US20140122870A1 - Utilizing X.509 Authentication for Single Sign-On Between Disparate Servers - Google Patents
Utilizing X.509 Authentication for Single Sign-On Between Disparate Servers Download PDFInfo
- Publication number
- US20140122870A1 US20140122870A1 US13/666,397 US201213666397A US2014122870A1 US 20140122870 A1 US20140122870 A1 US 20140122870A1 US 201213666397 A US201213666397 A US 201213666397A US 2014122870 A1 US2014122870 A1 US 2014122870A1
- Authority
- US
- United States
- Prior art keywords
- server
- user
- certificate
- currently logged
- sap
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0815—Network architectures or network communication protocols for network security for authentication of entities providing single-sign-on or federations
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
Definitions
- Enterprise software Today, many business and government organizations utilize enterprise software for performing various business functions and providing services. Business functions may include order processing, procurement, production scheduling, customer information management, energy management, and accounting. Services provided by enterprise software are typically business-oriented tools such as online shopping and online payment processing, interactive product catalogue, automated billing systems, security, enterprise content management, IT service management, customer relationship management, enterprise resource planning, business intelligence, project management, collaboration, human resource management, manufacturing, enterprise application integration, and enterprise forms automation. Enterprise software is typically hosted on servers and provides simultaneous services to a large number of users, typically over a computer network. This is in contrast to a single-user application that is executed on a user's personal computer and serves only one user at a time. Enterprise software which is utilized by many business and government organizations includes the SAP application from SAP AG CORPORATION of Walldorf, Germany.
- Enterprise software is often integrated with web application platforms hosted by separate servers to enable users to remotely access data hosted by enterprise software servers by initiating a “sign-on” operation (i.e., a user name login) from a web application platform server to an enterprise software server.
- web application platform may include the SHAREPOINT SERVER application from MICROSOFT CORPORATION of Redmond, Wash.
- One known problem associated with accessing data between web application platform servers and enterprise software servers is associated with the authentication required for performing a single sign-on operation to enable all of the various security settings and data access privileges required for accessing data on enterprise software servers.
- Previous solutions for solving the aforementioned problem have included the use of Security Assertion Markup Language (“SAML”) token authentication with the open data protocol (“OData”).
- SAML Security Assertion Markup Language
- OData open data protocol
- OData is utilized by some web application platform software and enterprise application software applications for querying and updating data over Hypertext Transfer Protocol (“HTTP”), including the SHAREPOINT SERVER application software and the SAP application software.
- HTTP Hypertext Transfer Protocol
- SHAREPOINT SERVER application software and the SAP application software are examples of Hypertext Transfer Protocol
- OData does not prescribe any authentication method when used with SAML. It is with respect to these considerations and others that the various embodiments of the present invention have been made.
- Embodiments are provided for utilizing an authentication scheme to facilitate a single sign-on operation between disparate servers.
- One or more servers receives a data request directed to a disparate server (e.g., an SAP server).
- a root certificate (e.g., an X.509 root certificate) is loaded for accessing the disparate server via a single sign-on operation.
- a user certificate is dynamically generated for identifying a logged-in user. It should be understood however, that in alternative embodiment, the user certificate may be pre-generated during configuration and stored in a secure store service. Following the generation of the user certificate, the user certificate is signed with the root certificate and sent to the disparate server for binding with the data request.
- the data request is sent to the disparate server for authentication using the user certificate.
- the disparate server accesses a mapping table to map a subject name in the user certificate.
- mapping table When an entry for the logged-in user is found in the mapping table, data operations are enabled between the servers.
- An open web protocol response containing the requested data is then received from the disparate server.
- FIG. 1 is a block diagram illustrating a network architecture for utilizing an authentication scheme for a single sign-on between disparate servers, in accordance with various embodiments
- FIG. 2 is a block diagram illustrating a user mapping table which is utilized in executing a single sign-on between disparate servers, in accordance with various embodiments;
- FIG. 3 is a flow diagram illustrating a routine for utilizing an authentication scheme for a single sign-on between disparate servers, in accordance with various embodiments
- FIG. 4 is a simplified block diagram of a computing device with which various embodiments may be practiced
- FIG. 5A is a simplified block diagram of a mobile computing device with which various embodiments may be practiced
- FIG. 5B is a simplified block diagram of a mobile computing device with which various embodiments may be practiced.
- Embodiments are provided for utilizing an authentication scheme to facilitate a single sign-on operation between disparate servers.
- One or more servers receives a data request directed to a disparate server (e.g., an SAP server).
- a root certificate (e.g., an X.509 root certificate) is loaded for accessing the disparate server via a single sign-on operation.
- a user certificate is dynamically generated for identifying a logged-in user. Then, the user certificate is signed with the root certificate and sent to the disparate server for binding with the data request.
- the data request is sent to the disparate server for authentication using the user certificate.
- the disparate server accesses a mapping table to map a subject name in the user certificate.
- the disparate server may verify that the user certificate is valid. Since the disparate server was previously configured to know about the root certificate, the disparate server may use this knowledge to validate that the data request came from a trusted originating server. When an entry for the logged-in user is found in the mapping table, data operations are enabled between the servers. An open web protocol response containing the requested data is then received from the disparate server.
- FIG. 1 is a block diagram illustrating a network architecture for utilizing an authentication scheme for a single sign-on between disparate servers, in accordance with various embodiments.
- the network architecture includes one or more servers 10 (hereinafter referred to as “the server 10 ”) in communication with a server 30 .
- the server 10 may comprise one or more computers configured for executing the SHAREPOINT SERVER application from MICROSOFT CORPORATION of Redmond, Wash.
- the server 10 may comprise multiple computers (i.e., a server farm) where each server is configured for executing the aforementioned SHAREPOINT SERVER application. It should be appreciated, however, that other server applications from other manufacturers may be utilized in accordance with the various embodiments described herein.
- the server 30 may comprise an SAP gateway which is configured for executing the SAP application from SAP AG CORPORATION of Walldorf, Germany.
- the SAP application may be utilized by an enterprise for performing various business functions and providing services. Business functions may include order processing, procurement, production scheduling, customer information management, energy management, and accounting.
- Services may include business-oriented tools such as online shopping and online payment processing, interactive product catalogue, automated billing systems, security, enterprise content management, IT service management, customer relationship management, enterprise resource planning, business intelligence, project management, collaboration, human resource management, manufacturing, enterprise application integration, and enterprise forms automation. It should be appreciated, however, that other enterprise software from other manufacturers may be utilized in accordance with the various embodiments described herein.
- the servers 10 and 30 may each be utilized by administrators 2 and 4 (e.g., a SHAREPOINT administrator and an SAP administrator).
- the administrator 2 may utilize the application 12 to initiate the creation of a root certificate 6 and the communication of the root certificate 6 to the administrator 4 .
- the administrator 4 may initiate the storing of the root certificate 6 into a certificate trust store 32 on the server 30 .
- the root certificate 6 may comprise an X.509 root certificate.
- X.509 is an ITU-T standard for public key infrastructure (“PKI”) and privilege management infrastructure (“PMI”).
- X.509 may specify, among other things, standard formats for public key certificates, certificate revocation lists, attribute certificates, and a certification path validation algorithm.
- a certification authority may issue a certificate which binds a public key to a particular distinguished name or to an alternative name such as an e-mail address or a DNS-entry.
- the server 10 may also be utilized by end user 70 for retrieving requested data.
- the end user 70 may utilize browser application 72 to log-in to a SHAREPOINT server for data retrieval.
- the server 10 may include an application 12 , application configuration application program interfaces (“APIs”) 14 , a secure store service 16 , an application open data protocol (“Odata”) extension provider 18 and a business connectivity services (“BCS”)/hybrid remoter 20 .
