International Business Machines Corporation

Benjamin Brewer Harmon

Anthony Scott Moran

Heather Maria Hinton

Christopher John Hockings

Scott Anthony Exton

Paul William Jensen

A method carried out at a point of contact (e.g., reverse proxy, a web server plug-in, or the like) that serves as an intermediary between a client browser and one or more back-end applications (or application component), wherein each back-end application has the capability to set its own server-side session management data with respect to the point of contact that is independent of any client-side session management data set by the point of contact and used by the point of contact to manage a user session. The method begins as a given back-end application returns a response to a first request that has been issued from the client browser (the first request having been received at the point of contact and passed to a back end application or component for processing). The point of contact intercepts the out-going response, augments server-side session management data associated therewith with a 'stamp,' and forwards to the client browser the response together with the server-side session management data as augmented to include the stamp. The stamp provides a way for the point of contact to later determine whether the server-side session management data, if received with another user request, is valid for that request. Later, upon receipt at the point of contact of a new user request that includes the server-side session management data (and stamp), the point of contact uses the stamp to determine whether the new request is valid. If so, the point of contact removes the stamp from the server-side session management data and forwards the new request (and the management data) to the back-end application for handling.

Method and system for global logoff from a web-based point of contact server

One embodiment provides a computer-implemented method for transaction authorization within a security service. The computer-implemented method intercepts a request by a security service, wherein a transaction identifier is cached to form a cached transaction identifier, and requests the requester to authenticate to form an authentication request. The computer-implemented method further determines whether the requester was authenticated, and responsive to a determination the requester was authenticated, receives authentication information, including an associated transaction identifier. The request is intercepted and the cached transaction identifier inserted. The computer-implemented method further determines whether the cached transaction identifier is equivalent to the authentication information, including an associated transaction identifier, and responsive to a determination that the cached transaction identifier is equivalent to authentication information, including an associated transaction identifier, passes the request to the application.

Transaction authorization

A method is presented for managing authentication credentials for a user. A session management server performs session management with respect to the user for a domain that includes a protected resource. The session management server receives a request to access the protected resource, which requires authentication credentials that have been generated for a first type of authentication context. In response to determining that authentication credentials for the user have been generated for a second type of authentication context, the session management server sends to an authentication proxy server a first message that contains the authentication credentials for the user and an indicator for the first type of authentication context. The session management server subsequently receives a second message that contains updated authentication credentials for the user that indicate that the updated authentication credentials have been generated for the first type of authentication context.

Method and system for extending authentication methods

A method, an apparatus, a system, and a computer program product are presented for allowing an administrative user to provide help, support, or assistance to other users within a computing environment. An administrator obtains a username of a user who requires assistance through some means. The administrator belongs to a special group of users that is allowed to invoke a switch-user function, which obtains a comprehensive version of that user's identity, e.g., security credentials, while maintaining a session. With respect to applications and systems within a computing environment, the administrator's session will have the attributes of the assumed user identity as if the administrator had logged in with that user's authentication information. The administrator then accesses resources while impersonating that user in order to assist that user or to find a problem.

Growing community of inventors

Santa Cruz, CA, United States of America

Benjamin Brewer Harmon