Patent ID: 11870781
Assignee: MORGAN STANLEY SERVICES GROUP INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 6:
7. A method of authenticating an end user of an enterprise network computer system with an external service provider, the method comprising:
storing, in an entitlements data store, entitlement data for end users of the enterprise network computer system with respect to the external service provider, wherein:
the external service provider comprises one or more servers in communication with the enterprise network computer system via a computer data network;
the external service provider is external to the enterprise network computer system; and
the external service provider provides a SaaS application for end users of the enterprise network computer system;
and wherein the entitlement data stored by the entitlements data store comprise:
data regarding whether the end users are entitled to access the external service provider; and
data regarding, for each end user that is entitled to access the external service provider, conditional access parameters that dictate the permitted actions that are allowed to be performed on resources hosted by the external service provider, and wherein the conditional access parameters are set by a manager of the enterprise network computer system such that the conditional access parameters are not configurable by the end users;
receiving, by an identity provider server system of the enterprise network computer system, from the external service provider, redirection of a request by a first end user of the enterprise network computer system to access the external service provider, wherein the identity provider server system comprises one or more server on the enterprise network computer system;
receiving, by the identity provider server system, from the external service provider, redirection of a request by a second end user of the enterprise network computer system to access the external service provider;
upon receiving the redirected request for the first end user, communicating, by the identity provider server system with the end user via the enterprise network computer system to authenticate the first end user to the enterprise network computer system;
upon receiving the redirected request for the second end user, communicating, by the identity provider server system with the end user via the enterprise network computer system to authenticate the second end user to the enterprise network computer system;
upon authenticating the first end user to the enterprise network computer system, communicating, by the identity provider server system, via a first web service call, with the entitlements data store that is internal to the enterprise network computer system, to determine whether the first end user is authorized to access the external service provider;
upon authenticating the second end user to the enterprise network computer system, communicating, by the identity provider server system, via a second web service call, with the entitlements data store, to determine whether the second end user is authorized to access the external service provider;
making, by the identity provider server system, a determination of whether the first end user is authorized to access the external service provider based on the entitlement data from the entitlements data store for the first end user with respect to the external service provider; and
making, by the identity provider server system, a determination of whether the second end user is authorized to access the external service provider based on the entitlement data from the entitlements data store for the second end user with respect to the external service provider;
upon a determination by the identity provider server system that the first end user is authorized to access the external service provider, sending, by the identity provider server system, a SAML token to the first end user, wherein the SAML token comprises an XML representation of entitlement information for the first end user for the external service provider, and wherein the XML representation of the entitlement information in the SAML token is based on the entitlement data for the first end user stored in the entitlements data store, wherein the XML representation in the SAML token comprises one or more XML representations about the permitted actions that the first end user is permitted to perform on the resources hosted by the external service provider; and
upon a determination by the identity provider server system that the second end user is not authorized to access the external service provider, sending, by the identity provider server system, a message to be displayed for the second end user that second end user is not authorized to access the external service provider, wherein the process of authorizing the second end user is terminated upon display of the message such that enterprise-specific data for the request from the second end user is not sent outside of the enterprise network computer system.