- the application 12 may comprise the DUET ENTERPRISE software jointly developed by MICROSOFT CORPORATION of Redmond, Wash. and SAP AG CORPORATION of Walldorf, Germany.
- DUET ENTERPIRSE software blends SAP and SHAREPOINT functionality by combining collaboration and productivity with business data and processes.
- the application 12 may be configured to utilize the root certificate 6 in dynamically creating a user certificate for enabling single sign-on operations with the server 30 .
- the application configuration APIs 14 may be utilized for receiving the root certificate 6 created by the application 12 and to store the root certificate 6 in the secure store service 16 .
- the application OData extension provider 18 is a software plug-in for the BCS/Hybrid remoter 20 .
- the application OData extension provider 18 may be configured receive the root certificate 6 from the secure store service 16 in addition to a domain user.
- the OData extension provider 18 may also be configured to output a dynamically created user certificate 8 for enabling single sign-on operations with the server 30 (the details of which will be discussed below with respect to FIG. 3 ) and a user certificate subject name in a format which is consistent and agreed upon between the server 10 and the server 30 .
- the user certificate 8 may comprise an X.509 user certificate.
- OData is an open web protocol for querying and updating data.
- the protocol allows for querying a data source over the HTTP protocol and to receive results back in any of a number of formats including, without limitation, plain extensible markup language (“XML”), Atom (an XML language utilized for web feeds) and JavaScript Object Notation (“JSON”).
- the results may include pagination, ordering or filtering of data.
- XML plain extensible markup language
- Atom an XML language utilized for web feeds
- JSON JavaScript Object Notation
- the results may include pagination, ordering or filtering of data.
- GData GOOGLE data protocol
- GData GOOGLE data protocol
- the BCS/Hybrid remoter 20 may be utilized to call the application OData extension provider 18 to retrieve the dynamically created user certificate 8 and the user certificate subject name for sending to the server 30 . It should be understood that, in accordance with an embodiment, all authentication and data exchange (including calls) between the server 10 and the server 30 occur over Hypertext Transfer Protocol Secure (“HTTPS”).
- HTTPS Hypertext Transfer Protocol Secure
- the server 30 may include the certificate trust store 32 , a user mapping table 34 , OData 36 and an active directory (“AD”) import tool 38 .
- the certificate trust store 32 may be utilized to store the root certificate 6 received from the server 10 .
- the user mapping table 34 may comprise user mappings for users of the server 10 .
- the user mappings may comprise a list of user certificate 8 subject names (along with associated domains) for users of the server 10 (i.e., external IDs) and a corresponding list of user names (i.e., SAP IDs) in a format compatible for accessing the various functions and services provided by the server 30 .
- the OData 36 in the server 30 represents a server protocol service (e.g., an SAP OData protocol service) which is utilized for accepting the dynamically generated user certificate 8 from the BCS/Hybrid remoter 20 on the server 10 in order to enable a single sign-on between the server 10 and the sever 30 .
- a server protocol service e.g., an SAP OData protocol service
- FIG. 2 is a block diagram illustrating the user mapping table 34 which is utilized in executing a single sign-on between disparate servers, in accordance with various embodiments.
- the user mapping table 34 may include a list of external IDs 50 for users of the sever 10 and a list of IDs 60 (e.g. SAP IDs) formatted for use on the server 30 .
- the list of external IDs 50 may include IDs 52 , 54 , 56 and 58 which are each formatted according to a user name and either an on-premises domain or an online domain.
- Joe and Jack are employees of the Contoso company who wish to access company human resources data which is remotely hosted on an SAP server (i.e., the server 30 ) via a single sign-on operation from an on-premises company server (i.e., the server 10 ).
- the company administrator determines that both Joe and Jack are mixed domain users of the company server. That is, sometimes Joe and Jack access the company server while on the company premises via SHAREPOINT on-premises (e.g., Contoso company headquarters) while other times Joe and Jack access the company server from home-based client computers online via SHAREPOINT online.
- the user mapping table 34 may be populated with two external IDs for each user.
- the list of IDs 60 (e.g., the SAP IDs) may include IDs 62 , 64 , 66 and 68 , and be associated with a corresponding external ID 50 .
- the IDs 62 and 64 i.e., SAP-Joe
- FIG. 3 is a flow diagram illustrating a routine 300 for utilizing an authentication scheme for a single sign-on between disparate servers, in accordance with various embodiments.
- routines for utilizing an authentication scheme for a single sign-on between disparate servers, in accordance with various embodiments.
- the logical operations of various embodiments of the present invention are implemented (1) as a sequence of computer implemented acts or program modules running on a computing system and/or (2) as interconnected machine logical circuits or circuit modules within the computing system.
- the implementation is a matter of choice dependent on the performance requirements of the computing system implementing the invention. Accordingly, the logical operations illustrated in FIG. 3 and making up the various embodiments described herein are referred to variously as operations, structural devices, acts or modules.
- the routine 300 begins at operation 305 , where the server 10 receives a data request directed to the server 30 .
- a data request directed to the server 30 .
- a user of a SHAREPOINT server may wish to access company human resources data stored on an SAP gateway server.
- the server 10 may prepare to forward the request to the server 30 as part of a single-sign on operation which will be described in detail below.
- the routine 300 continues to operation 310 , where the server 10 may load a root certificate for accessing the server 30 via a single sign-on operation.
- the X.509 root certificate 6 may be retrieved from the secure store service 16 on the server 10 . It should be understood that the root certificate is trusted by both the server and the server 30 .
- the routine 300 continues to operation 315 , where the server 10 may dynamically generate a user certificate for identifying a currently logged-in user.
- the application 12 may utilize the application OData extension provider 18 to generate the X.509 user certificate 8 for identifying users a currently logged-in on-premises user of the server 10 and/or a currently logged-in online user of the server 10 .
- the server 10 may provide support for both multiple domain users and mixed mode environments (e.g., SHAREPOINT on-premises and SHAREPOINT online).
- routine 300 continues to operation 320 , where the server 10 may sign the dynamically generated user certificate with the root certificate.
- the server 10 may sign the dynamically generated user certificate with the root certificate.
- the X.509 user certificate 8 may be signed by the X.509 root certificate 6 .
- the routine 300 continues to operation 325 , where the server 10 may send the dynamically user certificate to the server 30 for binding with the data request received at operation 305 .
- the application OData extension provider 18 may send the X.509 user certificate 8 to the BCS/Hybrid remoter 20 for binding the X.509 user certificate 8 to an outgoing HTTPS request directed to the OData 36 on the server 30 .
- the routine 300 continues to operation 330 , where the server 10 may send the data request for authentication using the dynamically generated user certificate.
- the BCS/Hybrid remoter 20 may bind the X.509 user certificate 8 , received from the OData extension provider 18 , to an outgoing HTTPS request directed to the OData 36 on the server 30 .
- a trust chain of the X.509 user certificate 8 may be authenticated by the server 30 accessing the mapping table 34 .
- the server 30 may access the mapping table 34 to map a subject name in the X.509 user certificate 8 to an SAP user.
- an error code (e.g., an HTTP 403 “Forbidden” error code) may be returned as the HTTP response from the server 30 .
- the routine 300 continues to operation 335 , where the server 10 may enable a single sign-on for the currently logged-in user with the server 30 upon an entry being found in the mapping table for the currently logged-in user.
- a security context for the currently logged-in user is created on the sever 30 and subsequent data operations (e.g., SAP data operations) will occur with the aforementioned user context.
- SAP data operations e.g., SAP data operations
- the routine 300 continues to operation 340 , where the server 10 may receive a response containing the requested data from the server 30 .
- the server 10 may receive an OData response containing requested SAP data from the server 30 . It should be understood that if the data request was originally made from an online SHAREPOINT user, the OData response may be channeled via the BCS/Hybrid remoter 20 back to SHAREPOINT online. From operation 340 , the routine 300 then ends.
