International Business Machines Corporation

Brent Allan Hepburn

Olgierd Stanislaw Pieczul

Mark Alexander McGloin

David S Kern

Mary Ellen Zurko

Juan Galiana Lara

Mark Lawrence Rovelli

A rich client performs single sign-on (SSO) to access a web- or cloud-based application. According to the described SSO approach, the rich client delegates to its native application server the task of obtaining a credential, such as a SAML assertion. The native server, acting on behalf of the user, obtains an assertion from a federated identity provider (IdP) that is then returned to the rich client. The rich client provides the assertion to a cloud-based proxy, which presents the assertion to an identity manager to attempt to prove that the user is entitled to access the web- or cloud-based application using the rich client. If the assertion can be verified, it is exchanged with a signed token, such as a token designed to protect against cross-site request forgery (CSRF). The rich client then accesses the web- or cloud-based application making a REST call that includes the signed token. The application, which recognizes the request as trustworthy, responds to the call with the requested data.

Method and system for authenticating a rich client to a web or cloud application

A method, and an associated computer system and computer program product. A login request is received from a user, to log into a computing resource, wherein the login request includes a password and a user identifier of the user. The received password is compared with a stored password to determine whether to grant access to the computing resource. Responsive to determining that the received password does not match the stored password, an authenticity of the login request is determined, based on one or more characteristics of the user and/or one or more checks performed against the received password. A score is calculated based on the determined authenticity of the login request. The login request is denied. Based on the calculated score, it is decided whether to lock the user and deny the user further access to the computing resource.

Accessing a computing resource

In a cloud computing environment, a user authenticates to multiple cloud services concurrently. A master service has knowledge of or tracks the cloud service(s) to which a user is authenticated. Each cloud service may enforce its own inactivity period, and the inactivity period of at least first and second cloud services may be distinct from one another. When the master service receives an indication that the authenticated user is attempting to take an action at a first cloud service despite an activity timeout there, the master service issues a status request to at least the second cloud service to determine whether the user is still active at the second cloud service (despite its different inactivity period). If the user is still active at the second cloud service, the master service provides a response, selectively overriding (re-setting) the activity timeout at the first cloud service to permit the action.

Growing community of inventors

Boston, MA, United States of America

Brent Allan Hepburn