Abstract:
A web browser sends to a web-application server a request to access a web application. The web server transmits to the web browser a parent document with an inline frame (iframe) containing a Uniform Resource Locator (URL) to an authentication location. in response, a child document is transferred to the web browser. The child document occludes the parent document and presents a user interface for user authentication. Rather than wait until authentication is complete to begin transferring prerequisite files, the web-application server at least partially transfers to the web browser prerequisite files for the web application during the authentication process. This reduces the post-authentication delay involved in transferring prerequisite files, improving the user experience.

Description:
BACKGROUND 
       [0001]    Web applications are applications accessed over a network using a web browser. E-mail, social media sites, online retail sites, and online banking are familiar examples of online applications. Many online applications require user authentication, i.e., a determination that a user accessing an online application is who the user purports to be. For example, a password, a certificate, a verifiable contact address (e.g., email address or cell phone number), or a combination of such identifiers, can be used to authenticate a user. 
         [0002]    In some cases, an authentication procedure can be built into an application. In other cases, the authentication procedure can exist is independently of the application. For example, rather than require separate authentications for each of a suite of web applications, the web applications can share a single-sign-on (SSC)) procedure so that a user authenticated for one web application can use the others without additional authentication procedures. Once a user is authenticated and all the prerequisite files, if any, for a web application have been transferred, the user can use the web application. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0003]      FIG. 1  is a schematic diagram of a web-application system in accordance with the present invention. 
           [0004]      FIG. 2  is a flow chart of a process in accordance with the present invention. 
           [0005]      FIG. 3  is a more detailed schematic diagram of the web-application system of  FIG. 1 . 
       
    
    