- FIG. 4 is a block diagram illustrating example physical components of a computing device 400 with which various embodiments may be practiced.
- the computing device 400 may include at least one processing unit 402 and a system memory 404 .
- system memory 404 may comprise, but is not limited to, volatile (e.g. random access memory (RAM)), non-volatile (e.g. read-only memory (ROM)), flash memory, or any combination.
- System memory 404 may include an operating system 405 and application 407 .
- Operating system 405 for example, may be suitable for controlling computing device 400 's operation and, in accordance with an embodiment, may comprise the WINDOWS operating systems from MICROSOFT CORPORATION of Redmond, Wash.
- the application 407 may comprise functionality for performing one or more of the operations in the routine 300 described above with respect to FIG. 3 . It should be understood, however, that the embodiments described herein may also be practiced in conjunction with other operating systems and application programs and further, is not limited to any particular application or system.
- the computing device 400 may have additional features or functionality.
- the computing device 400 may also include additional data storage devices (removable and/or non-removable) such as, for example, magnetic disks, optical disks, solid state storage devices (“SSD”), flash memory or tape.
- additional storage is illustrated in FIG. 4 by a removable storage 409 and a non-removable storage 410 .
- the computing device 400 may also have input device(s) 412 such as a keyboard, a mouse, a pen, a sound input device (e.g., a microphone) for receiving a voice input, a touch input device for receiving gestures, etc.
- Output device(s) 414 such as a display, speakers, a printer, etc. may also be included.
- the aforementioned devices are examples and others may be used.
- program modules may be provided which include routines, programs, components, data structures, and other types of structures that may perform particular tasks or that may implement particular abstract data types.
- various embodiments may be practiced with other computer system configurations, including hand-held devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, minicomputers, mainframe computers, automotive computing systems and the like.
- Various embodiments may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network.
- program modules may be located in both local and remote memory storage devices.
- various embodiments may be practiced in an electrical circuit comprising discrete electronic elements, packaged or integrated electronic chips containing logic gates, a circuit utilizing a microprocessor, or on a single chip containing electronic elements or microprocessors.
- various embodiments may be practiced via a system-on-a-chip (“SOC”) where each or many of the components illustrated in FIG. 4 may be integrated onto a single integrated circuit.
- SOC system-on-a-chip
- Such an SOC device may include one or more processing units, graphics units, communications units, system virtualization units and various application functionality all of which are integrated (or “burned”) onto the chip substrate as a single integrated circuit.
- the functionality, described herein may operate via application-specific logic integrated with other components of the computing device/system 400 on the single integrated circuit (chip).
- Embodiments may also be practiced using other technologies capable of performing logical operations such as, for example, AND, OR, and NOT, including but not limited to mechanical, optical, fluidic, and quantum technologies.
- embodiments may be practiced within a general purpose computer or in any other circuits or systems.
- Various embodiments may be implemented as a computer process (method), a computing system, or as an article of manufacture, such as a computer program product or computer readable media.
- the computer program product may be a computer storage media readable by a computer system and encoding a computer program of instructions for executing a computer process.
- Computer readable media may include computer storage media.
- Computer storage media may include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information (such as computer readable instructions, data structures, program modules, or other data) in hardware.
- the system memory 404 , removable storage 409 , and non-removable storage 410 are all computer storage media examples (i.e., memory storage.)
- Computer storage media may include, but is not limited to, RAM, ROM, electrically erasable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store information and which can be accessed by the computing device 400 . Any such computer storage media may be part of the computing device 400 .
- Computer readable media may also include communication media.
- Communication media may be embodied by computer readable instructions, data structures, program modules, or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and includes any information delivery media.
- modulated data signal may describe a signal that has one or more characteristics set or changed in such a manner as to encode information in the signal.
- communication media may include wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, radio frequency (RF), infrared, and other wireless media.
- RF radio frequency
- FIGS. 5A and 5B illustrate a suitable mobile computing environment, for example, a mobile computing device 550 which may include, without limitation, a smartphone, a tablet personal computer, a laptop computer, and the like, with which various embodiments may be practiced.
- a mobile computing device 550 for implementing various embodiments is illustrated.
- mobile computing device 550 is a handheld computer having both input elements and output elements.
- Input elements may include touch screen display 525 and input buttons 510 that allow the user to enter information into mobile computing device 550 .
- Mobile computing device 550 may also incorporate an optional side input element 520 allowing further user input.
- Optional side input element 520 may be a rotary switch, a button, or any other type of manual input element.
- mobile computing device 550 may incorporate more or less input elements.
- display 525 may not be a touch screen in some embodiments.
- the mobile computing device is a portable telephone system, such as a cellular phone having display 525 and input buttons 510 .
- Mobile computing device 550 may also include an optional keypad 594 .
- Optional keypad 594 may be a physical keypad or a “soft” keypad generated on the touch screen display.
- Mobile computing device 550 incorporates output elements, such as display 590 , which can display a graphical user interface (GUI). Other output elements include speaker 530 and LED light 580 . Additionally, mobile computing device 550 may incorporate a vibration module (not shown), which causes mobile computing device 550 to vibrate to notify the user of an event. In yet another embodiment, mobile computing device 550 may incorporate a headphone jack (not shown) for providing another means of providing output signals.
- output elements such as display 590 , which can display a graphical user interface (GUI).
- GUI graphical user interface
- Other output elements include speaker 530 and LED light 580 .
- mobile computing device 550 may incorporate a vibration module (not shown), which causes mobile computing device 550 to vibrate to notify the user of an event. In yet another embodiment, mobile computing device 550 may incorporate a headphone jack (not shown) for providing another means of providing output signals.
- headphone jack not shown
- any computer system having a plurality of environment sensors, a plurality of output elements to provide notifications to a user and a plurality of notification event types may incorporate the various embodiments described herein.
- FIG. 5B is a block diagram illustrating components of a mobile computing device used in one embodiment, such as the mobile computing device 550 shown in FIG. 5A .
- mobile computing device 550 can incorporate a system 502 to implement some embodiments.
- system 502 can be used in implementing a “smart phone” or tablet computer that can run one or more applications similar to those of a desktop or notebook computer.
- the system 502 is integrated as a computing device, such as an integrated personal digital assistant (PDA) and wireless phone.
- PDA personal digital assistant
- Application 567 may be loaded into memory 562 and run on or in association with an operating system (“OS”) 564 .
- the system 502 also includes non-volatile storage 568 within memory the 562 .
- Non-volatile storage 568 may be used to store persistent information that should not be lost if system 502 is powered down.
- the application 567 may use and store information in the non-volatile storage 568 .
- a synchronization application (not shown) also resides on system 502 and is programmed to interact with a corresponding synchronization application resident on a host computer to keep the information stored in the non-volatile storage 568 synchronized with corresponding information stored at the host computer.
- other applications may also be loaded into the memory 562 and run on the mobile computing device 550 .
- the system 502 has a power supply 570 , which may be implemented as one or more batteries.
- the power supply 570 might further include an external power source, such as an AC adapter or a powered docking cradle that supplements or recharges the batteries.
- the system 502 may also include a radio 572 (i.e., radio interface layer) that performs the function of transmitting and receiving radio frequency communications.
- the radio 572 facilitates wireless connectivity between the system 502 and the “outside world,” via a communications carrier or service provider. Transmissions to and from the radio 572 are conducted under control of OS 564 . In other words, communications received by the radio 572 may be disseminated to the application 567 via OS 564 , and vice versa.
- the radio 572 allows the system 502 to communicate with other computing devices, such as over a network.
- the radio 572 is one example of communication media.
