Identity experience framework
地域：
WA
WA Redmond
摘要
Methods for composable user journeys for user authentication via an identity experience framework are performed by systems and apparatuses. Initiating a user authentication process for an application triggers application calls for dynamic invocation of a specific identity policy, required by the application, of a number of identity policies managed by a host of the identity experience framework. User interfaces defined by the identity policies are provided from the host to the application for interaction by the user and entry of identity information needed to authenticate the user according to specified verification providers. Identity claims and token requests are provided from the application to the host which then authenticates the identity claims via the verification providers and mints a token that includes the claims required by the application, according to the identity policy. The application consumes the token to complete the token request and allow the user access to the application.
說(shuō)明書(shū)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
This application is related to U.S. patent application Ser. No. 15/809,651 filed on the same day herewith, and entitled “Identity Experience Framework,” the entirety of which is incorporated by reference herein.
Identity features are ubiquitous across all applications used by end users. Features such as authentication based on username or email address and password, multi-factor authentication, and federation are used for application sign up, authentication, and access. Even so, current identity solutions are rife with examples where many different application developers are providing their own implementations for identity verification.
The needs of workloads for companies and governments vary widely, where the variations are unique enough that they require custom-built solutions. Workloads span from a website or mobile application interacting with consumers, to large scale application platforms that offer a built-in identity systems for developers building applications, to dynamic portal teams such as consumer portals created via wizards.
Digital transformation in the modern world has reached a point where every industry (not just software) and even governments are increasingly engaging with their customers and citizens digitally. Higher value transactions such as buying health insurance, managing health vaults, finances, paying taxes, requesting welfare benefits, etc., are moving to online implementations. Companies also need to handle the vetting of software developers for application (“app”) stores before payouts can be made. Currently, each of these issues are achieved by custom-built solutions.
權(quán)利要求
What is claimed is:1. A system comprising:memory configured to store program logic; and a processor configured to access the memory and to execute the program logic to perform operations comprising: receiving a call over a network from an application in response to user interaction with the application via an interface, the application executing on an application service provider device remote to the system and the interface, the call comprising a policy identifier (ID) that corresponds to an identity policy that is one of a plurality of identity policies for dynamic deployment on behalf of the application; executing a user authentication process that is defined by the identity policy that corresponds to the policy ID; providing a user interface (UI) to the application over the network subsequent to receiving the call and based on the policy ID of the received call; receiving a token request and an identity claim over the network from the application responsive to additional user interaction with the UI; verifying the identity claim; and providing a token configured to enable a user to access the application over the network to the application for consumption to complete the token request. 2. The system of claim 1 , wherein said verifying the identity claim comprises:providing the identity claim to a verification provider according to the identity policy that corresponds to the policy ID; receiving a response claim from the verification provider; and verifying the identity claim against the response claim. 3. The system of claim 2 , wherein the verification provider is one or more of:an identity provider, an attribute provider, a directory provider, a multi-factor authentication (MFA) provider, an email validation provider, or self-asserted attribute provider. 4. The system of claim 2 , wherein the operations further comprise:transforming the identity claim to a transformed claim, using at least one parameter associated with the claim, prior to providing the identity claim to the verification provider according to the identity policy that corresponds to the policy ID; providing the transformed claim to the verification provider instead of the identity claim; and transforming the response claim, that is based on the transformed claim, received from the verification provider prior to verifying the identity claim. 5. The system of claim 1 , wherein the memory is configured to store the plurality of identity policies, the identity policy that corresponds to the policy ID of the received call being:provided to the memory from a remote identity operator; or a child identity policy comprising a base parent identity policy and one or more changes thereto specified by an application service provider that provides the application. 6. The system of claim 1 , wherein the operations further comprise:providing access for customer entities to a base identity policy of the plurality of identity policies, the customer entities including at least one of:an application service provider, or an identity operator; performing at least one of:receiving a customer entity base identity policy that includes a modification to the base identity policy from which it derives; or receiving a customer entity application identity policy that includes an additional modification to the customer entity base identity policy from which it derives, the additional modification being related to the application; and storing received customer entity base identity policies or customer entity application identity policies as a portion of the plurality of identity policies. 