Method and apparatus for managing workflow in single sign-on framework

background

[0001] Password management has become a complex and cumbersome task for end users of systems (ie, computers running multiple applications). In today's technology security consciousness, the complexity of password management typically results in a compromise between security and productivity loss. Therefore, the focus of system login is shifting towards the coordination and integration of user authentication and sign-on capabilities for a large number of different applications within the system.

[0002] One such tool for coordination and integration is known as single sign-on (SSO). SSO is a user authentication process that allows a user to enter one name and password to access many applications in the system. The SSO typically required at the start of a network session allows access to all authorized applications (ie, where the user has appropriate access) after authenticating the user. By doing so, SSO removes future authentication prompts when users switch applications during a particular network session. In this way, SSO allows a user to prepare a set of authentication credentials that, if valid, establish a relationship that gives the user permission to access all authenticated system resources.

[0003] More specifically, the user initiates an SSO logon session using a user agent (ie, desktop browser, mobile device, etc.). When the user's credentials are verified, SSO generates a master token to represent the user's authentication session. The master token contains a unique ID that the system uses to identify the master token. Moreover, the master token has the ability to track various applications that the user requests access to in the system. Typically, the master token refers to session information such as the user's user ID, the length of time the user has been actively connected to the system (ie, the session length), and so on. Traditionally, master tokens are passed to a large number of applications participating in SSO sessions to avoid the need for per-application user applications.

[0004] SSO provides user convenience, but more importantly, SSO provides sensitive information (ie passwords, user IDs, credit card numbers, social security) for users to use numerous applications on the system. It limits the number of times you have to enter a number, etc.) to improve security. Furthermore, the work for confirming the user's information for each requested application is invisible to the user. In other words, the user does not need to know how each application receives and inspects credentials before granting access to the user.

Overview

[0005] Generally speaking, in one aspect, the invention associates a state with a subtask, a step of acquiring an application adapter associated with the application and specifying a subtask, and a step of monitoring the application to acquire the state. It relates to how to manage the workflow of an application, including steps to perform the action associated with the subtask when it is done.

[0006] Also, generally speaking, in one aspect, the invention monitors an application with a state, an application adapter configured to define an action associated with the state, and the state. It relates to a system that manages the workflow of an application, including an application adapter runtime configured to perform that action when it appears.

[0007] Other aspects of the invention are apparent from the following description and claims.

Detailed explanation

[0011] Next, a specific embodiment of the present invention will be described in detail with reference to the accompanying drawings. Similar elements in various drawings are represented using similar reference numbers for consistency.

[0012] In the following detailed description of embodiments of the invention, a number of specific details are provided to provide a more complete understanding of the invention. However, as will be apparent to those skilled in the art, the present invention can be practiced without the use of these specific details. In other cases, well-known features will not be described in detail to avoid obscuring the invention.

[0013] In general, one or more embodiments of the present invention relate to methods and devices for managing workflows in an SSO environment. More specifically, an embodiment of the present invention allows a user to manage a workflow by monitoring various states of an application executed in an SSQ environment and executing various actions when the states occur. ..

[0014] FIG. 1 shows a system for managing workflow in an SSO environment according to an embodiment of the present invention. In particular, this system includes a server (100) and one or more clients (102). In one embodiment of the invention, the server (100) includes a server authentication component (104) and an SSO server component (106). The server authentication component (104) includes the ability to authenticate users who interact with the client (102). More specifically, in one embodiment of the invention, the server authentication component (104) includes the ability to retrieve the authentication profile (108) from the database (110). The authentication profile (108) contains the information required to authenticate the user. The server authentication component (104) uses an authentication profile (108) to guide the user's authentication (ie, authentication such as biometrics (eg fingerprint reading, voice, retinal scan), password from smart card, etc. Includes a copy of the credentials used to direct the method and identify the user, etc.).

[0015] In one embodiment of the invention, the server authentication component (104) retrieves information to authenticate the user via the client authentication component (126). The client authentication component (126) typically directs the user to enter credentials and works with the device module (128) (ie, the hardware required to enter the credentials, eg, a fingerprint reader).

