Sap Se

Sap Ag

Jasen Minov

Milen Manov

Stefan Petrov

Petio G Petev

Georgi Stanev

Krasimir Semerdzhiev

Nikolai Veselinov Neichev

Miroslav R Petrov

Hristo S Iliev

Nikola I Marchev

Martin Raepple

Dimitar P Kostadinov

Biser E Ivanov

Stanimir Eisner

A request from an application client is received at a protected application. The request includes an access token. A grant information associated with the received access token is retrieved. The grant information includes a plurality of intersecting scopes of rights granted to the application client. In another aspect, a session is established between the protected application and the application client. Furthermore, at least one scope of rights from the plurality of intersecting scopes of rights is determined to be mapped to at least one Application Programming Interface (API) from a number of APIs provided by the protected application.

Accessing an application through application clients and web browsers

A multi-domain application requiring SSO and SLO operations in cloud environment is presented. The computing system of the multi-domain application includes a multi-domain service (MDS) to redirect the calls for the multi-domain application to an identity provider to authenticate the user or to invoke the single logout services (SLOs) on the domains of the multi-domain application and to invalidate the user sessions on the domains. A cookie that includes the multi-domain application URL is generated to reach the assertion consumer service (ASC) and the single logout service (SLO) that receive an identity assertion response from the identity provider. Domain specific SLOs are provided. A trust between these domain specific SLOs and the SLO is provided based on service provider keys. The SAML mechanism for a logout scenario is reused for communication between the SLO and the domain specific SLOs, where the SLO plays a role of a local IDP.

Multi-domain applications with authorization and authentication in cloud environment

Various embodiments of systems and methods for automatic context passing during management application navigation are described herein. When management applications work with different managed entities, the managed context is preserved by following the relations between the managed entities. These relations are followed from a mediator framework during the navigation between the management applications. In this manner, a managed application passes context information for one entity type, and second managed application retrieves from the framework context information for different entity type, but the user context information will be preserved as the framework follows the relations between the passed entity and the requested entity types.

Automatic context passing during management application navigation

Software applications receive input data, perform processing of the received data and generate output. In one aspect the output is modification of data structures. The software application is tested with instances of input data that lead to various data modifications in the data structures. In another aspect, patterns are found in the modifications of the data structures, which are evaluated and analyzed for software vulnerabilities.

Evaluation of software applications

A multi-domain application requiring SSO and SLO operations in cloud environment is presented. The computing system of the multi-domain application includes a multi-domain service (MDS) to redirect the calls for the multi-domain application to an identity provider to authenticate the user or to invoke the single logout services (SLOs) on the domains of the multi-domain application and to invalidate the user sessions on the domains. A cookie that includes the multi-domain application URL is generated to reach the assertion consumer service (ACS) and the single logout service (SLO) that receive an identity assertion response from the identity provider. Domain specific SLOs are provided. A trust between these domain specific SLOs and the SLO is provided based on service provider keys. The SAML mechanism for a logout scenario is reused for communication between the SLO and the domain specific SLOs, where the SLO plays a role of a local IDP.

An HTTP tunneling service is described for creating a tunneled path between a client and a server (e.g., over a firewall or other data/protocol filtering device). According to one embodiment of the invention the client sends the server an initial request to open a preliminary socket connection which includes a secure client ID previously assigned to the client. The server opens the preliminary socket connection, generates a random client ID and transmits the random client ID to the client. The preliminary socket connection is then closed. The client then sends a second request to open a second socket connection using both the unique ID and the secure client ID for authentication purposes.

Tunneling apparatus and method for client-server communication

Embodiments include a timeout event management system that registers timeout events and checks for and corrects inaccuracies in timing caused by hibernation or system time changes. The timeout event management system may trigger an event after an intended delay time or at an intended expiration time. A handler program may be called in response to the triggered timeout. In an additional embodiment, the timeout system may track timeout events in a priority queue data structure.

Growing community of inventors

Sofia, Bulgaria

Jasen Minov