Sun Microsystems, Inc.

Oracle America, Inc.

Ping Luo

Shivaram Bhat

Qingwen Cheng

Aravindan Ranganathan

Bhavna Bhatnagar

Wei Sun

Hong Xu

Rajeev Angal

Dilli Dorai Minnal Arumugam

Hua Cui

Sai Vs Allavarpu

Bart Lee Fisher

Raghavendra Sondur

Andrew Patterson

Heng-Ming Hsu

Mrudul Pradeep Uchil

Xuerbin Lue

Bina Keshava

A method for multi-protocol logout. The method includes receiving, by a first identity provider, a logout request from a user agent, wherein the first identity provider executes in a federation manager, and initiating a logout on a service provider associated with the first identity provider based on the logout request by the first identity provider. The method further includes identifying, by the federation manager, a plurality of identity providers associated with the user agent, wherein the plurality of identity providers communicate using heterogeneous federation protocols, and initiating, by the federation manager, a logout on each of the plurality of identity providers based on the logout request using the plurality of heterogeneous federation protocols. The method further includes initiating, by the plurality of identity providers, a logout of each service provider corresponding to the plurality of identity providers, identifying a status of each logout, and sending the status to the user agent.

Method and system for multi-protocol single logout

A method for managing access to multiple applications using a central server. The method includes receiving a user name and password from an application for a user, generating identity assertion information using the user name and password, generating an artifact associated with the identity assertion information, sending the artifact to the application, receiving the artifact and a request for the identity assertion information from a second application, verifying the validity of the artifact, and sending the identity assertion information to the second application. The second application uses the identity assertion information to authorize the user to access the second application.

Method and system for transferring identity assertion information between trusted partner sites in a network using artifacts

Embodiments of the present invention provide a circle of trust on a network. The circle of trust is configured by exchanging credential of a first and a second affiliated entity. The credentials of the first affiliated entity is stored in a trusted partner list of the second affiliated entity. The credentials of the second affiliated entity is stored in a trusted partner list of the first affiliated entity. Thereafter, a circle of trust session may be provided when a client device initiates use of a resource on a relying party device by providing an authentication assertion reference. The identity of the issuing party of the authentication is determined as a function of the authentication assertion reference. The relying party sends an authentication query containing its credential to the issuing party. The issuing party determines if the relying party is a trusted entity based upon whether the relying party's credential is contained in the trusted partner list of the issuing party.

Method and system for providing a circle of trust on a network

Methods and systems thereof for controlling access to resources are described. When a user attempts to access a resource via a remote interface such as a Web server, the request is initially evaluated by a source of policy definitions such as a policy server. This source returns a policy decision to the remote interface. The policy decision is stored in memory by the remote interface. The remote interface can then evaluate subsequent requests from the user for the resource using the stored policy decision instead of having to communicate again with the source for the policy decision. Enhancements to this approach are also described. Accordingly, policy definitions and decisions are more efficiently implemented.

Remote interface for policy decisions governing access control

In accordance with one embodiment of the present invention, there is provided a mechanism for implementing navigation seamlessly between sites in a computing environment in order to access resources without having to require users or user agents to re-authenticate. In one embodiment, there is provided the ability to determine different attribute sets for use with different resources on a target site for a user or user agent authenticated with a first site seeking to access one or more resources of the second site without re-authenticating. In one embodiment, there is provided the ability to map accounts on a first site to accounts on the second site using a set of attributes selected from among attributes provided by an application on the first site. With this mechanism, it is possible for applications or other resources to share information about a user or a user agent across disparate web sites seamlessly.

Methods for more flexible SAML session

A method and system for dynamically generating web based user interfaces. In one embodiment, a method is disclosed for displaying a user interface over a network to a user. The method begins by reading an HTTP request for authentication from a browser associated with the user. The HTTP request comprises credential information associated with the user. Based on the credential information, a first plug-in module from a plurality of plug-in modules is invoked to authenticate the user. Also, each of the plurality of plug-in modules provide similar authentication services. An authentication user interface is dynamically generated based on the HTTP request and configuration properties that are defined by the first plug-in module.

Method and system for dynamically generating a web-based user interface

An architecture for allowing extensibility to policies. The architecture has a policy component program that is able to evaluate and enforce polices. The architecture also has plugin modules for allowing a user to customize the polices. The policy component program is able to present interfaces to the user for customizing the polices. The policy component program is further able to integrate customized polices into a framework of the policy component program in response to user input that is based on the interfaces presented to the user. The presented interfaces may be for defining subjects in the policy program, defining conditions in the policy program, defining referrals in the policy program, defining resource names in the policy program, and defining how conflicts will be resolved in the policy program. The interfaces may be compliant with the JAVA programming language.

Plugin architecture for extending polices

Embodiments of the present invention provide an open and interoperable single sign-on session in a heterogeneous communication network. The open and interoperable single sign-on system is configured by exchanging an entity identifier, an account mapping, an attribute mapping, a site attribute list, an action mapping and/or the like. The entity identifier, account mapping, attribute mapping, site attribute list, action mapping and the like for each partner entity is stored in a partner list accessable to the particular entity. Thereafter, the open and interoperable single sign-on session may be provided upon receipt of a SAML request or assertion containing an entity identifier. The entity identifier contained in the SAML request or assertion is looked-up in the partner list of the particular entity which received the SAML request or assertion. A record containing a matching entity identifier provides the applicable account mapping, attribute mapping, site attribute list, and/or action mapping. The one or more mappings are then utilized to process the SAML request or assertion.

Method and system for providing an open and interoperable system

The client portion of a distributed client-server network management system uses an interface designed with, and written in, a platform independent language, such as Java. This allows management application programs to be written in the platform independent language and insures their portability. The inventive interface caches most of the management information at the server so that only a small client program is necessary. This program can run on a system with minimal resources, thereby allowing a network manager to manage a network from virtually any location on the network. For example, the client management application could be written as a Java applet which could then be run on any Java-enabled browser. The inventive distributed management system can also connect with, and use, the services and structure of existing distributed network management systems.

Platform independent distributed management system for manipulating managed objects in a network

An access control database defines access rights through the use of access control objects. The access control objects include group objects, each defining a group and a set of users who are members of the group, and rule objects. Some of the rule objects each specify a set of the group objects, a set of the management objects, and access rights by the users who are members of the groups defined by the specified set of the group objects to the specified set of management objects. A plurality of access control servers are used to process access requests. Each access control server controls access to a distinct subset of the management objects in accordance with the access rights specified in the access control database. At least one of the access control servers receives access requests from the users and distributes the received access requests among the access control servers for processing. A subset of the access requests specify operations to be performed on specified sets of the management objects. Each of these access requests is sent for processing to one or more of the access control servers in accordance with the management objects to which access is being requested. The access control servers responding to the access requests from the users by granting, denying and partially granting and denying the access requested in each access request in accordance with the access rights specified in the access control database.

Growing community of inventors

Union City, CA, United States of America

Ping Luo