Patent ID: 9286465
Filing Date: 2016-03-15
CPC Classification: G06F,H04L

Claim Text:
1. A computer-implemented method for execution in a system comprising a plurality of domains, a plurality of authentication servers, and an authentication broker layer spanning the plurality of domains, the method comprising: performing a first brokering operation to establish a first trusted relationship in an authentication broker layer between a first authentication server in a first domain and a second authentication server in a second domain, the first domain comprising a client and the first authentication server in the authentication broker layer and the second domain comprising a resource and the second authentication server in the authentication broker layer, the first trusted relationship established via a request to establish trust by the first authentication server in the first domain to the second authentication server in the second domain, a challenge for authentication issued by the second authentication server in the second domain to the first authentication server in the first domain, and authentication credentials provided by the first authentication server in the first domain to the second authentication server in the second domain; in response to receiving in the first domain a rejection from the second domain of an attempt by the client in the first domain to access the resource in the second domain, the rejection requiring authentication of the client in the first domain with the second domain, performing a second brokering operation to establish a second trusted relationship spanning the first domain and the second domain between the client in the first domain and the resource in the second domain, the second trusted relationship established via an authenticated request from the client in the first domain to the authentication broker layer for a token authorizing access to the resource in the second domain, the token received by the client in the first domain from the second authentication server in the second domain, and a request including the token from the client in the first domain to access the resource in the second domain; and enabling the client in the first domain to access the resource in the second domain according to the first trusted relationship in the authentication broker layer between the first authentication server in the first domain and the second authentication server in the second domain established by the first brokering operation and the second trusted relationship spanning the first domain and the second domain between the client in the first domain and the resource in the second domain established by the second brokering operation.