- the embodiment of the system 502 is shown with two types of notification output devices: LED 580 that can be used to provide visual notifications and an audio interface 574 that can be used with speaker 530 to provide audio notifications. These devices may be directly coupled to the power supply 570 so that when activated, they remain on for a duration dictated by the notification mechanism even though processor 560 and other components might shut down for conserving battery power.
- the LED 580 may be programmed to remain on indefinitely until the user takes action to indicate the powered-on status of the device.
- the audio interface 574 is used to provide audible signals to and receive audible signals from the user.
- the audio interface 574 may also be coupled to a microphone (not shown) to receive audible input, such as to facilitate a telephone conversation.
- the microphone may also serve as an audio sensor to facilitate control of notifications.
- the system 502 may further include a video interface 576 that enables an operation of on-board camera 540 (shown in FIG. 5A ) to record still images, video streams, and the like.
- a mobile computing device implementing the system 502 may have additional features or functionality.
- the device may also include additional data storage devices (removable and/or non-removable) such as, magnetic disks, optical disks, or tape.
- additional storage is illustrated in FIG. 5B by storage 568 .
- Data/information generated or captured by the mobile computing device 550 and stored via the system 502 may be stored locally on the mobile computing device 550 , as described above, or the data may be stored on any number of storage media that may be accessed by the device via the radio 572 or via a wired connection between the mobile computing device 550 and a separate computing device associated with the mobile computing device 550 , for example, a server computer in a distributed computing network such as the Internet.
- a server computer in a distributed computing network such as the Internet.
- data/information may be accessed via the mobile computing device 550 via the radio 572 or via a distributed computing network.
- data/information may be readily transferred between computing devices for storage and use according to well-known data/information transfer and storage means, including electronic mail and collaborative data/information sharing systems.
- FIG. 6 is a simplified block diagram of a distributed computing system in which various embodiments may be practiced.
- the distributed computing system may include number of client devices such as a computing device 603 , a tablet computing device 605 and a mobile computing device 610 .
- the client devices 603 , 605 and 610 may be in communication with a distributed computing network 615 (e.g., the Internet).
- a server 620 is in communication with the client devices 603 , 605 and 610 over the network 615 .
- the server 620 may store application 600 which may be perform routines including, for example, one or more of the operations in the routine 300 described above with respect to FIG. 3 .
Abstract
Description
- A portion of the disclosure of this patent document contains material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent file or records, but otherwise reserves all copyright rights whatsoever.
- Today, many business and government organizations utilize enterprise software for performing various business functions and providing services. Business functions may include order processing, procurement, production scheduling, customer information management, energy management, and accounting. Services provided by enterprise software are typically business-oriented tools such as online shopping and online payment processing, interactive product catalogue, automated billing systems, security, enterprise content management, IT service management, customer relationship management, enterprise resource planning, business intelligence, project management, collaboration, human resource management, manufacturing, enterprise application integration, and enterprise forms automation. Enterprise software is typically hosted on servers and provides simultaneous services to a large number of users, typically over a computer network. This is in contrast to a single-user application that is executed on a user's personal computer and serves only one user at a time. Enterprise software which is utilized by many business and government organizations includes the SAP application from SAP AG CORPORATION of Walldorf, Germany.
- Enterprise software is often integrated with web application platforms hosted by separate servers to enable users to remotely access data hosted by enterprise software servers by initiating a “sign-on” operation (i.e., a user name login) from a web application platform server to an enterprise software server. Once such web application platform may include the SHAREPOINT SERVER application from MICROSOFT CORPORATION of Redmond, Wash. One known problem associated with accessing data between web application platform servers and enterprise software servers is associated with the authentication required for performing a single sign-on operation to enable all of the various security settings and data access privileges required for accessing data on enterprise software servers. Previous solutions for solving the aforementioned problem have included the use of Security Assertion Markup Language (“SAML”) token authentication with the open data protocol (“OData”). OData is utilized by some web application platform software and enterprise application software applications for querying and updating data over Hypertext Transfer Protocol (“HTTP”), including the SHAREPOINT SERVER application software and the SAP application software. However, OData does not prescribe any authentication method when used with SAML. It is with respect to these considerations and others that the various embodiments of the present invention have been made.
- This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended as an aid in determining the scope of the claimed subject matter.
- Embodiments are provided for utilizing an authentication scheme to facilitate a single sign-on operation between disparate servers. One or more servers (e.g., a SHAREPOINT server) receives a data request directed to a disparate server (e.g., an SAP server). A root certificate (e.g., an X.509 root certificate) is loaded for accessing the disparate server via a single sign-on operation. A user certificate is dynamically generated for identifying a logged-in user. It should be understood however, that in alternative embodiment, the user certificate may be pre-generated during configuration and stored in a secure store service. Following the generation of the user certificate, the user certificate is signed with the root certificate and sent to the disparate server for binding with the data request. The data request is sent to the disparate server for authentication using the user certificate. The disparate server accesses a mapping table to map a subject name in the user certificate. When an entry for the logged-in user is found in the mapping table, data operations are enabled between the servers. An open web protocol response containing the requested data is then received from the disparate server.
- These and other features and advantages will be apparent from a reading of the following detailed description and a review of the associated drawings. It is to be understood that both the foregoing general description and the following detailed description are illustrative only and are not restrictive of the invention as claimed.
-
FIG. 1 is a block diagram illustrating a network architecture for utilizing an authentication scheme for a single sign-on between disparate servers, in accordance with various embodiments; -
FIG. 2 is a block diagram illustrating a user mapping table which is utilized in executing a single sign-on between disparate servers, in accordance with various embodiments; -
FIG. 3 is a flow diagram illustrating a routine for utilizing an authentication scheme for a single sign-on between disparate servers, in accordance with various embodiments; -
FIG. 4 is a simplified block diagram of a computing device with which various embodiments may be practiced; -
FIG. 5A is a simplified block diagram of a mobile computing device with which various embodiments may be practiced; -
FIG. 5B is a simplified block diagram of a mobile computing device with which various embodiments may be practiced; and -
FIG. 6 is a simplified block diagram of a distributed computing system in which various embodiments may be practiced. - Embodiments are provided for utilizing an authentication scheme to facilitate a single sign-on operation between disparate servers. One or more servers (e.g., a SHAREPOINT server) receives a data request directed to a disparate server (e.g., an SAP server). A root certificate (e.g., an X.509 root certificate) is loaded for accessing the disparate server via a single sign-on operation. A user certificate is dynamically generated for identifying a logged-in user. Then, the user certificate is signed with the root certificate and sent to the disparate server for binding with the data request. The data request is sent to the disparate server for authentication using the user certificate. The disparate server accesses a mapping table to map a subject name in the user certificate. It should be understood that, prior to consulting the mapping table, the disparate server may verify that the user certificate is valid. Since the disparate server was previously configured to know about the root certificate, the disparate server may use this knowledge to validate that the data request came from a trusted originating server. When an entry for the logged-in user is found in the mapping table, data operations are enabled between the servers. An open web protocol response containing the requested data is then received from the disparate server.
- In the following detailed description, references are made to the accompanying drawings that form a part hereof, and in which are shown by way of illustrations specific embodiments or examples. These embodiments may be combined, other embodiments may be utilized, and structural changes may be made without departing from the spirit or scope of the present invention. The following detailed description is therefore not to be taken in a limiting sense, and the scope of the present invention is defined by the appended claims and their equivalents.
- Referring now to the drawings, in which like numerals represent like elements through the several figures, various aspects of the present invention will be described.