Continuing with the description of FIG. 1, the SSO server component (106) includes the ability to provide the client (102) with the information it needs to enable the client (102) to perform workflow management. In particular, once the user has been successfully authenticated by the server authentication component (104), the SSO server component (106) begins to retrieve the corresponding SSO profile (112) from the database (110). In one embodiment of the invention, the SSO profile (112) comprises one or more application adapters (114). In one embodiment of the invention, the application adapter contains information necessary to enable workflow management.

[0017] In one embodiment of the invention, the application adapter (114) includes two parts, namely an initialization part and a script part (not shown). In one embodiment of the invention, the initializer contains information that determines how the application (with which the application adapter (114) is associated) is started. This information includes the adapter type (for example, Windows application, web-based application, terminal emulator application, etc.), adapter name, application executable name, application executable path, working directory for starting the application, command line for the application. It includes, but is not limited to, options, information about how to start the application when recording the state within the application, and the location of the associated script file (ie, the script part). In one embodiment of the invention, the scripting portion of the application adapter (114) is information that dictates how the application adapter (114) interacts with the application (132) at runtime, eg, which action during a particular application state. Contains information about what should be done.

Continuing with the description of FIG. 1, the server (100) also includes a server-side session protocol (116) and a server communication layer (118). The server-side session protocol (116) is used to manage session protocols for various sessions (ie, authentication and SSO sessions). The server communication layer (118) includes the ability to manage communication between the server (100) and the client (102). More specifically, the server communication layer (118) includes a function of exchanging information with and from the client communication layer (120) existing on the client (102) side.

[0019] In one embodiment of the invention, the client (102) is a client communication layer (120), a client-side session protocol (122), an SSO client component (124), a client authentication component (126), and an application adapter. Includes line time (130). Like the server-side session protocol (116), the client-side session protocol (122) manages sessions on the client (102) side. In addition, the SSO client component (124) includes features to enable workflow management. In particular, in one embodiment of the present invention, the user is authenticated, SSO client component (124) is a SSO profile (112) to the SSO server component (106) client requests to transfer cement to (102) To do. Moreover, the SSO client component (124) contains the functionality needed to start the application adapter runtime (130).

[0020] In one embodiment of the present invention, the application adapter runtime (130) includes a function of interpreting information in the application adapter (114), that is, information in the initialization section and information in the script section. In addition, the application adapter runtime (130) includes the ability to monitor the state of the application (132) and perform actions related to that state.

[0021] Although those skilled in the art have two profiles (ie, authentication profile (108) and SSO profile (112)) in the above description, these profiles may be combined into one file and referred to as a profile. Admit that it is good.

FIG. 2 is a data structure hierarchy diagram according to an embodiment of the present invention. In particular, FIG. 2 shows the relationship between the user (150), the profile (152) and the application adapter (154). In one embodiment of the invention, one or more users (ie, user A (150A), user N (150N)) are associated with one profile (ie, profile A (152A), profile N (152N)). In addition, the profile (152) is associated with one or more application adapters (application adapter A (154A), application adapter N (154N)). Using the above hierarchy, a single application adapter (154) is used by multiple users and promotes code reuse.

Those skilled in the art allow a user (150) to accommodate a group of users who access the system using a common username and credentials.

[0024] FIG. 3 is a flowchart according to an embodiment of the present invention. More specifically, FIG. 3 shows a method of generating an application adapter for an application according to an embodiment of the present invention. First, the type of task is selected (step 100). In one embodiment of the invention, the tasks correspond to pre-login tasks, login tasks, post-login tasks, logout tasks, and pre-end tasks. The above task identifiers are typically used as a means of organizing the workflow of an application.

[0025] Continuing with the description in Figure 3, after the task is selected, the subtask is specified next (step 102). In one embodiment of the invention, the subtask corresponds to a functional part of the task. In particular, the subtask defines the pre-execution state of the application that should be satisfied before the action is executed, the action to be executed, and the post-execution state of the application indicating the successful completion of the action. The application type is then selected (step 104). As mentioned above, the application type indicates whether the application is a Windows application, a web-based application, a terminal emulator application, and so on. Information about the application type is typically used to determine how to get the various states of the application. In one embodiment of the invention, the state of the application is text, window title, parent and child windows, control ID, enumeration order of windows in the application, window class (ie, artificial assigned when the window is created). Attribute) is defined by a collection of.

