Sun Microsystems, Inc.

Oracle America, Inc.

Chris Ferris

Derk Norton

David L Wood

Paul Weschler

Yvonne Wilson

William R Soley

Alejandro H Abdelnur

Abhay K Gupta

Abhay Gupta

A security architecture has been developed in which a single sign-on is provided for multiple information resources. Rather than specifying a single authentication scheme for all information resources, the security architecture associates trust-level requirements with information resources. Authentication schemes (e.g., those based on passwords, certificates, biometric techniques, smart cards, etc.) are employed depending on the trust-level requirement(s) of an information resource (or information resources) to be accessed. Once credentials have been obtained for an entity and the entity has been authenticated to a given trust level, access is granted, without the need for further credentials and authentication, to information resources for which the authenticated trust level is sufficient.

Log-on service providing credential level change without loss of session continuity

A security architecture has been developed in which a single sign-on is provided for multiple information resources. Rather than specifying a single authentication scheme for all information resources, the security architecture associates trust-level requirements with information resources. Authentication schemes (e.g., those based on passwords, certificates, biometric techniques, smart cards, etc.) are employed depending on the trust-level requirement(s) of an information resource (or information resources) to be accessed. Once credentials have been obtained for an entity and the entity has been authenticated to a given trust level, access is granted, without the need for further credentials and authentication, to information resources for which the authenticated trust level is sufficient. In addition, an entity can be allocated a new session and associated default credential if the entity's access request indicates an invalid session token or does not indicate a token.

Default credential provisioning

A security architecture has been developed in which a single sign-on is provided for multiple information resources. Rather than specifying a single authentication scheme for all information resources, the security architecture associates trust-level requirements with information resources. Authentication schemes (e.g., those based on passwords, certificates, biometric techniques, smart cards, etc.) are associated with trust levels and a log-on service obtains credentials for an entity commensurate with the trust-level requirement(s) of an information resource (or information resources) to be accessed. Once credentials have been obtained for an entity and the entity has been authenticated to a given trust level, access is granted, without the need for further credentials and authentication, to information resources for which the authenticated trust level is sufficient.

Single sign-on framework with trust-level mapping to authentication requirements

A method and apparatus for authenticating users. Prior art mechanisms require each individual application (running on an &ldquo;application server&rdquo;) that the user is accessing to provide for the ability to use the various authentication mechanisms. One or more embodiments of the invention externalize the authentication mechanism from the application in the form of a login server. Only the login server needs to be configured to handle authentication mechanisms. The application server checks if a request has an active and valid session (e.g., a valid session may exist when there is active communication between a client and server that has not expired). If there is not a valid session, the application server redirects the user to the login server. The login server attempts to authenticate the user using any desired authentication mechanism. Once authenticated, the login server redirects the user back to the application server. The application server verifies the authentication directly with the login server. Once verified, the application server processes the user's request and responds accordingly. One or more embodiments of the invention may utilize cookies to aid in the authentication process. Thus, applications on the application server need not be concerned about authenticating a given user. The application server merely knows how to work with the login server to authenticate the user. Further, communications between the application server and login server are transparent (or without any interaction from) the user (although the user may see the browser communicating with each server).

Method and apparatus for authenticating users

A security architecture has been developed in which a single sign-on is provided for multiple information resources. Rather than specifying a single authentication scheme for all information resources, the security architecture associates trust-level requirements with information resources. Authentication schemes (e.g., those based on passwords, certificates, biometric techniques, smart cards, etc.) are employed depending on the trust-level requirement(s) of an information resource (or information resources) to be accessed. Once credentials have been obtained for an entity and the entity has been authenticated to a given trust level, access is granted, without the need for further credentials and authentication, to information resources for which the authenticated trust level is sufficient. The security architecture allows upgrade of credentials for a given session. This capability is particularly advantageous in the context of a single, enterprise-wide log-on. An entity (e.g., a user or an application) may initially log-on with a credential suitable for one or more resources in an initial resource set, but then require access to resource requiring authentication at higher trust level. In such case, the log-on service allows additional credentials to be provided to authenticate at the higher trust level. The log-on service allows upgrading and/or downgrading without loss of session continuity (i.e., without loss of identity mappings, authorizations, permissions, and environmental variables, etc.).

A user interface component. One or more embodiments provide a framework to develop a graphical user interface (GUI) for applications and to present information to a user. The framework provides a common look, feel, and usage with a layout that may follow a designated style guide. Aspects of a business (e.g., customers, vendors, or invoices) are created in the form of business objects. An editor that provides the ability to display and modify attributes of each business object (e.g., the address, name and phone number may be attributes of a customer object) is created. A set of commands that implement the changes made in an editor and that are executed upon execution of an event (such as the selection of a button on a display, e.g., a &ldquo;save&rdquo; button) are also defined. One or more embodiments of the invention provide for the defining of information relating to a GUI's menu bar, tool bar, and action bar. Such user interface information may be provided in a properties file. One or more embodiments of the invention utilize the properties file to build the GUI menu bar, tool bar, and action bar. One or more embodiments of the invention utilizes information from the properties files and automatically maps the options from the different GUI bars to the appropriate command. Subsequent changes to the GUI bars may be done by updating the properties file without the need for recompilation.

Growing community of inventors

Whitinsville, MA, United States of America

Chris Ferris