Unified Token Exchange for Web and API Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional identity management solutions in enterprises face inefficiencies due to the lack of seamless transition between Web resource access and API resource access, requiring separate authentication and access control mechanisms for each application, leading to increased complexity and security risks.
Innovation Solution
A method that involves receiving a request for access to a resource, determining if it's a Web or API resource, validating credentials, creating an authentication cookie and bearer token, and exchanging the bearer token for an access token to provide seamless access across both types of resources, using a common identifier for session management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate authentication mechanisms are used for each application, then application security is improved, but system complexity increases
Solution Approach 1:
The patent merges separate authentication mechanisms into a unified authentication system that issues a single token valid across multiple applications. The authentication server consolidates credential validation and session management, allowing users to authenticate once and access multiple applications without repeating the authentication process, thereby reducing system complexity while maintaining security through centralized control
Solution Approach 2:
The patent implements a universal authentication token that serves multiple functions across different applications. The token contains user identity information and authorization credentials that are recognized by multiple applications, enabling a single authentication mechanism to provide security for multiple applications simultaneously, thus reducing the need for separate authentication systems
2Reliability
If separate authentication mechanisms are used for each application, then application-specific access control is improved, but user convenience deteriorates
Solution Approach 1:
The patent combines multiple authentication requirements into a single authentication event. When a user presents credentials to the authentication server, the server validates them and issues a token that grants access to multiple applications, eliminating the need for users to authenticate separately with each application while maintaining application-specific access control through the token's embedded permissions
Solution Approach 2:
The patent performs authentication in advance by issuing a token that contains all necessary authorization information for multiple applications. This preliminary authentication action eliminates the need for repeated authentication during subsequent application accesses, significantly improving user convenience while maintaining security through the pre-validated token
3Reliability
If authentication information is not shared between applications, then security isolation is improved, but transition between Web and API resources deteriorates
Solution Approach 1:
The patent introduces an authentication server as an intermediary that issues tokens containing user identity and authorization information. This token serves as a portable credential that can be presented to multiple applications including both Web and API resources. The token acts as a secure intermediary that enables seamless transition between different resource types while maintaining security through centralized credential management and validation
Data Source
AI summary
The present disclosure relates generally to access control, and more particularly, to techniques for seamless transition between world wide web (WEB) resource access and application programming interface (API) resource access on an enterprise network with security restrictions. One technique includes receiving a request for access to a first resource, determining the first resource is a WEB resource, creating an authentication cookie and a bearer token that are tied together using a common identifier, and providing access to the WEB resource based on the authentication cookie. The technique may further include receiving a call for access to a second resource, where the call includes the bearer token in a header of the call, determining the second resource is an API resource, initiating a token exchange of the bearer token for an access token; and providing access to the API resource based on the access token.