[0026] The method of recording the state remains selected (step 106). In one embodiment of the invention, an automatic state setting mechanism is used to acquire the state of the application. In another embodiment of the invention, a manual state setting mechanism is used to obtain the state of the application. If the above state is specified, the state corresponding to the subtask is recorded (if using the automatic state setting mechanism) and defined if using the manual state setting mechanism (step 108). When a state is recorded / defined, one or more actions are then associated with that state, regardless of the mechanism used to retrieve the state (step 110). For example, actions include prompting the user for data, retrieving specific data, automatically directing the user to a specific part of the application, and so on.

[0027] When an action (one or more) is associated with a state, it is determined whether additional subtasks should be specified (step 112). If more subtasks are needed, then steps 102-112 are repeated until there are no more subtasks to be specified for a particular task. If all subtasks for a particular task have been specified, it is determined whether to select more tasks (step 114). If more tasks are selected, steps 100-114 are repeated until there are no more tasks to be selected.

[0028] Once all tasks have been selected and these subtasks have been defined, the information collected during the above steps will be used to generate the initialization part of the application adapter (step 116) and the application adapter script. Used to generate parts (step 118). In one embodiment of the invention, the initialization unit sets the application adapter in the primary executable code, i.e., the first part of the code that is executed when the application associated with the application adapter is started.

[0029] In one embodiment of the invention, the scripting portion of the application adapter is represented in extended markup language (XML). Alternatively, the script part of the application adapter may be written in its own binary format. The resulting application adapter is subsequently associated with one or more profiles (step 120). Those skilled in the art allow each application adapter to contain one or more tasks and each task to contain one or more subtasks.

[0030] In one embodiment of the invention, one or more parameters are defined while recording a subtask. These parameters include the identity, password, domain, etc. associated with a particular application. In addition, control actions such as button clicks and drop-down list menu selections are also defined while recording subtasks. Moreover, dynamic variables are added by the user to specific subtasks. Dynamic variables may be obtained from the local data repository or through an external system. In one embodiment of the invention, the value of a dynamic variable is determined when an action is performed within a subtask. Therefore, the value of a dynamic variable allows the application adapter to perform various actions based on the context of the application (ie, the value of the new variable).

FIG. 4 shows how to use the application adapter according to an embodiment of the present invention. First, the user is authenticated (step 130). In one embodiment of the invention, the user is authenticated using the authentication infrastructure shown in FIG. Once the user is authenticated, the SSO profile associated with the user (including one or more application adapters) is retrieved (step 132) and loaded on the client side used by the user (step 134). The application adapter runtime is subsequently started (step 136). At this stage, the system performing the above steps is ready to use the application adapter in the SSO profile.

[0032] The user then requests that a particular application be started (step 138). This request is captured prematurely by the application adapter runtime, which uses the initialization part of the application adapter runtime associated with the application to start the application and also to start monitoring the various steps of the application. (Step 140). As the application goes through various states, the application adapter runtime monitors the state and determines if there are any state-related subtasks (step 142).

[0033] If a subtask is associated with that state, then the application adapter performs the action specified within the subtask (step 144). In one embodiment of the invention, the application adapter runtime includes the ability to perform actions. In addition, the application adapter runtime first matches the state of the application (ie, the pre-execution state) with the pre-execution state defined in the subtask before performing the action. If the pre-execution state of the application matches the pre-execution state defined for the subtask, the application adapter begins executing the action.

[0034] After the action is completed, the application adapter runtime verifies the state of the application (ie, the post-execution state) to determine if the action execution was successful. If the application runs correctly (as indicated by the post-execution state), the application adapter runtime allows the application to continue running (step 146). Steps 140-146 are repeated until the application is terminated.

[0035] As described above, each task may include a large number of subtasks. In one embodiment of the invention, the user specifies, via a toolbar client or a custom interface client, that only one subtask within each task is executed by the application adapter runtime. Alternatively, the user may specify that the application adapter runtime perform two or more subtasks specified within the task via the toolbar client or custom interface client.

[0036] The following embodiments are used to illustrate one embodiment of the invention and are not intended to limit the scope of the application. Consider the following scenarios for Customer Relationship Banking Applications (CRBA). This scenario includes the following features: (1) CRBA is started on a network-mapped drive device, and (2) the application launcher is on the user (the application launcher is starting the appropriate version of CRBA). When the user logs in to the application and (4) the user logs in to the CRBA after the CRBA is started, the user is asked to type in the employee identification number. Directly directed to various areas of CRBA such as ordinary account area, money market account area and so on.

