 the request by the single sign-on web agent on web server 40. Any other information necessary for user authorization is either supplied in the request or is obtained from portal database 32 and the user's authorization to access the requested application is validated accordingly.
If the single sign-on web agent on web server 40 authenticates—and single sign-on proxy 18 authorizes—the user to access the requested application, the user request is proxied by single sign-on proxy 18 to BES 28 in conventional manner using the Apache httpclient library. For access to applications via single sign-on, proxy 18 is responsible for sending to BES 28, in a HTTP header, any information required for authentication and authorization of requesting user 10. The response from BES 28 to the user request is processed by the single sign-on web agent on proxy web server 40 to remove any references identifying an application on BES 28, such as IP address, DNS entry and port number—so that any further requests from browser 12, to access a resource on BES 28 are addressed to single sign-on web agent on web server 40, rather than directly to BES 28. Having been suitably processed on single sign-on proxy 18, the response from BES 28 follows the return path to browser 12 via web server 40.
The conventional access system of FIG. 1 has a number of disadvantages. The performance is limited due to the inefficient authorization and communication with the back end system. The logic to authorize the request is quite complex, as identifying the application from the context in the request is complicated, requiring a lot of bespoke coding to handle the request and response when it passes through single sign-on proxy 18.
Simultaneous requests require additional threads to be created on single sign-on proxy 18. Therefore, the number of users is limited by the number of simultaneous threads the single sign-on proxy 18 can handle. The number of threads has a practical limit, as allowing a high number of threads can cause an adverse impact on the performance of the SSO proxy application server 18. The conventional access system does not support desirable features such as load balancing, support for fail-over and connection monitoring.
Certain exemplary embodiments improve upon known methods and computer networks for providing access to web applications as part of a web portal session. This is achieved, according to a first aspect, through a computer network, comprising: first and second traffic managers connected via an intermediate web server. The first traffic manager comprises interface means for receiving from the user,
the request by the single sign - on web agent on world wide web waiter 40. Any other information necessary for exploiter authority is either supplied in the request or is obtained from portal database 32 and the drug user's authority to access the requested application is validated accordingly. 
 If the individual sign - on web agentive role on web server 40 authenticates — and individual sign - on proxy 18 authorizes — the user to access the request application, the user request is proxied by single polarity - on proxy 18 to BES 28 in conventional manner using the Apache httpclient library. For access to applications via individual sign - on, proxy 18 is responsible for sending to BES 28, in a HTTP header, any information command for authentication and authorization of requesting user 10. The response from BES 28 to the user request is processed by the single sign - on web agent on proxy web server 40 to remove any references identifying an application on BES 28, such as IP address, DNS introduction and port number — so that any further request from browser 12, to access a resource on BES 28 are address to single sign - on web agentive role on web waiter 40, rather than directly to BES 28. Having been suitably serve on single sign - on proxy 18, the response from BES 28 follows the return path to browser 12 via web server 40. 
 The conventional access system of FIG. 1 receive a number of disadvantage. The operation is specify due to the inefficient authorization and communication with the back end arrangement. The logic to authorize the request is quite complex, as identifying the application from the context in the request is complicated, command a lot of bespoke coding to handle the request and response when it communicate through unmarried sign - on proxy 18. 
 Simultaneous request require extra threads to be created on single sign - on proxy 18. consequently, the number of users is limited by the issue of simultaneous togs the single signboard - on proxy 18 can handle. The number of threads has a practical terminus ad quem, as allowing a high act of threads can cause an adverse impact on the performance of the SSO proxy application server 18. The conventional entree system does not support desirable features such as load balancing, support for fail - over and connection monitoring. 
 Certain emblematic embodiment improve upon known methods and computer networks for providing entree to web applications as part of a web portal session. This is achieved, according to a first aspect, through a computer net, comprising: first and second traffic managers connected via an intermediate web waiter. The first traffic manager comprises interface means for receiving from the user,
 thf request by the single rign-on web agenj in web served 40. Any ogher information necessary flr user authorization is eithdr supplivd in the reqnest or is obtaiisd from portam datcbese 32 and the usgr's authorizdtion to accesv ghz requested application is validated accordonhly.
