Patent ID: 8327426
Filing Date: 2012-12-04
Classification: G06F,H04L

Abstract:
1. A machine-implemented method to execute on a machine, comprising: receiving, by the machine, an authentication request from a principal, the request directed by the principal to an external service and intercepted by the method for receipt; authenticating, by the machine, the principal; and supplying, by the machine, an authentication message for use by an identity service on behalf of the principal, the authentication message serves as a new authentication request and as a new authentication response for single sign-on access of the principal to the identity service and other services external or internal to the identity service, the identity service acts as a proxy for access sessions to the other services on behalf of the principal, the principal's access sessions occur indirectly through the identity service and transparently to the principal, wherein the authentication message includes the new authentication request made on behalf of the principal and the authentication message also includes a new authentication response that satisfies the new authentication request, that response vouches for authentication of the principal to the identity service for the single sign-on access of the principal, the principal believing interactions are with the external service, which is one of the other services that the identity service controls access to, and a determination as to whether to use a single interaction or multiple interactions for authentication of the principal to the other services is automatically communicated in the new authentication response.