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Speed

If SSO credentials are stored locally for windows applications, then authentication speed is improved, but portability across different platforms deteriorates

Engineering Contradiction:

Improveauthentication speedVSAvoidcredential portability

Core Design Contradiction:

SpeedVSAdaptability or versatility

Solution Approach 1:

The patent extracts the authentication credentials from local storage and replaces them with token-based authentication. Instead of storing SSO credentials locally in the windows application, the system retrieves validated token information from the authentication service, eliminating the need for local credential storage while maintaining fast authentication through cached token validation results.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent replaces the mechanical local credential storage system with a network-based token validation system. Instead of reading stored credentials from local files or databases, the system uses electronic token exchange and validation over the network, substituting physical credential storage with digital token-based authentication that can be validated across different platforms.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Reliability

If manual login is required for each application, then security is improved, but user time consumption deteriorates

Engineering Contradiction:

ImprovesecurityVSAvoiduser time consumption

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent implements preliminary authentication through token-based SSO, where users authenticate once to the authentication service before accessing applications. The authentication service pre-validates user credentials and issues tokens that can be used across multiple applications, eliminating the need for repeated manual logins while maintaining security through centralized credential verification.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent enables self-service authentication where the system automatically handles token validation and user identity verification without requiring manual intervention for each login. The authentication service autonomously validates tokens and manages user sessions, reducing user time consumption while maintaining security through automated credential verification processes.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS11595375B2Single sign-on for token-based and web-based applications

Publication Date: 2023.02.28 SAUDI ARABIAN OIL CO

AI summary

A method of authenticating a user includes: logging into a first system that includes a token-based authentication system (TBAS); creating, at the TBAS, a cookie based on a token from the TBAS; requesting access, by the user, to a second system that includes at least one windows-hosted web application (WHWA); and decoding and validating the token, thereby granting the user access to the second system based only on the user logging into the first system.