7. The system of claim 1 , wherein the UI is:defined by the identity policy that corresponds to the policy ID; and configured in accordance with one or more verification providers specified by the identity policy that corresponds to the policy ID. 8. The system of claim 1 , wherein the operations further comprise:executing the user authentication process at least in part as a security token service (STS) defined by the identity policy; and minting the token according to the STS and the token request to include claims required by the application and the identity policy. 9. A method implemented by a computing system that comprises a multi-sided identity experience framework configured to support a plurality of remote identity operators, a plurality of remote verification providers, and a plurality of remote application service providers for user authentication to applications, the method comprising:receiving a call over a network from an application in response to user interaction with an interface, the application executing on an application service provider device remote to the computing system and the interface, the call comprising a policy identifier (ID) that corresponds to an identity policy of a plurality of identity policies for dynamic deployment on behalf of the application; executing a user authentication process that is defined by the identity policy that corresponds to the policy ID; providing a user interface (UI) to the application over the network subsequent to receiving the call, the UI being:provided based on the policy ID of the received call, defined by the identity policy that corresponds to the policy ID, and configured in accordance with one or more verification providers specified by the identity policy that corresponds to the policy ID; receiving a token request and an identity claim over the network from the application responsive to additional user interaction with the UI; verifying the identity claim; and providing a token configured to enable a user to access the application over the network to the application for consumption to complete the token request. 10. The method of claim 9 , further comprising:providing the identity claim to a verification provider according to the identity policy that corresponds to the policy ID; and receiving a response claim from the verification provider; wherein verifying the identity claim includes verifying the identity claim against the response claim. 11. The method of claim 10 , wherein the verification provider is one or more of:an identity provider, an attribute provider, a directory provider, a multi-factor authentication (MFA) provider, an email validation provider, or self-asserted attribute provider. 12. The method of claim 9 , further comprising:storing the plurality of identity policies in a memory of the computing system, wherein one of the plurality of identity policies is provided to the at least one memory from a remote identity operator. 13. The method of claim 12 , wherein the identity policy that corresponds to the policy ID is a child identity policy comprising a base parent identity policy and one or more changes thereto specified by an application service provider that provides the application. 14. The method of claim 9 , wherein the method further comprises:executing the user authentication process at least in part as a security token service (STS); and minting the token according to the identity policy that corresponds to the policy ID and the token request to include claims required by the application and the identity policy that corresponds to the policy ID. 15. A computer-readable storage medium comprising computer-executable instructions that, when executed by a processor, perform a method comprising:receiving a call over a network from an application in response to user interaction with the application via an interface, the application executing on an application service provider device remote to the processor and the interface, the call comprising a policy identifier (ID) that corresponds to an identity policy of a plurality of identity policies for dynamic deployment on behalf of the application; executing a user authentication process that is defined by the identity policy that corresponds to the policy ID; providing a user interface (UI) associated with the identity policy that corresponds to the policy ID to the application, over the network subsequent to receiving the call, based on the policy ID of the received call; receiving a token request and an identity claim over the network from the application responsive to additional user interaction with the UI; verifying the identity claim; and providing a token configured to enable a user to access the application over the network to the application for consumption to complete the token request. 16. The computer-readable storage medium of claim 15 , wherein the method further comprises:providing the identity claim to a verification provider according to the identity policy that corresponds to the policy ID; and receiving a response claim from the verification provider; wherein verifying the identity claim includes verifying the identity claim against the response claim. 17. The computer-readable storage medium of claim 16 , wherein the verification provider is one or more of:an identity provider, an attribute provider, a directory provider, a multi-factor authentication (MFA) provider, an email validation provider, or self-asserted attribute provider. 18. The computer-readable storage medium of claim 15 , wherein the method further comprises:storing the plurality of identity policies in a memory, wherein the identity policy that corresponds to the policy ID is provided to the memory from a remote identity operator. 19. The computer-readable storage medium of claim 18 , wherein the identity policy that corresponds to the policy ID is a child identity policy comprising a base parent identity policy and one or more changes thereto specified by an application service provider that provides the application. 20. The computer-readable storage medium of claim 15 , wherein the method further comprises:executing the user authentication process at least in part as a security token service (STS); and minting the token according to the identity policy that corresponds to the policy ID and the token request to include claims required by the application and the identity policy that corresponds to the policy ID.
意見(jiàn)反饋
使用該功能遇到問(wèn)題
該功能需要專(zhuān)業(yè)版企業(yè)版VIP權(quán)限，您可以：
您也可以聯(lián)系官方QQ: 2157717237 電話(huà): 13264338900
PatentHub聯(lián)系方式
掃描加專(zhuān)利匯官方微信交流群