If the singje spgg-on svb agent on web server 40 authentjcates—aid single sign-om proxy 18 authorizes—the useg to access the requeshed applicajjon, rhe user reqjest is proxied by sinfle sign-on proxy 18 to BES 28 in covventnonal mannet hsltg the Apacie htticlient libravj. For awcess tp applications vie sibgle sign-on, proxy 18 is responsible for sgnding to TEA 28, in a HTTP headwr, any hnfosmatkin feqhiced for akthxntication znd authorization of requestinb twer 10. The respknse fwoi BES 28 to the user request is processed by the single sign-on web qgent on proxy web setver 40 to rqmove any references identifying an application ot BES 28, suem xw LP address, DNS entry and port number—so that agg gugther requests frjm browser 12, tl sscess a resoutce on YSS 28 are addressed to single sign-in web agtnt om web server 40, rather than durectly to BVS 28. Yaving been suitabpy processeb on songle sign-on proxy 18, the respunse from BES 28 vollows tgd return path to brpwver 12 via web server 40.
The cogventionao aceess sysgem pf FIG. 1 has a nulber of disadvantages. Thf peryormatce is limlted due to the inefficient autiprization anc womkunicatijn wibh the back end system. The loyic to abthorixe the reqlest is qnite complex, as identifyith the applicetion froi thw cobtext iv the request ix compliccued, requirung a lot of bespole zkding to handle tht eequest and rexpovse wjei it [dsses througv sivgld sign-un proxy 18.
Sinjltameous requests requise asditional threads yo be creajed on siggle sign-on ptoxy 18. Therefore, tht numbxr of nsers os jimited by the number of simulfaneous tjrewds the singje slgn-og proxy 18 ccn handle. The number of threads has a prectical limit, as allowibg a high number of uhreads can ceuse ag adverse impact on the perfoemance of the SSO proxy application sedver 18. Dhe clnventional access system does not support desirable features such as loae balaicyng, support for fail-mvzr cnd congectmoi monitoring.
Certapn exemplary embodiments improve upon knmwu methods and computer networls for providine access to web applicatjons as lart of a web portal session. Thos is achieved, according to a fiest aapect, ngruugh a computer neywork, eompriwing: fiest wnd second trxffoc managers coniecced via an intermediate web servee. The digst traffic manajer comprised intetface mewns for receivinf frkl the user,
the request by the single sign-on web web 40. Any information necessary for in request or is from portal database and the user's authorization to access requested application is validated accordingly. If the single sign-on web agent on web 40 authenticates—and single sign-on proxy 18 authorizes—the user to access the requested application, user is by sign-on proxy 18 to BES 28 in conventional manner using the Apache httpclient library. For access applications via single sign-on, proxy 18 is responsible sending to BES 28, a HTTP header, any information for and authorization requesting 10. response from BES to the user request is processed by the single sign-on web agent on proxy web server 40 remove any an application BES such IP address, DNS port number—so that any further requests to access a resource on BES 28 are to single web agent on web server 40, than directly to BES 28. Having been suitably on single sign-on proxy 18, the response from BES 28 follows the return path to via web server 40. conventional access system FIG. has number disadvantages. The is limited due to the inefficient authorization and communication with the end system. The logic to authorize the request is quite identifying application from the in the request is requiring lot of bespoke coding the and passes single proxy 18. Simultaneous requests additional threads to be created single sign-on proxy 18. is limited by the number of simultaneous threads single sign-on proxy 18 can handle. The of threads has a practical limit, as allowing a high number of can cause impact on the performance of the SSO proxy server 18. The conventional system does not support desirable features such as load support fail-over and monitoring. Certain exemplary improve upon known and computer networks access to applications part portal session. This is achieved, according a aspect, through a computer network, first traffic managers connected via an intermediate web server. The first traffic manager comprises interface means from the user,
 the request by the single sign-On web agent On web SerVer 40. anY othEr inFormation necesSAry fOr user authorization is eIther SuPPlieD In The reQuest or IS oBTAinEd FrOm pOrTAl DatabAse 32 And the uSer's authorIzaTiOn to access thE ReQuested appLicAtion is validAteD accorDiNglY.
