International Business Machines Corporation

Chunlong Liang

Eduardo N Spring

William D Dodd

Rajesh Balasubramanian

Carlos N Andreu

Ching-Yun Chao

Jose I Ortiz

William J O'Donnell

Xiaoyan Y Zhang

Jose Angel Rodriguez

David Alex Cohen

James T Mulvey

Bruce Tiffany

An approach for optimizing security token exchange. The approach receives a first request from a client. The approach extracts a first security token and an API reference. The approach validates the first security token. If the security token is valid, then the approach, calls the API and retrieves a second security token, embeds the second security token in the API and sends a second request with a third security token and the reference to the API to another application in a different domain.

Securely preserving prior security tokens for recall

Handling access token invalidation is provided. In response to receiving a valid login from a user requesting access to a service, a new access token is issued to the user with a claim containing a container identifier. A first cache corresponding to access tokens issued to the user is searched. In response to identifying a previously issued access token corresponding to the user in the first cache, the previously issued access token is added to a second cache corresponding to stale tokens. The new access token is added to the first cache. In response to receiving the new access token as an identity of the user to access the service, the new access token is validated when the new access token is not identified in the second cache of stale tokens and the container identifier contained in the claim matches an identifier corresponding to a running container of the service.

Compromised access token invalidation in a singleton process

Arrangements described herein relate to collaborative environments and, more particularly, to use of a microblog to enhance communication in an organization. The present arrangements can include receiving from a first user a first microblog entry into a microblog, identifying at least one keyword associated with the first microblog entry, and assigning to the at least one keyword a tag creating an association between the at least one keyword and at least one data repository. The arrangements further can include establishing bidirectional integration between the microblog and the at least one data repository of information related to the tag creating the association between the at least one keyword and the at least one data repository.

Bidirectional integration of information between a microblog and a data repository

An identity provider (IdP) discovery service operative at a service provider (SP) is described. In operation, and as valid requests are received by the SP via normal IdP-initiated flows, the SP builds-up knowledge about the relationship between the IdP (that redirected the request) and the initiator of the request. The IdP instance typically is inferred from an HTTP referrer field, and information about the initiator may be ascertained from client-specific information, such as client system IP address, client DNS domain, a domain of a user e-mail address, a target URL for the incoming request, or the value associated with a particular HTTP header field. This knowledge is maintained in one or more mapping table(s) that associate request attributes-to-IdP instance data. The mappings are then used to facilitate IdP discovery for a new incoming request to the SP that has been determined to originate from other than an IdP.

Dynamically selecting an identity provider for a single sign-on request

An example of a solution provided here comprises: providing a connection pool, said connection pool including a connection for each of a plurality of servers; applying a load-balancing policy to said connection pool; and assigning a connection from said connection pool to a client, according to said load-balancing policy. Another example of a solution comprises: providing a plurality of directory servers; providing a connection pool, said connection pool including a connection for each of said plurality of directory servers; applying a load-balancing policy to said connection pool; and assigning a connection from said connection pool to a client, according to said load-balancing policy. Methods for providing highly available services, systems for executing such methods, and instructions on a computer-usable medium, for executing such methods, are provided.

Growing community of inventors

Austin, TX, United States of America

Chunlong Liang