Salesforce Com, Inc.

Salesforce, Inc.

Alan Vangpat

William Charles Mortimore, Jr

Sergio Isaac Koren

Ian Glazer

Matthew Bahrenburg

Anupam Jain

Peter S Wisnovsky

Paul Anthony Mason

Harsimranjit Singh Chabbewal

Srinath Krishna Ananthakrishnan

Peter Dapkus

Forrest Junod

Nikita Prokopev

João Henrique Pimentel Wanderley Neves

Koson Thambundit

Matthew Wong

Sean Tubbs

Charles Mortimore

Sanjay Thakkar

Prathima Rao

Itzik Koren

Sarah Lui

Jr William C Mortimore

A method and system for generating a digital access token consumable by a piggy-back service system has been developed. A request for a digital access token for a client is received. The digital access token is associated with a tenant. At least one standard claim associated with a client attribute of the client is generated. The digital access token includes a header, a payload, and a signature. The payload includes the at least one standard claim associated with the client attribute. The digital access token enables the piggy-back service system to independently authorize access by the client to at least one service at the piggy-back service system based on the at least one standard claim. The digital access token is transmitted to a first device associated with the client.

Systems and methods for generating digital access tokens independently comsumable by a piggy-back service system

Disclosed are some implementations of systems, apparatus, methods and computer program products for facilitating the authentication of computing system requests across tenants of at least one multi-tenant database system. Authentication is facilitated using a central registry that is accessible by and independent from the tenants of the multi-tenant database system.

Authenticating computing system requests across tenants of a multi-tenant database system

Methods and systems are provided for declaratively configuring a process and a page for a particular service provider. User interface(s) can be displayed at a user system and include options for declaratively configuring different log in processes and log in pages for the particular service provider. After receiving a selection of one of the options to configure the log in process and the log in page, inputs can be received that specify a type of identifiers associated with a user to be verified as part of the log in process, and an identity verification process to define how the user will be verified as part of the log in process for the service provider.

Method and system for declarative configuration of user self-registration pages and processes for a service provider and automatic deployment of the same

Methods and systems are provided for declaratively configuring a sign up process and a sign up page for a particular service provider. User interface(s), which can be displayed at a user system of a particular service provider, can include a plurality of options for declaratively configuring different sign up processes and sign up pages for the particular service provider. After receiving a selection of one of the options to configure the sign up process and the sign up page, inputs can be received that can include an input that specifies one of a plurality of different types of identifiers associated with a user to be verified as part of the sign up process, and one of a plurality of different types of identity verification processes to define how the user will be verified as part of the sign up process for the service provider.

A computer system receives a first request as part of a primary session with a client device to access information stored on a primary domain associated with the computer system. The first request includes an authentication key that was generated using a session key. The computer system receives a second request as part of a sub-session with the client device to access information stored on a secondary domain associated with the computer system. The second request includes a second authentication key that includes a session identifier of the primary session and a session payload generated using the session key and an indicator of the secondary domain. The computer system determines whether to grant the first and second requests using the first and second authentication keys, respectively.

Primary domain and secondary domain authentication

Disclosed are some implementations of systems, apparatus, methods and computer program products for facilitating the authentication of computing system requests with an unknown destination across tenants of at least one multi-tenant database system. Authentication is facilitated using an intermediate system that is accessible by and independent from the tenants of the multi-tenant database system.

Authenticating computing system requests with an unknown destination across tenants of a multi-tenant system

Techniques are disclosed relating to user authentication. In some embodiments, a computing system maintains an exception handler of a software development platform. The exception handler is executable to process a particular type of exception that causes an authentication of users of applications running on the software development platform. The computing system may receive, at the exception handler, an indication of the particular type of exception thrown by a particular application. In response to receiving the indication of the particular type of exception, the exception handler issues to a web browser interacting with the application, a request that the web browser redirect to an authentication server configured to perform an authentication of a user of the particular application. The computing system receives, from the authentication server, a result of the performed authentication and returns the result to the particular application.

Authentication through exception handling

Methods and systems are provided for configuring for declaratively configuring a user self-registration process and a user self-registration page process for a particular service provider. A graphical user interface is displayed that includes a plurality of options for declaratively configuring different user self-registration processes and corresponding user self-registration pages for the particular service provider. One of the options can be selected, and a type of identifier and a type of verification process can be specified from different types for each. The type of identifier is associated with a user to be verified as part of the user self-registration process, and can be specified to define how the user is identified and looked-up during the user self-registration process. The type of verification process can define how the user will be verified as part of the user self-registration process.

Mechanisms and techniques for customized user validation. A login attempt is received from a remote electronic device with one or more computing devices that provide access to one or more resources. The login attempt is analyzed to determine a profile from a plurality of profiles corresponding to the login attempt. The one or more computing devices support the plurality profiles with each profile having a corresponding flow. The flow corresponding to the profile is performed prior to allowing continuation of the login attempt. The login attempt is continued, via the one or more computing devices, after the flow corresponding to the profile is completed. Access is granted to the one or more resources, via the one or more computing devices, in response to a successful completion of the login attempt.

Customized user validation

Methods and systems are provided for configuring an interview-based log in process and a corresponding interview-based log in page for a particular service provider. A graphical user interface (GUI) is displayed at a user system of an administrator. The GUI includes a plurality of options for configuring different interview-based log in processes and corresponding interview-based log in pages for that particular service provider. The administrator to configure the interview-based log in process and the corresponding interview-based log in page for deployment. The administrator can specify a type of log in prompt to define how a user is identified and looked-up, and a type of authentication mechanism to define how the user will be authenticated for the service provider. The type of log in prompt and the type authentication mechanism can be one of a plurality of different types that can be specified by the administrator.

Method and system for declarative configuration of user self-registration and log in pages and processes for a service provider and automatic deployment of the same

Systems and methods are described for communicating between a client machine and a server. A security token message may be transmitted from the server to the client machine. The security token message may include a first security token. The first security token may include a communication interaction identifier that identifies a communication interaction between the client machine and the server and an action request identifier that identifies an action request message capable of being sent from the client machine to the server to request that an action be performed on the server. An action request message including a second security token and transmitted in association with the communication interaction may be received at the server. When it is determined that the first security token matches the second security token, the requested action may be performed.

Secure communications

A method for logging a user into an online host system begins by receiving a login request from a web browser application of a client device, wherein the login request identifies the online host system. The method continues by initiating a single sign-on routine that involves an online third party system and by obtaining third party user data from the online third party system, wherein the obtained third party user data is associated with the user and is maintained by the online third party system. Host system records maintained by the online host system are modified in accordance with the obtained third party user data. Thereafter, the user is automatically logged into the online host system.

Providing third party authentication in an on-demand service environment

Various techniques and procedures related to user authentication, identity providers, and single sign-on (SSO) are presented here. One approach creates an SSO link between two organizations in a streamlined manner using an internal cross-user systemwide digital certificate, and without processing any user-created, user-uploaded, or user-assigned digital certificates. Another approach presented here configures an identity provider service for an entity or organization by processing a single user command. The identity provider service is automatically configured in the background without processing any additional user commands, user instructions, or user-entered data.

Growing community of inventors

Pittsburgh, PA, United States of America

Alan Vangpat