[0037] For the purposes of the embodiment, login includes three situations. The first situation is a successful login where the user is required to enter a user ID and password. The user prepares the user ID and password accepted by CRBA, and the user obtains the access permission to the application. The second situation is an unsuccessful login where the user cannot log in due to the wrong password / user ID combination. The third situation is the situation of a password change event in which the user has the correct password, but the password has expired and is not accepted. In this case, CRBA prompts the user for a new password.

Next, the application adapter used in the above scenario will be described. The application adapter includes pre-login tasks and login tasks. In the pre-login task, the user ID is set as an external parameter. The pre-login task pre-execution state is set to recognize the prompt for the user ID. When prompted, the user ID corresponding to a particular user is provided to the application via the application adapter runtime. When a user ID is given, the post-execution state is set in order to recognize that the user ID has been entered.

[0039] The login task includes subtasks for handling each of the above login situations. The login subtask contains a pre-execution state that corresponds to the login information prompt. The login subtask contains actions that define how to log in to CRBA. In particular, the login action may include a script to retrieve the user's password for the repository and present that password to the CRBA. The login subtask also includes a post-execution state to verify that login information has been sent to the application. Subsequent success subtasks are defined to verify that the login was successful. This subtask only defines a pre-execution state that reflects a successful login and does not contain any actions.

[0040] In situations where the user ID is correct and the password is incorrect, the application adapter uses the same subtask used to perform the login, but additional subtasks are defined to handle the login that eventually failed. .. In particular, a failed login subtask is defined to detect error messages resulting from a failed login. The pre-execution state of the failed login task corresponds to the application state (for example, the pre-execution state detects an error message). Actions defined within a subtask require the user to enter the correct password and pass the correct password to the application. If successful (as verified by the success subtask), the user is logged in to the application.

[0041] The same login subtask is used in situations where the user ID and password are correct and the password has expired. However, instead of subsequently running a successful subtask, a password change subtask is triggered. The password change subtask may include a pre-execution state defined as a prompt from the CRBA to give a new password. The action associated with the password change subtask involves entering a new password. The post-execution state includes a prompt from the system indicating that the new password has been sent and accepted. In this particular situation, if the new password is accepted by the system, the SSO client component updates the password in the database through the SSO server component.

[0042] If the user successfully logs on to the CRBA, the user is navigated directly to a particular area of the application. This navigation is typically performed by subtasks defined in the post-login task. In the above scenario, at least three subtasks are defined, and one subtask is responsible for one of the following areas: the ordinary account area, the checking account area, and the money market account area. Parameters for each subtask include account type and customer account number. The application adapter performs any one of the three subtasks based on the information entered by the user (ie, the customer account number and account type). The subtask then directs the user to a particular area of the application as defined by the information entered by the user. In one embodiment of the invention, the application adapter runtime is configured to automatically retrieve customer information (ie, customer account number and account type) rather than requiring the user to enter information.

Although the present invention has been described for a limited number of embodiments, those skilled in the art benefiting from the present disclosure will not deviate from the scope of the invention as disclosed herein. Admit that you can come up with. Therefore, the scope of the present invention should be limited only by the matters described in the claims.

<figref num="1">It is a figure which shows the system by one Embodiment of this invention.</figref><figref num="2">It is a figure which shows the data structure hierarchy by one Embodiment of this invention.</figref><figref num="3">It is a figure which shows the flowchart by one Embodiment of this invention.</figref><figref num="4">It is a figure which shows the flowchart by one Embodiment of this invention.</figref>

Code description

100 ... Server, 102 ... Client, 104 ... Server Authentication Component, 106 ... SSO Server Component, 108 ... Authentication Profile, 110 ... Database, 112 ... SSO Profile, 112. .. SSO Profile, 114 ... Application Adapter, 116 ... Server Side Session Protocol, 118 ... Server Communication Layer, 120 ... Client Communication Layer, 122 ... Client Side Session Protocol, 124 ... SSO Client Component, 126 ... Client Authentication Component, 128 ... Device Module, 130 ... Application Adapter Runtime, 132 ... Application.