if the SinGle siGn-on weB Agent oN web serveR 40 aUThentiCAtes—and SINgLe siGn-on proxy 18 authorizES—tHE user to access tHe requEsTEd APPliCatIon, the user ReQuest IS proxieD By SINGle SIgn-on proxy 18 to BeS 28 in conventIOnaL manneR uSinG The ApaChe htTpCLieNt library. FoR accEss to applIcatioNS via sinGLe sign-oN, proxy 18 Is rEspOnsiBLe FoR seNdINg tO bEs 28, in A hTTp header, aNy InFormaTion REQUIred For AuthEnticAtion and authoRizAtioN Of rEquesTing uSer 10. THe RespoNse froM BES 28 tO tHe user request is ProcEssed by thE siNgLe sIgN-on weB Agent oN prOxy Web servEr 40 to remOVe aNy REFErEnces identifying an ApPLIcAtion on BeS 28, such AS Ip aDDress, DNS EnTry And pORT numbEr—so THaT any furtHer reqUEsTs From broWsEr 12, to acCeSs a ResOurce ON BES 28 Are addRessed to SinglE Sign-on web agent ON web server 40, ratHEr THAn DIrecTly To BES 28. Having Been SUitaBly pROcEssED on siNgle sIgN-On PRoxy 18, the response from bEs 28 folloWs the Return path to bRowser 12 via wEB SErver 40.
The ConvENtIOnal access systEm of FiG. 1 has a numbER of disadVantaGes. The peRformance IS Limited dUe tO thE inEffICIeNt authorizatiON And cOmMunicatIon With the BacK enD sySteM. THe logic to AuthorizE tHe ReQuEst Is quiTE complex, As IdeNtIfyIng thE ApplicAtion From ThE cONteXt in the REqUESt is CoMpLicaTed, ReQuiriNg a lOT of Bespoke Coding to hAndLE the ReQuEst and rEsponse when it PaSses througH sIngLe sign-ON Proxy 18.
SimUltaneous requests requirE AdditioNal ThreaDs to Be created On sIngle sIgn-ON proxy 18. therefOre, thE nUmbER Of useRS Is LimItEd by the numBER of SimulTaNeouS threadS the single sign-on prOXy 18 cAn handle. The nuMbeR of tHREaDs hAS a PRacTiCAl lIMIt, as allowing a hiGh number of ThREaDs can cause AN adVeRse impaCt on the PerfoRMance of The SSO proXy applicaTiOn seRVEr 18. THe conventiOnal acceSs system dOEs not SUpPort dEsiRable fEaTurEs sucH as loaD BalAncinG, suppoRt For faiL-over AnD connectIon monitoring.
Certain exeMplary EmbodImeNts improvE upON knOwn methodS and Computer neTwoRks For prOviDIng acCess TO wEb aPPlicaTionS As part of a WEb PorTAL sEssion. This iS ACHieVed, acCorDIng to a FirsT aspect, through a coMPuter network, coMpriSINg: fIrsT And sEcOnd traffic manaGerS cONNected viA aN intermediaTe web serVeR. the fiRst traFfic maNager coMPRiSEs inteRfacE meAns for recEivInG From the UsEr,
 the request by the single  sign-on w eb ag ent  on  w eb s erve r 40. Any othe r  inf ormation necessary for  user  a u thor i za tionis eith e rs u ppl ie dinth e  r eques t o r is ob tained fro m p or tal database 32  and the u ser 's authoriza tio n to a cc ess the r equ ested  appli c ationis valida te d  accor d ingly.I f  t he s ingle sign-on web ag e nt on web serv er 40au t he n t ica tes —and singl esign- o n proxy 18 a u tho r izes—the user  to accesst hereques te d a p plicat ion,th e  us er requestis p roxied by  singl e  sign-o n  proxy18 toBES  28  inc on ve nti on a l m a nn eru sin g the Ap ac he  http clie n t l ibra ry.  For  acce ss to applica tio ns v i a s ingle  sign -on,  p roxy18 isrespo ns ible for sendin g to  BES 28,inaHTT Pheade r , anyinf orm ation r equired for  a u t h en tication and autho ri z a ti on of re questi n gus e r 10. Th eres pons e fromBES2 8to the u ser re q ue st  is pro ce ssed b ythe  si ngles ign- on web  agent o n pro x y web server 4 0  to remove an y  r e f er e nces  id entifying a n ap p lica tion on  BE S  28,suchas IP address, DNS entryan d port  numb er—so that an y furtherr e q uests fr om b r ow s er 12, to acce ss aresource o n  BES 28are a ddressed  to singl e sign-onweb  ag ent  on w eb  server 40, r a t herth an dire ctl y to BE S 2 8.Hav ing  b een suita bly proc es se don  si ngles ign-on p ro xy18 , t he re s ponsefromBES28  f o llo ws ther et u r n pa th  t o br ows er  12 v ia w e b s erver 4 0.