     DETAILED DESCRIPTION 
       [0006]    Some web applications require transferring of prerequisite files before a user can begin to use the web application. For example, in the case of a web application (e.g., based on Adobe Flash, Oracle JAVA, or Microsoft Active X) a number of runtime libraries may have to be transferred before the user can use the web application. The present invention provides a way for a web-application server to transfer prerequisite files while a separate authentication server handles authentication. Since transferring of prerequisite files begins before rather than after authentication is completed, the delay between the time a user is authenticated and the time the user can actually use the web application is reduced, enhancing the user experience. 
         [0007]    As shown in  FIG. 1 , a web-application system  100  includes a web-application server  102 , an authentication server  104 , and a client computer  106 . Web-application server  102  includes a web application  108  and hardware  110  for executing a server-side portion of web application  108 . Hardware  110  can include one or more processors, communications devices, and non-transitory storage media encoded with code defining web application  108  and associated software including an operating-system instance and a file server. Web-application server  102  may be referred to as a “web-application stack” as it includes the server-side portion of a web application and all the software and hardware required to run the server-side portion of the web application. Depending on the embodiment, a web-application server can include a portion of a physical computer, an entire physical computer, or plural physical computers. 
         [0008]    Authentication server  104  includes an authentication program  112  and hardware  114 . Hardware  114  can include processors, communications devices, and non-transitory storage media encoded with code defining authentication program  112  and an operating system. Authentication server  104  can serve as an “authentication stack” as it includes an authentication. program and all the software and hardware required for a server-side portion of the authentication program to execute. 
         [0009]    Client computer  106  includes a web browser  116  and hardware  118  on which the web browser can execute. Hardware  118  can include one or more processors, communications devices, and non-transitory media encoded with code defining web browser  116  and other software (e.g., an operating-system instance) on which web browser  116  executes. Client computer  106  serves as a browser stack including a web browser, an operating-system instance on which the web browser runs, and the hardware on which the operating system runs. 
         [0010]    A user-authentication process  200 , implementable on web-application system  100  and other systems, is flow charted in  FIG. 2 . At  201 , a user, using a web browser executing on a client computer, transmits a request to access a web application. The request can be made to a web-application server. In an alternative embodiment, the request is made to an authentication server. 
         [0011]    At  202 , the web-application server transfers, to a browser executing on a client computer, a parent document, such as document  120  in  FIG. 1 . The parent document may serve, when loaded, as a user interface for the web application and may serve other purposes as well. The parent document may specify a location to which an authentication request may be sent. For example, the parent document may include an iframe specifying a Uniform Resource Locator (URL). Herein, an “iframe” is an inline frame that can. contain its own request, e.g., an authentication. request, in the illustrated embodiment, the authentication location is associated with the authentication server, to which the authentication request is sent. However, in an alternative embodiment, the authentication location is associated with the web-application server, which redirects the authentication request to the authentication server. 
         [0012]    At  203 , the browser sends an authentication request to the location specified in the parent document and the web-application server starts sending prerequisite files to the browser. During authentication, the web-application server transfers to the web browser at least some portion of the rerequisite files, e.g. run-time modules, for the web application. This transferring can begin at the time the parent document is sent or any time after through authentication. The transfer of prerequisite files may finish before authentication is complete or continue past authentication. 
         [0013]    At  204 , the authentication server transfers a child document to the web browser. The child document can occlude, i.e., block, the parent document, as shown for child document  122  in  FIG. 1 . The occlusion can be partial or total; in either case, the user is prevented from interacting with the parent document while the child document is occluding it. The child document can include a user interface for authentication. 
         [0014]    At  205 , the user interacts with the authentication (child) document, for example, entering a user name, a password, and/or credentials. The interaction can include an action causing the authentication information to be uploaded to the authentication server. At  206 , a determination is made whether or not the user is authenticated. 
         [0015]    If at  206 , the user is authenticated, then, at  207 , the child document is removed, revealing the parent document. If, by this time, the web-application prerequisites have not completed transferring, the transferring o prerequisite files is completed at  208 . At  209 , the user uses the web application by interacting with the parent page. 
         [0016]    If at  206 , the authentication fails, then, at  210 , the user is informed that authentication has failed. In an embodiment, the web-application server is also informed of the authentication failure so that it can halt transferring of prerequisite files prior to completion at  211 . However, in web-application system  100 , the authentication server does not inform the web-application server directly of the authentication results as the user may retry authentication. 
         [0017]    More of the context of web-application system  100  is shown in  FIG. 3 . Web-application server  102  and authentication server  104  belong to a network of web servers  302  that also includes other web servers. The other web servers include web-application servers  304  and  306  that serve different ones of a suite of web applications for using and managing virtual infrastructures, including virtual infrastructures  308  and  310 . A virtualization layer  312  virtualizes a physical infrastructure  314  to generate the virtual infrastructures. 
         [0018]    The virtual infrastructures may be used and managed by different entities, e.g., different customers of a cloud-services entity that owns and manages physical infrastructure  314 . Each customer interfaces with its own virtual infrastructure without regard to coexisting virtual infrastructures. The cloud-services entity provisions and manages physical infrastructure  314  and virtualization layer  312 . 
         [0019]    For example, web application  108  ( FIG. 1 ) may be vSphere, available from VMware Inc., for managing virtual infrastructures, e.g., reconfiguring virtual servers and networks. Users, accessing vSphere on web-application server  102  can manage their respective virtual infrastructures. Web-application system  100  uses the authentication process to match a user making a request to the virtual infrastructure the user is authorized to manage. 
         [0020]    A user attempting to use web application  108  is authenticated using single-sign-on (SSO) authentication server  104 . Once a user is authenticated, the user is then also authenticated for using different web applications, e.g., executing on. web-application. servers  304  and  306  without further authentication. Such a single-sign-on context is one reason an authentication process would be independent from the web application for which authentication is required. 
         [0021]    The present invention provides for alternative types of communications between a web-application server and an authentication server. In the illustrated embodiment, the web-application server forwards an authentication request to the authentication server, and the authentication server informs the web-application server of the authentication results. When the web application is informed that the authentication has failed, the web-application server can halt transferring of the prerequisite files. Alternatively, there may be no direct notification of authentication results from the authentication server to the web-application server; in which case, transferring of prerequisite files may not be halted, but the user cannot use the web application as the parent document continues to be occluded by the child document. In an embodiment in which the URL in the iframe specifies a location associated with the authentication server (instead of being associated with the web-application server), the authentication server can notify the web-application server that the request for authentication has been received. 
         [0022]    In an embodiment in which a user first accesses the authentication server, the authentication server can speculate as to the web application to be accessed based on a user&#39;s profile or history. The authentication server can then notify the respective web-application server to begin transferring prerequisite files. 
         [0023]    Herein, a “system” is a set of interacting non-transitory tangible elements, wherein the elements can be, by way of example and not of limitation, mechanical components, electrical elements, atoms, physical encodings of instructions, and process segments. Herein, “process” refers to a sequence of actions resulting in or involving a physical transformation. 
         [0024]    Herein, “process container” encompasses process containers running on the same operating-system instance and process containers running on separate operating-system instances. Typically, processes executing in the same process container may communicate directly with each other, whereas processes executing in separate process containers, if communication is possible at all, must communicate through controlled channels. Herein, the browser, the authentication program, and the web application. execute in separate process containers. 
         [0025]    Herein, a “stack” is a combination of a mission program (e.g., a web application), any hardware required to execute the application, and any additional software (e.g., an operating system) required to execute the application. For an application running on a virtual machine, the stack would include the application, the guest operating system (OS), the virtualizing-host OS, and the hardware on which the host OS executes. 
         [0026]    “Occlude” herein means “to block a view so as to obstruct user interaction with”. The blocking can be such that the occluded object is not visible at all or such that the occluded object is partially visible. In either case, user interaction with the occluded object is obstructed in some way. For an object to be occluded, it must be present, e.g., defined by code to exist in a given location over which the occluding object is defined. 
         [0027]    In this Specification, related art is discussed for expository purposes. Related art labeled “prior art”, if any, is admitted prior art. Related art not labeled “prior art” is not admitted prior art. In addition to the examples presented herein, other variations upon and modifications to the illustrated. embodiments are within the scope of the following claims.