FIG. 1 is a block diagram illustrating a network architecture for utilizing an authentication scheme for a single sign-on between disparate servers, in accordance with various embodiments. The network architecture includes one or more servers 10 (hereinafter referred to as “theserver 10”) in communication with aserver 30. In accordance with an embodiment, theserver 10 may comprise one or more computers configured for executing the SHAREPOINT SERVER application from MICROSOFT CORPORATION of Redmond, Wash. It should be understood that, in accordance with embodiment, theserver 10 may comprise multiple computers (i.e., a server farm) where each server is configured for executing the aforementioned SHAREPOINT SERVER application. It should be appreciated, however, that other server applications from other manufacturers may be utilized in accordance with the various embodiments described herein. In accordance with an embodiment, theserver 30 may comprise an SAP gateway which is configured for executing the SAP application from SAP AG CORPORATION of Walldorf, Germany. As is known to those skilled in the art, the SAP application may be utilized by an enterprise for performing various business functions and providing services. Business functions may include order processing, procurement, production scheduling, customer information management, energy management, and accounting. Services may include business-oriented tools such as online shopping and online payment processing, interactive product catalogue, automated billing systems, security, enterprise content management, IT service management, customer relationship management, enterprise resource planning, business intelligence, project management, collaboration, human resource management, manufacturing, enterprise application integration, and enterprise forms automation. It should be appreciated, however, that other enterprise software from other manufacturers may be utilized in accordance with the various embodiments described herein. - In accordance with an embodiment, the
servers administrators 2 and 4 (e.g., a SHAREPOINT administrator and an SAP administrator). In particular, theadministrator 2 may utilize theapplication 12 to initiate the creation of aroot certificate 6 and the communication of theroot certificate 6 to theadministrator 4. Theadministrator 4 may initiate the storing of theroot certificate 6 into acertificate trust store 32 on theserver 30. In accordance with an embodiment, theroot certificate 6 may comprise an X.509 root certificate. As known to those skilled in the art, X.509 is an ITU-T standard for public key infrastructure (“PKI”) and privilege management infrastructure (“PMI”). X.509 may specify, among other things, standard formats for public key certificates, certificate revocation lists, attribute certificates, and a certification path validation algorithm. In an X.509 system, a certification authority may issue a certificate which binds a public key to a particular distinguished name or to an alternative name such as an e-mail address or a DNS-entry. It should be understood that theserver 10 may also be utilized byend user 70 for retrieving requested data. For example, in accordance with an embodiment, theend user 70 may utilizebrowser application 72 to log-in to a SHAREPOINT server for data retrieval. - The
server 10 may include anapplication 12, application configuration application program interfaces (“APIs”) 14, asecure store service 16, an application open data protocol (“Odata”)extension provider 18 and a business connectivity services (“BCS”)/hybrid remoter 20. In accordance with an embodiment, theapplication 12 may comprise the DUET ENTERPRISE software jointly developed by MICROSOFT CORPORATION of Redmond, Wash. and SAP AG CORPORATION of Walldorf, Germany. As is known to those skilled in the art, DUET ENTERPIRSE software blends SAP and SHAREPOINT functionality by combining collaboration and productivity with business data and processes. As will be described in greater detail below with respect toFIG. 3 , theapplication 12 may be configured to utilize theroot certificate 6 in dynamically creating a user certificate for enabling single sign-on operations with theserver 30. - The
application configuration APIs 14 may be utilized for receiving theroot certificate 6 created by theapplication 12 and to store theroot certificate 6 in thesecure store service 16. The applicationOData extension provider 18 is a software plug-in for the BCS/Hybrid remoter 20. The applicationOData extension provider 18 may be configured receive theroot certificate 6 from thesecure store service 16 in addition to a domain user. TheOData extension provider 18 may also be configured to output a dynamically createduser certificate 8 for enabling single sign-on operations with the server 30 (the details of which will be discussed below with respect toFIG. 3 ) and a user certificate subject name in a format which is consistent and agreed upon between theserver 10 and theserver 30. In accordance with an embodiment, theuser certificate 8 may comprise an X.509 user certificate. As is known to those skilled in the art, OData is an open web protocol for querying and updating data. The protocol allows for querying a data source over the HTTP protocol and to receive results back in any of a number of formats including, without limitation, plain extensible markup language (“XML”), Atom (an XML language utilized for web feeds) and JavaScript Object Notation (“JSON”). The results may include pagination, ordering or filtering of data. It should be understood however, that the embodiments described herein are not limited to the OData protocol and that other web protocols for querying and updating data may also be utilized, including, for example, the GOOGLE data protocol (“GData”) from GOOGLE CORPORATION of Mountain View, Calif. - The BCS/
Hybrid remoter 20 may be utilized to call the applicationOData extension provider 18 to retrieve the dynamically createduser certificate 8 and the user certificate subject name for sending to theserver 30. It should be understood that, in accordance with an embodiment, all authentication and data exchange (including calls) between theserver 10 and theserver 30 occur over Hypertext Transfer Protocol Secure (“HTTPS”). - The
server 30 may include thecertificate trust store 32, a user mapping table 34,OData 36 and an active directory (“AD”)import tool 38. As discussed above, thecertificate trust store 32 may be utilized to store theroot certificate 6 received from theserver 10. The user mapping table 34 may comprise user mappings for users of theserver 10. The user mappings may comprise a list ofuser certificate 8 subject names (along with associated domains) for users of the server 10 (i.e., external IDs) and a corresponding list of user names (i.e., SAP IDs) in a format compatible for accessing the various functions and services provided by theserver 30. It should be understood that the aforementioned user mappings may be imported into the mapping table 34 using theAD import tool 38 which, in turn, may retrieve the user mappings from theactive directory 40. The user mapping table 34 will be described in greater detail below with respect toFIG. 2 . TheOData 36 in theserver 30 represents a server protocol service (e.g., an SAP OData protocol service) which is utilized for accepting the dynamically generateduser certificate 8 from the BCS/Hybrid remoter 20 on theserver 10 in order to enable a single sign-on between theserver 10 and thesever 30. -
FIG. 2 is a block diagram illustrating the user mapping table 34 which is utilized in executing a single sign-on between disparate servers, in accordance with various embodiments. In accordance with an embodiment, the user mapping table 34 may include a list ofexternal IDs 50 for users of thesever 10 and a list of IDs 60 (e.g. SAP IDs) formatted for use on theserver 30. In particular, the list ofexternal IDs 50 may includeIDs IDs IDs IDs external ID 50. Thus, for example, theIDs IDs 62 and 64 (i.e., SAP-Joe) while theIDs IDs -
FIG. 3 is a flow diagram illustrating a routine 300 for utilizing an authentication scheme for a single sign-on between disparate servers, in accordance with various embodiments. When reading the discussion of the routines presented herein, it should be appreciated that the logical operations of various embodiments of the present invention are implemented (1) as a sequence of computer implemented acts or program modules running on a computing system and/or (2) as interconnected machine logical circuits or circuit modules within the computing system. The implementation is a matter of choice dependent on the performance requirements of the computing system implementing the invention. Accordingly, the logical operations illustrated inFIG. 3 and making up the various embodiments described herein are referred to variously as operations, structural devices, acts or modules. It will be recognized by one skilled in the art that these operations, structural devices, acts and modules may be implemented in software, in firmware, in special purpose digital logical, and any combination thereof without deviating from the spirit and scope of the present invention as recited within the claims set forth herein. - The routine 300 begins at
operation 305, where theserver 10 receives a data request directed to theserver 30. For example, a user of a SHAREPOINT server may wish to access company human resources data stored on an SAP gateway server. Upon receiving the data request, theserver 10 may prepare to forward the request to theserver 30 as part of a single-sign on operation which will be described in detail below. - From
