International Business Machines Corporation

Vivek Shankar

Chee Meng Low

Codur Sreedhar Pranam

Edwin Boaz Soenaryo

Kelvin K V Chin

Jose Angel Rodriguez

Adrian R Sasmita

Weide Victor Soon

Embodiments herein describe a pattern or syntax that can be used to convey or express the reason or purpose for a service provider to request user data in an identity federation. A service provider can request user data from the identity provider using an authentication process. If the authentication process is successful, the identity provider provides an authorization token to the service provider which it can use to retrieve the user data. The embodiments herein obtain user consent in the same authentication process used to provide the authorization token. In order to do so, the embodiments herein introduce a pattern or syntax that the service provider uses to convey the purpose for which it wants to use the user data to the identity provider.

Enforcing data privacy policies for federated applications

Protecting application passwords using a secure proxy. A request is received by a proxy from a client to access a protected resource located on a target server. A secure session is initiated between the proxy and client. The access request is forwarded by the proxy to the target. A response is received from the target that is a credential form. The proxy server injects into each required credential field a credential field tag and is sent to the client computer. Target credentials mapped by the credential field tags are retrieved by the proxy server from a protected datastore. The form is completed and sent to the target. If the credentials are invalid, the target credentials are updated and stored in the protected data store without client computer intervention, and sent by the proxy server to the target. The client computer is then allowed to access the protected resource.

Protection of application passwords using a secure proxy

In an approach for providing auditable retrieval of privileged credentials in a privilege identity management (PIM) system, a processor invokes a checkout of a PIM credential, based on, at least, a determination that a PIM server cannot be accessed. A processor receives a request to access the PIM credential by a user. A processor receives validation of the request to access the PIM credential and an identity of the user. A processor retrieves the PIM credential from a database, wherein the database stores a plurality of PIM credentials owned by a system owner.

Auditable retrieval of privileged credentials

A computer-implemented method, computer program product, and system for tagging and replacing tagged credentials with target credentials unknown to a client. The method includes; receiving an access request from a client to access a protected resource on a target server, injecting credential field tags into a credential form used to access the protected resource, auto-submitting the credential form on the client computer, replace tagged credentials with target credentials, submitting the target credentials to the target server, and updating the target credentials if the target credentials are invalid or expired without intervention by the client.

Growing community of inventors

Singapore, Singapore

Vivek Shankar