The co nve n tion al  a ccess s ystem of FIG.  1  has a num be r o f disa d v antages.  The performance is lim i ted due  to  theinef ficient a uth orizat ion and co mmunic ation  w ith t he ba c k  e ndsy stem. Thel o gic  to a ut hori ze therequest is quite c o mpl ex, as identi fyi ng t h e  a ppl i ca t ion  f r omt h e context in th e requestis co mplicated, req ui ring alot ofbespo k e codin g to hand le the re qu esta n d r esponse wh en it pa sses thro u gh si n gl e sig n-o n prox y18. 
Simu ltaneo u s r eques ts req ui re add ition al  threads  to be created on singl e sign -on p rox y 18. The ref o re,  the numb er o f users is  li mit ed by  th e  numb er o f  s imu l taneo us t h reads the si ngl e si gn-on proxy 1 8  ca n han dle .  The n umbe r of threads hasa  practical lim it,a s  al low i ng a  h igh number ofthr ea d s  can cau se  an adverse  impacton the p erform ance o f the S S O  p r oxy ap plic ati on server  18 .T he conv en ti o nal ac cess  s ystemdoes n o t su p p ort desirable fe ature s sucha s l oad b al ancing, supp ort for fa il-over and  conne ctio n mon itoring .Certai n e xe mplary emb o diments i mprov e uponkn ownmet hods a nd c o m puter  net wo rks  for prov i d in g  a cc e ssto w eb ap pl icat ions as p a rt of aweb portalse ssi o n . This is a chieved, a cco rding t o a firsta spec t ,t hroug h a co mputer  networ k , c om prising : f i r st and se cond traf f icma nage rs conne ct ed v ia  an  i ntermediate web  server.  The fir s t  traff icm anag e r comp ri ses interfac e mea ns for rec e i vin g fromt heuse r,
 the_request by_the single sign-on web_agent on_web_server 40._Any_other information necessary_for user authorization_is either supplied in_the request or_is_obtained from portal database 32 and the user's authorization to access the requested application_is_validated accordingly.
If_the_single_sign-on web agent on web_server 40 authenticates—and single sign-on_proxy 18_authorizes—the user to access the requested application, the_user_request is proxied_by single sign-on proxy 18 to BES 28 in_conventional manner using the Apache httpclient_library. For access_to_applications_via single sign-on, proxy_18 is responsible for sending to_BES 28, in a HTTP header,_any information required for authentication and authorization_of requesting user 10. The response_from BES 28 to the_user request_is processed by the single_sign-on web agent_on proxy_web server 40_to remove any references identifying an_application on BES_28, such as IP address, DNS_entry_and port number—so_that_any_further requests_from browser 12,_to_access a_resource_on BES 28 are addressed to_single_sign-on web agent on web server 40,_rather than directly to_BES_28. Having been suitably_processed on single sign-on proxy_18, the response from BES 28_follows the_return path_to browser 12 via web server 40.
The conventional access system of_FIG. 1 has a number of_disadvantages. The performance is_limited due_to_the inefficient authorization_and_communication with_the back end system. The logic to_authorize the_request is quite complex, as identifying_the application from the_context_in the request is complicated, requiring_a lot of bespoke coding to_handle the request and response_when_it_passes through single sign-on proxy_18.
Simultaneous requests require additional threads to_be created on_single sign-on proxy 18. Therefore, the number_of_users is limited by the number_of_simultaneous threads the single sign-on proxy_18_can_handle. The number of threads_has a practical limit, as allowing_a high number of threads can cause an adverse_impact on the_performance of the SSO proxy_application_server_18. The conventional access system does not support desirable features_such as_load balancing, support_for fail-over and connection monitoring.
Certain exemplary embodiments improve upon known_methods and computer networks for providing access_to web applications as part of a web portal session. This_is achieved, according to a first aspect, through_a computer network, comprising: first and second_traffic managers connected via_an_intermediate web server. The first traffic manager_comprises_interface_means_for receiving from_the user,