operation 305, the routine 300 continues tooperation 310, where theserver 10 may load a root certificate for accessing theserver 30 via a single sign-on operation. In particular, the X.509root certificate 6 may be retrieved from thesecure store service 16 on theserver 10. It should be understood that the root certificate is trusted by both the server and theserver 30. - From
operation 310, the routine 300 continues tooperation 315, where theserver 10 may dynamically generate a user certificate for identifying a currently logged-in user. In particular, theapplication 12 may utilize the applicationOData extension provider 18 to generate the X.509user certificate 8 for identifying users a currently logged-in on-premises user of theserver 10 and/or a currently logged-in online user of theserver 10. Thus, it should be understood that theserver 10 may provide support for both multiple domain users and mixed mode environments (e.g., SHAREPOINT on-premises and SHAREPOINT online). For example, in dynamically generating theuser certificate 8, a subject name for a currently logged-in on-premises user may be specified in a fixed format (e.g., CN=domain/username or CN=username@domain.com). - From
operation 315, the routine 300 continues tooperation 320, where theserver 10 may sign the dynamically generated user certificate with the root certificate. For example, the X.509user certificate 8 may be signed by the X.509root certificate 6. - From
operation 320, the routine 300 continues tooperation 325, where theserver 10 may send the dynamically user certificate to theserver 30 for binding with the data request received atoperation 305. In particular, the applicationOData extension provider 18 may send the X.509user certificate 8 to the BCS/Hybrid remoter 20 for binding the X.509user certificate 8 to an outgoing HTTPS request directed to theOData 36 on theserver 30. - From
operation 325, the routine 300 continues tooperation 330, where theserver 10 may send the data request for authentication using the dynamically generated user certificate. In particular, the BCS/Hybrid remoter 20 may bind the X.509user certificate 8, received from theOData extension provider 18, to an outgoing HTTPS request directed to theOData 36 on theserver 30. It should be understood that once theOData 36 receives the aforementioned HTTPS request, a trust chain of the X.509user certificate 8 may be authenticated by theserver 30 accessing the mapping table 34. In particular, theserver 30 may access the mapping table 34 to map a subject name in the X.509user certificate 8 to an SAP user. It should be understood that the authentication may fail if the X.509root certificate 6 has expired or not trusted. Under these circumstances, an error code (e.g., an HTTP 403 “Forbidden” error code) may be returned as the HTTP response from theserver 30. - From
operation 330, the routine 300 continues tooperation 335, where theserver 10 may enable a single sign-on for the currently logged-in user with theserver 30 upon an entry being found in the mapping table for the currently logged-in user. In particular, upon the entry being found, a security context for the currently logged-in user is created on thesever 30 and subsequent data operations (e.g., SAP data operations) will occur with the aforementioned user context. Thus, for example, all SAP authorizations configured for an SAP user will apply. It should be understood that if an entry is not found, an error code (e.g., an HTTP 403 “Forbidden” error code) may be returned as the HTTP response from theserver 30. - From
operation 335, the routine 300 continues tooperation 340, where theserver 10 may receive a response containing the requested data from theserver 30. In particular, theserver 10 may receive an OData response containing requested SAP data from theserver 30. It should be understood that if the data request was originally made from an online SHAREPOINT user, the OData response may be channeled via the BCS/Hybrid remoter 20 back to SHAREPOINT online. Fromoperation 340, the routine 300 then ends. -
FIG. 4 is a block diagram illustrating example physical components of acomputing device 400 with which various embodiments may be practiced. In a basic configuration, thecomputing device 400 may include at least oneprocessing unit 402 and asystem memory 404. Depending on the configuration and type of computing device,system memory 404 may comprise, but is not limited to, volatile (e.g. random access memory (RAM)), non-volatile (e.g. read-only memory (ROM)), flash memory, or any combination.System memory 404 may include anoperating system 405 andapplication 407.Operating system 405, for example, may be suitable for controllingcomputing device 400's operation and, in accordance with an embodiment, may comprise the WINDOWS operating systems from MICROSOFT CORPORATION of Redmond, Wash. Theapplication 407, for example, may comprise functionality for performing one or more of the operations in the routine 300 described above with respect toFIG. 3 . It should be understood, however, that the embodiments described herein may also be practiced in conjunction with other operating systems and application programs and further, is not limited to any particular application or system. - The
computing device 400 may have additional features or functionality. For example, thecomputing device 400 may also include additional data storage devices (removable and/or non-removable) such as, for example, magnetic disks, optical disks, solid state storage devices (“SSD”), flash memory or tape. Such additional storage is illustrated inFIG. 4 by aremovable storage 409 and anon-removable storage 410. Thecomputing device 400 may also have input device(s) 412 such as a keyboard, a mouse, a pen, a sound input device (e.g., a microphone) for receiving a voice input, a touch input device for receiving gestures, etc. Output device(s) 414 such as a display, speakers, a printer, etc. may also be included. The aforementioned devices are examples and others may be used. - Generally, consistent with various embodiments, program modules may be provided which include routines, programs, components, data structures, and other types of structures that may perform particular tasks or that may implement particular abstract data types. Moreover, various embodiments may be practiced with other computer system configurations, including hand-held devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, minicomputers, mainframe computers, automotive computing systems and the like. Various embodiments may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.
- Furthermore, various embodiments may be practiced in an electrical circuit comprising discrete electronic elements, packaged or integrated electronic chips containing logic gates, a circuit utilizing a microprocessor, or on a single chip containing electronic elements or microprocessors. For example, various embodiments may be practiced via a system-on-a-chip (“SOC”) where each or many of the components illustrated in
FIG. 4 may be integrated onto a single integrated circuit. Such an SOC device may include one or more processing units, graphics units, communications units, system virtualization units and various application functionality all of which are integrated (or “burned”) onto the chip substrate as a single integrated circuit. When operating via an SOC, the functionality, described herein may operate via application-specific logic integrated with other components of the computing device/system 400 on the single integrated circuit (chip). Embodiments may also be practiced using other technologies capable of performing logical operations such as, for example, AND, OR, and NOT, including but not limited to mechanical, optical, fluidic, and quantum technologies. In addition, embodiments may be practiced within a general purpose computer or in any other circuits or systems. - Various embodiments, for example, may be implemented as a computer process (method), a computing system, or as an article of manufacture, such as a computer program product or computer readable media. The computer program product may be a computer storage media readable by a computer system and encoding a computer program of instructions for executing a computer process.
- The term computer readable media as used herein may include computer storage media. Computer storage media may include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information (such as computer readable instructions, data structures, program modules, or other data) in hardware. The
system memory 404,removable storage 409, andnon-removable storage 410 are all computer storage media examples (i.e., memory storage.) Computer storage media may include, but is not limited to, RAM, ROM, electrically erasable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store information and which can be accessed by thecomputing device 400. Any such computer storage media may be part of thecomputing device 400. - The term computer readable media as used herein may also include communication media. Communication media may be embodied by computer readable instructions, data structures, program modules, or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and includes any information delivery media. The term “modulated data signal” may describe a signal that has one or more characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media may include wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, radio frequency (RF), infrared, and other wireless media.
