International Business Machines Corporation

Martin Smolny

Thomas Dürr

Michael Beck

Georg Ochs

Daniel Pittner

Gerald Francis McBrearty

Klaus Rindtorff

Christian Habermann

Juergen Schaeck

Marco Pavone

Michael Haide

Gregor Möhler

Stephen SooHoo

Sandra Rapp

Silke Wastl

Thomas DÜRR

A method for authenticating and authorizing a user identifier to access a service is disclosed. The service is activated by a service application programming interface which requires a two-factor authorization to initiate execution of the service for the requesting user identifier. The method receives, by the service API, a service request together with first and second data for a first and a second authentication method, confirming a correctness of the first data as a first identity pass key using the first authentication method, confirming a correctness of the second data as a second identity pass key using the second authentication method and the first identity pass key is input to the second authentication method, and the second authentication method differs from the first authentication method. Having received the confirmed correctness of both the first identity pass key and the second identity pass key, executing the service.

Authenticating and authorizing api calls with multiple factors

Embodiments of the present invention provide computer-implemented methods, computer program products and computer systems for enabling modifying a behavior of a consuming component. The method comprises requesting a smart client by a consuming component. The smart client is adapted to modify a control logic of the consuming component and to establish a network connection. Next, the consuming component executes the smart client and receives a modification for the smart client of the consuming component. Further, a computer-implemented method for enabling modifying a behavior of a consuming component by a serving component is disclosed. This method comprises, upon receiving a request for a smart client by the serving component, providing a smart client, transmitting the smart client, receiving service requests comprising procedure calls to be executed by the serving component, and, upon detecting a performance change by the serving component, sending a modification for the smart client.

Smart client for deployment architecture with unreliable network connection

The present disclosure relates to a method for authentication with identity providers via a federating authorization server, wherein the federating authorization server has at least one interface to at least one identity provider. Each identity provider is configured to validate user identities using a respective validation method. The method comprises: receiving login data via a webpage, the login data indicating at least an identity provider and a user. The validation method of the indicated identity provider may be determined using the login data. An update of the content of the webpage may be caused for enabling the determined validation method. Identity information of the user may be provided via the updated webpage and verifying the identity information using the determined validation method.

Method for authentication with identity providers

Mechanisms are provided for dispatching requests to service instances based on data storage boundaries. A request specifying an identity is received and dispatched to a service instance of a data storage boundary, where each data storage boundary is defined by a regulation or policy restricting data storage of specific types of data to computing devices within a specified boundary. A feedback response, specifying a target location, is received from the service instance in response to determining that the service instance cannot access the data because the data is associated with a different data storage boundary. A dynamic dispatch rule specifying the identity and the target location is generated and a subsequent request specifying the identity is processed by executing this dynamic dispatch rule to dispatch the subsequent request directly to a service instance associated with the target location.

Experience based dispatch of regulated workloads in a cloud environment

Access token scope limiting is provided. An access token of a client containing a list of scopes is presented to an authorization application programming interface of the computer. Each scope in the list of scopes defines a permission to access a particular protected resource hosted by a resource server. A new access token is returned to the client containing a decreased number of scopes using a scope alias in response to the authorization application programming interface requesting a decrease in a number of scopes in the list of scopes. The scope alias representing a plurality of specific scopes from the list of scopes contained in the presented access token.

Limiting scopes in token-based authorization systems

Aspects of the present invention disclose a method for handling incoming microservice requests at an application server. The method includes one or more processors identifying a microservice request of a user at an application server. The method further includes querying a database associated with the application server for a feedback history corresponding to the microservice request. The method further includes collecting a response corresponding to the microservice request of the user. The method further includes generating a rule corresponding to the microservice request based at least in part on the response corresponding to the microservice request.

Identification of invalid requests

A computer-implemented method for a token-based authorization in a data processing environment may be provided. The data processing environment comprises at least a user system, an application, an authentication server and an access control server. The method comprises accessing the application via a user system request, redirecting the user access request to an authentication server, authenticating the user, wherein authentication credentials comprise a request for a restricted entitlement, wherein the restricted entitlement represents a subset of existing entitlements managed by the access control server for a resource. The method comprises also sending an access token from the authentication server to the application, requesting execution of an operation comprising invoking the operation by the application providing the access token comprising restricted entitlements, invoking the access control server, and providing the scope of the token comprising the subset of the existing entitlements.

Fine-grained token based access control

A computer-implemented method for reducing cookie traffic in browser communication is provided. The method sends, by a browser to a domain, a first request resulting in a returned cookie. The returned cookie includes a category tag. The method adds the returned cookie to a set of cookies for the browser. The category tag of the returned cookie is added to a related category tag in a browser tag list. The method sends, by the browser to a server of the domain, a second request resulting in a returned list of required category tags. The method sends a selected cookie with a category tag relating to at least one required category tag of the list of required category tags for the server. The selected cookie is selected from the set of cookies and the category tag for the selected cookie occurs within the browser tag list.

Network traffic reduction by server-controlled cookie selection

A computer-implemented method for a token-based authorization in a data processing environment comprising a user system, an application server and an authorization server may be provided. The method comprises accessing the application via the user agent, sending an access token and a refresh token from the authorization server to the application, triggering an execution of the service providing the long-running operation by the application. The triggering comprises requesting and receiving a transferable refresh token, starting an execution of the service providing the long-running operation by passing the transferable refresh token together with the identifier from the application to the service providing the long-running operation, passing the transferable refresh token from the long-running service to the authorization server, receiving an access and refresh token, and continuing the long running service.

Secure delegation of a refresh token for long-running operations

A method, a computer program product, and a system for distributing a private signature key between authorization instances. The method includes registering a plurality of authorization instances in a configuration file and generating host instance key pairs by each of the authorization instances. The method also includes storing the public host keys in the shared database and electing one of the authorization instances to be a signature key leader instance. The method includes generating, by the signature key leader instance, a signature key pair. The signature key pair includes a public signature key and a private signature key. The method also includes storing the public signature key in the shared database and transmitting an encrypted private signature key to a requesting authorization instance of the authorization instances. The method further includes decrypting the encrypted private signature key using the private host key generated by the requesting authorization instance.

Growing community of inventors

Boeblingen, Germany

Martin Smolny