Web SSO Token Exchange for Extranet Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Windows authentication mechanisms are inadequate for applications in demilitarized zones (DMZs) due to security restrictions, requiring shadow accounts that are cumbersome to maintain and update, and existing solutions fail to efficiently provide Windows tokens for extranet and federated access without disrupting security measures.
Innovation Solution
The implementation of Web Single Sign-On (Web SSO) using Active Directory Federation Services (ADFS) tokens, which allows the construction of Windows NT tokens without shadow accounts by filtering and expanding Security Identifiers (SIDs) across security boundaries, enabling traditional Windows-based authorization for web clients and federated partners.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If shadow accounts are used to provide Windows authentication for DMZ applications, then security restrictions are maintained, but maintenance overhead and complexity increase significantly
Solution Approach 1:
The patent extracts the authentication functionality from shadow accounts by implementing a token exchange mechanism where federated identity tokens are converted into Windows NT tokens. This eliminates the need for shadow accounts while maintaining security boundaries, as the authentication is performed through token transformation rather than through separate shadow account structures.
Solution Approach 2:
The patent introduces a token exchange service as an intermediary between federated identity providers and Windows authentication systems. This service receives security tokens from external federated partners, validates them, and issues corresponding Windows NT tokens, thereby mediating between different authentication domains without requiring shadow accounts.
2Reliability
If multiple sign-on mechanisms are implemented for extranet access, then security boundaries are preserved, but user authentication complexity and time increase
Solution Approach 1:
The patent merges multiple authentication mechanisms into a unified token exchange process. By combining federated identity verification with Windows authentication through a single token transformation operation, the system preserves security boundaries while eliminating the need for separate sign-on procedures for each domain.
Solution Approach 2:
The patent performs preliminary authentication through federated identity verification before the actual resource access request. The token exchange service pre-validates external identity tokens and issues Windows NT tokens in advance, so that when resources are accessed, authentication has already been completed, eliminating repeated authentication steps.
3Reliability
If traditional Windows authentication is used for web clients in DMZ, then security is maintained, but adaptability to federated partners is reduced
Solution Approach 1:
The patent implements a universal token exchange mechanism that can handle multiple federated identity providers and partners through a single interface. The system accepts various external security token formats, validates them against federated trust relationships, and converts them into Windows NT tokens, thereby providing both Windows security compatibility and federated partner adaptability through one multi-functional system.
Data Source
AI summary
A system for authenticating computer users comprising a single active directory disposed in an intranet, a web server disposed in a DMZ associated with the intranet, and a web client coupled to the web server through an internet connection that is capable of signing on to the web server.