-
FIGS. 5A and 5B illustrate a suitable mobile computing environment, for example, amobile computing device 550 which may include, without limitation, a smartphone, a tablet personal computer, a laptop computer, and the like, with which various embodiments may be practiced. With reference toFIG. 5A , an examplemobile computing device 550 for implementing various embodiments is illustrated. In a basic configuration,mobile computing device 550 is a handheld computer having both input elements and output elements. Input elements may include touch screen display 525 andinput buttons 510 that allow the user to enter information intomobile computing device 550.Mobile computing device 550 may also incorporate an optionalside input element 520 allowing further user input. Optionalside input element 520 may be a rotary switch, a button, or any other type of manual input element. In alternative embodiments,mobile computing device 550 may incorporate more or less input elements. For example, display 525 may not be a touch screen in some embodiments. In yet another alternative embodiment, the mobile computing device is a portable telephone system, such as a cellular phone having display 525 andinput buttons 510.Mobile computing device 550 may also include anoptional keypad 594.Optional keypad 594 may be a physical keypad or a “soft” keypad generated on the touch screen display. -
Mobile computing device 550 incorporates output elements, such asdisplay 590, which can display a graphical user interface (GUI). Other output elements includespeaker 530 andLED light 580. Additionally,mobile computing device 550 may incorporate a vibration module (not shown), which causesmobile computing device 550 to vibrate to notify the user of an event. In yet another embodiment,mobile computing device 550 may incorporate a headphone jack (not shown) for providing another means of providing output signals. - Although described herein in combination with
mobile computing device 550, in alternative embodiments may be used in combination with any number of computer systems, such as in desktop environments, laptop or notebook computer systems, multiprocessor systems, micro-processor based or programmable consumer electronics, network PCs, mini computers, main frame computers and the like. Various embodiments may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network in a distributed computing environment; programs may be located in both local and remote memory storage devices. To summarize, any computer system having a plurality of environment sensors, a plurality of output elements to provide notifications to a user and a plurality of notification event types may incorporate the various embodiments described herein. -
FIG. 5B is a block diagram illustrating components of a mobile computing device used in one embodiment, such as themobile computing device 550 shown inFIG. 5A . That is,mobile computing device 550 can incorporate asystem 502 to implement some embodiments. For example,system 502 can be used in implementing a “smart phone” or tablet computer that can run one or more applications similar to those of a desktop or notebook computer. In some embodiments, thesystem 502 is integrated as a computing device, such as an integrated personal digital assistant (PDA) and wireless phone. -
Application 567 may be loaded intomemory 562 and run on or in association with an operating system (“OS”) 564. Thesystem 502 also includesnon-volatile storage 568 within memory the 562.Non-volatile storage 568 may be used to store persistent information that should not be lost ifsystem 502 is powered down. Theapplication 567 may use and store information in thenon-volatile storage 568. A synchronization application (not shown) also resides onsystem 502 and is programmed to interact with a corresponding synchronization application resident on a host computer to keep the information stored in thenon-volatile storage 568 synchronized with corresponding information stored at the host computer. As should be appreciated, other applications may also be loaded into thememory 562 and run on themobile computing device 550. - The
system 502 has apower supply 570, which may be implemented as one or more batteries. Thepower supply 570 might further include an external power source, such as an AC adapter or a powered docking cradle that supplements or recharges the batteries. - The
system 502 may also include a radio 572 (i.e., radio interface layer) that performs the function of transmitting and receiving radio frequency communications. Theradio 572 facilitates wireless connectivity between thesystem 502 and the “outside world,” via a communications carrier or service provider. Transmissions to and from theradio 572 are conducted under control ofOS 564. In other words, communications received by theradio 572 may be disseminated to theapplication 567 viaOS 564, and vice versa. - The
radio 572 allows thesystem 502 to communicate with other computing devices, such as over a network. Theradio 572 is one example of communication media. The embodiment of thesystem 502 is shown with two types of notification output devices:LED 580 that can be used to provide visual notifications and anaudio interface 574 that can be used withspeaker 530 to provide audio notifications. These devices may be directly coupled to thepower supply 570 so that when activated, they remain on for a duration dictated by the notification mechanism even thoughprocessor 560 and other components might shut down for conserving battery power. TheLED 580 may be programmed to remain on indefinitely until the user takes action to indicate the powered-on status of the device. Theaudio interface 574 is used to provide audible signals to and receive audible signals from the user. For example, in addition to being coupled tospeaker 530, theaudio interface 574 may also be coupled to a microphone (not shown) to receive audible input, such as to facilitate a telephone conversation. In accordance with embodiments, the microphone may also serve as an audio sensor to facilitate control of notifications. Thesystem 502 may further include avideo interface 576 that enables an operation of on-board camera 540 (shown inFIG. 5A ) to record still images, video streams, and the like. - A mobile computing device implementing the
system 502 may have additional features or functionality. For example, the device may also include additional data storage devices (removable and/or non-removable) such as, magnetic disks, optical disks, or tape. Such additional storage is illustrated inFIG. 5B bystorage 568. - Data/information generated or captured by the
mobile computing device 550 and stored via thesystem 502 may be stored locally on themobile computing device 550, as described above, or the data may be stored on any number of storage media that may be accessed by the device via theradio 572 or via a wired connection between themobile computing device 550 and a separate computing device associated with themobile computing device 550, for example, a server computer in a distributed computing network such as the Internet. As should be appreciated such data/information may be accessed via themobile computing device 550 via theradio 572 or via a distributed computing network. Similarly, such data/information may be readily transferred between computing devices for storage and use according to well-known data/information transfer and storage means, including electronic mail and collaborative data/information sharing systems. -
FIG. 6 is a simplified block diagram of a distributed computing system in which various embodiments may be practiced. The distributed computing system may include number of client devices such as acomputing device 603, a tablet computing device 605 and amobile computing device 610. Theclient devices server 620 is in communication with theclient devices network 615. Theserver 620 may storeapplication 600 which may be perform routines including, for example, one or more of the operations in the routine 300 described above with respect toFIG. 3 . - Various embodiments are described above with reference to block diagrams and/or operational illustrations of methods, systems, and computer program products. The functions/acts noted in the blocks may occur out of the order as shown in any flow diagram. For example, two blocks shown in succession may in fact be executed substantially concurrently or the blocks may sometimes be executed in the reverse order, depending upon the functionality/acts involved.
- While certain embodiments have been described, other embodiments may exist. Furthermore, although various embodiments have been described as being associated with data stored in memory and other storage mediums, data can also be stored on or read from other types of computer-readable media, such as secondary storage devices (i.e., hard disks, floppy disks, or a CD-ROM), a carrier wave from the Internet, or other forms of RAM or ROM. Further, the disclosed routine's operations may be modified in any manner, including by reordering operations and/or inserting or operations, without departing from the embodiments described herein.
- It will be apparent to those skilled in the art that various modifications or variations may be made without departing from the scope or spirit of the embodiments described herein. Other embodiments will be apparent to those skilled in the art from consideration of the specification and practice of the embodiments described herein.
Claims (20)
Priority Applications (6)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US13/666,397 US9270667B2 (en) | 2012-11-01 | 2012-11-01 | Utilizing X.509 authentication for single sign-on between disparate servers |
CN201380069110.7A CN105052105A (en) | 2012-11-01 | 2013-11-01 | Utilizing x.509 authentication for single sign-on between disparate servers |
CN201810244653.2A CN108551438B (en) | 2012-11-01 | 2013-11-01 | Using X.509 authentication for single sign-on between different servers |
PCT/US2013/067911 WO2014071098A1 (en) | 2012-11-01 | 2013-11-01 | Utilizing x.509 authentication for single sign-on between disparate servers |
EP13795051.5A EP2915309B1 (en) | 2012-11-01 | 2013-11-01 | Utilizing authentication scheme for single sign-on between servers |
US14/992,545 US9686266B2 (en) | 2012-11-01 | 2016-01-11 | Utilizing X.509 authentication for single sign-on between disparate servers |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US13/666,397 US9270667B2 (en) | 2012-11-01 | 2012-11-01 | Utilizing X.509 authentication for single sign-on between disparate servers |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/992,545 Continuation US9686266B2 (en) | 2012-11-01 | 2016-01-11 | Utilizing X.509 authentication for single sign-on between disparate servers |
Publications (2)
Publication Number | Publication Date |
---|---|
US20140122870A1 true US20140122870A1 (en) | 2014-05-01 |
US9270667B2 US9270667B2 (en) | 2016-02-23 |
Family
ID=49627059
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/666,397 Active 2034-07-15 US9270667B2 (en) | 2012-11-01 | 2012-11-01 | Utilizing X.509 authentication for single sign-on between disparate servers |
US14/992,545 Active US9686266B2 (en) | 2012-11-01 | 2016-01-11 | Utilizing X.509 authentication for single sign-on between disparate servers |
Family Applications After (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/992,545 Active US9686266B2 (en) | 2012-11-01 | 2016-01-11 | Utilizing X.509 authentication for single sign-on between disparate servers |
Country Status (4)
Country | Link |
---|---|
US (2) | US9270667B2 (en) |
EP (1) | EP2915309B1 (en) |
CN (2) | CN108551438B (en) |
WO (1) | WO2014071098A1 (en) |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20160255089A1 (en) * | 2015-02-26 | 2016-09-01 | Smart Social Media, Inc. | Methods of enabling inter-organizational and public social collaboration |
US9686266B2 (en) | 2012-11-01 | 2017-06-20 | Microsoft Technology Licensing, Llc | Utilizing X.509 authentication for single sign-on between disparate servers |
Families Citing this family (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10749854B2 (en) * | 2015-11-12 | 2020-08-18 | Microsoft Technology Licensing, Llc | Single sign-on identity management between local and remote systems |
CN108632241B (en) * | 2018-03-07 | 2021-05-25 | 湖南小步科技有限公司 | Unified login method and device for multiple application systems |
US11196735B2 (en) * | 2019-07-17 | 2021-12-07 | Microsoft Technology Licensing, Llc | Certificate management in segregated computer networks |
EP3836489B1 (en) * | 2019-12-09 | 2023-09-27 | Siemens Aktiengesellschaft | Dynamic allocation of automation units to automation servers |
Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6275941B1 (en) * | 1997-03-28 | 2001-08-14 | Hiatchi, Ltd. | Security management method for network system |
US20030196108A1 (en) * | 2002-04-12 | 2003-10-16 | Kung Kenneth C. | System and techniques to bind information objects to security labels |
US7047404B1 (en) * | 2000-05-16 | 2006-05-16 | Surety Llc | Method and apparatus for self-authenticating digital records |
EP2107757A1 (en) * | 2008-03-31 | 2009-10-07 | British Telecommunications Public Limited Company | Identity management |
Family Cites Families (10)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
MXPA03011976A (en) * | 2001-06-22 | 2005-07-01 | Nervana Inc | System and method for knowledge retrieval, management, delivery and presentation. |
NO318842B1 (en) * | 2002-03-18 | 2005-05-09 | Telenor Asa | Authentication and access control |
US7574738B2 (en) * | 2002-11-06 | 2009-08-11 | At&T Intellectual Property Ii, L.P. | Virtual private network crossovers based on certificates |
JP2006522388A (en) * | 2003-02-14 | 2006-09-28 | ナーバナ、インコーポレイテッド | Systems and methods for acquiring, managing, capturing, sharing, discovering, communicating and presenting semantic knowledge |
US8528058B2 (en) | 2007-05-31 | 2013-09-03 | Microsoft Corporation | Native use of web service protocols and claims in server authentication |
CN101136916A (en) * | 2007-06-11 | 2008-03-05 | 夏莹杰 | P2P transmission method based on roles and credit access control mechanism |
US8438383B2 (en) * | 2010-04-05 | 2013-05-07 | White Sky, Inc. | User authentication system |
CN101783800B (en) * | 2010-01-27 | 2012-12-19 | 华为终端有限公司 | Embedded system safety communication method, device and system |
CN102255969B (en) * | 2011-07-14 | 2014-02-19 | 南京邮电大学 | Representational-state-transfer-based web service security model |
US9270667B2 (en) | 2012-11-01 | 2016-02-23 | Microsoft Technology Licensing, Llc | Utilizing X.509 authentication for single sign-on between disparate servers |
-
2012
- 2012-11-01 US US13/666,397 patent/US9270667B2/en active Active
-
2013
- 2013-11-01 WO PCT/US2013/067911 patent/WO2014071098A1/en active Application Filing
- 2013-11-01 CN CN201810244653.2A patent/CN108551438B/en active Active
- 2013-11-01 CN CN201380069110.7A patent/CN105052105A/en active Pending
- 2013-11-01 EP EP13795051.5A patent/EP2915309B1/en active Active
-
2016
- 2016-01-11 US US14/992,545 patent/US9686266B2/en active Active
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6275941B1 (en) * | 1997-03-28 | 2001-08-14 | Hiatchi, Ltd. | Security management method for network system |
US7047404B1 (en) * | 2000-05-16 | 2006-05-16 | Surety Llc | Method and apparatus for self-authenticating digital records |
US20030196108A1 (en) * | 2002-04-12 | 2003-10-16 | Kung Kenneth C. | System and techniques to bind information objects to security labels |
EP2107757A1 (en) * | 2008-03-31 | 2009-10-07 | British Telecommunications Public Limited Company | Identity management |
Cited By (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9686266B2 (en) | 2012-11-01 | 2017-06-20 | Microsoft Technology Licensing, Llc | Utilizing X.509 authentication for single sign-on between disparate servers |
US20160255089A1 (en) * | 2015-02-26 | 2016-09-01 | Smart Social Media, Inc. | Methods of enabling inter-organizational and public social collaboration |
US10305912B2 (en) * | 2015-02-26 | 2019-05-28 | Smart Social Media, Inc. | Methods of enabling inter-organizational and public social collaboration |
Also Published As
Publication number | Publication date |
---|---|
CN105052105A (en) | 2015-11-11 |
EP2915309A1 (en) | 2015-09-09 |
US9686266B2 (en) | 2017-06-20 |
US20160205092A1 (en) | 2016-07-14 |
CN108551438A (en) | 2018-09-18 |
CN108551438B (en) | 2021-06-22 |
WO2014071098A1 (en) | 2014-05-08 |
EP2915309B1 (en) | 2019-03-20 |
US9270667B2 (en) | 2016-02-23 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US9686266B2 (en) | Utilizing X.509 authentication for single sign-on between disparate servers | |
US10708252B2 (en) | Configuring credentials to faciltate sharing data in a secure manner | |
EP3375161B1 (en) | Single sign-on identity management between local and remote systems | |
US20220247637A1 (en) | Methods, apparatuses, and computer program products for facilitating synchronization of setting configurations | |
US9578114B2 (en) | External service application discovery method | |
CN107924411B (en) | Method and system for recovering UI state in transaction system | |
CN107408042B (en) | Efficient and intuitive data binding for mobile applications | |
US9274763B2 (en) | System and method for creating a development and operational platform for mobile applications | |
US11799841B2 (en) | Providing intercommunication within a system that uses disparate authentication technologies | |
US20130198620A1 (en) | Method and system for performing synchronous document conversion | |
US20160028591A1 (en) | Managing cross-premises resources through integrated view | |
US11570268B2 (en) | Proxy system for bot connectivity to communication channels | |
US20180213398A1 (en) | Tenant based signature validation | |
Hoang et al. | Secure roaming with identity metasystems |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: MICROSOFT CORPORATION, WASHINGTON Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:GUPTA, AJAY;RASTOGI, SUDEEP;JAYASANKAR, SHYAM SUNDAR;AND OTHERS;SIGNING DATES FROM 20121016 TO 20121030;REEL/FRAME:029230/0823 |
|
AS | Assignment |
Owner name: MICROSOFT TECHNOLOGY LICENSING, LLC, WASHINGTON Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:MICROSOFT CORPORATION;REEL/FRAME:034747/0417 Effective date: 20141014 Owner name: MICROSOFT TECHNOLOGY LICENSING, LLC, WASHINGTON Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:MICROSOFT CORPORATION;REEL/FRAME:039025/0454 Effective date: 20141014 |
|
STCF | Information on status: patent grant |
Free format text: PATENTED CASE |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 4TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1551); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 4 |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 8TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1552); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 8 |