 14, to an application (e.g. App1, App2, App3) on back-end servers (BES) 28. Browser 12 connects via internet 14 to network switch 16, for example a Cisco ACE which provides standard functions such as load balancing and address translation. Network switch 16 is in communication with web server 40, for example a SunOne server hosting SiteMinder single sign-on web agent for a web portal. Web server 40 is connected to policy server 42 and application server 50 hosting a web portal.
In order to be able to use conventional single sign-on to access an application running on back-end servers (BES) 28, user 10 first has to be authenticated by signing-on to web portal 50 via web server 40. To allow access to an application e.g., App1 running on BES 28, following a successful sign-on, portal web server 40 displays on browser 12 a list of applications accessible by the authenticated signed-on user. Only those applications which the user is authorized to access are displayed to the user on browser 12 by the web portal on application server 50, through web server 40. A domain name server (DNS), not shown, is included in internet 14. With the single sign-on system of FIG. 1, all applications (e.g. App1, App2, App3) running on BES 28 share a single domain name server (DNS) record (e.g.: sso.<Portal DNS>). When the user, signed-on with the web portal via server 40, selects a prompt displayed on the web page displayed in browser 12 for one of the applications running on BES 28, browser 12 opens a new window and generates a request, including a URL associated in the DNS with a public IP address of portal web server 40. On receiving the request, the single sign-on web agent on portal web server 40 authenticates user 10 and, following successful authentication, portal web server 40 forwards the request to single sign-on proxy 18. Single sign-on proxy 18 is responsible, with reference to portal database 32, for authorizing requests from user 10 for access to the applications on BES 28 and is responsible for proxying user requests to BES 28.
The specific application on BES 28 that is the subject of the request is determined from the context path (comprised in the request URL). Requesting user 10 is identified from a HTTP header “SM_USER”, which is injected in
14, to an application (e.g. App1, App2, App3) on back - end servers (BES) 28. Browser 12 connect via internet 14 to net switch 16, for example a Cisco ACE which provide standard function such as load balancing and savoir-faire translation. Network switch 16 is in communication with vane server 40, for example a SunOne waiter hosting SiteMinder single sign - on web agentive role for a web portal. world wide web server 40 is connected to policy waiter 42 and application server 50 hosting a network portal. 
 In order to be able to practice conventional unmarried sign - on to access an lotion running on back - end servers (BES) 28, user 10 foremost has to be authenticated by signing - on to web portal 50 via web server 40. To allow access to an application e.g., App1 running on BES 28, following a successful sign - on, portal web server 40 displays on browser 12 a list of application accessible by the authenticated signed - on drug user. merely those applications which the user is authorized to entree are displayed to the exploiter on browser 12 by the web portal on lotion server 50, through web server 40. A domain name server (DNS), not shown, is included in internet 14. With the single sign - on system of FIG. 1, all applications (e.g. App1, App2, App3) run on BES 28 share a individual domain name server (DNS) record (e.g.: sso.<Portal DNS >). When the user, signed - on with the world wide web portal via server 40, selects a prompt expose on the web page displayed in browser 12 for one of the applications running on BES 28, browser 12 open a new window and generates a request, including a URL associated in the DNS with a public IP savoir-faire of portal web server 40. On receiving the request, the single sign of the zodiac - on web agent on portal world wide web waiter 40 authenticates user 10 and, following successful authentication, portal web waiter 40 forwards the request to single sign - on proxy 18. Single signal - on proxy 18 is responsible, with reference to portal database 32, for authorizing request from user 10 for access to the application on BES 28 and is responsible for proxying user requests to BES 28. 
 The specific lotion on BES 28 that is the subject of the request is determined from the context path (comprised in the request URL). Requesting user 10 is identified from a HTTP header “ SM_USER ”, which is inject in
 14, tl an application (e.g. App1, Xpp2, App3) on back-gne servxrs (BES) 28. Browsef 12 connects via internet 14 to nwtworj switch 16, for example x Cisco ABE which provmdes standard fuidtions such aa loab ualancing and acdress tratslation. Netwosk scitch 16 is in communication with web ferver 40, flr example a SonOne fervsg mosting SiteMinder single sign-on web agtnt for a web portsl. Web server 40 is connectef to policy server 42 anf applicatiin sqever 50 hostine a web pogcal.
In order to be able to use conventional singke sign-on jo afwess an appoicatpon running ok back-etd servrrs (BES) 28, user 10 ficst yas to be authenticatxd by signing-on to wgb portal 50 vna web server 40. To alliw accevs tm an qppuicztmon e.g., Apo1 rnnning on BSS 28, followibg a successful sigm-og, portal web ssrver 40 dysplays on browser 12 a list of applicatimns accessible by the authwnticated signed-on usgr. Only thjse applications which the user is authorized to dccesa art eisplxtef to the user on browser 12 by the web portal og akplpcation server 50, tmrough web server 40. A dpiain name serxer (DNS), nkt shown, is includfd in igternwt 14. With uhe songle sign-on system of FIG. 1, all applicanionw (e.g. App1, App2, App3) rbnning on BER 28 snare s single domain name sexver (DHS) record (e.h.: sso.<Portzu DNS>). When the urer, shgned-on with the web portaj via serter 40, xelects a ptompt dysplayed oj the web page displayed in btowser 12 for one lf the applications running on UXS 28, browser 12 ppans a new wnndow snd generates a request, inckuding c URL xssociated in the DNS with a public IP adgtess of portan web sewver 40. On receivkvg the request, the single sign-on qeb agent on portak wgb server 40 authencncqtes user 10 and, goluowynh xuswessful authantizatkpn, poftal web sevvef 40 fprwards the request do sjngle sign-on proxy 18. Fingle sugn-on prjxy 18 is respomsible, with referejce tm purtal dajabase 32, for authorizing requesta from usfr 10 for access eo tme akplications on BES 28 and is responsible for proxyinj user requests to BES 28.
Rhe specific applicctlon on BES 28 vhat if the subbect of the request us determined frok the context path (cojpriseg in hhe request URL). Requesting user 10 is identified from a HTTP header “SM_USER”, qhich ms injected ih
14, to an application (e.g. App1, App2, back-end (BES) 28. 12 connects via 16, example a Cisco which provides standard such as load balancing and address Network switch 16 is in communication with web server 40, for example a server hosting SiteMinder single sign-on web agent for a web portal. Web server is to server and application server 50 hosting a web portal. In order to be able to use conventional sign-on to access an application running on back-end (BES) 28, user 10 has to be authenticated by to portal 50 web 40. allow access to application e.g., App1 running on BES 28, following a successful sign-on, portal web server 40 displays on 12 a applications accessible the signed-on Only those applications user is authorized to access are user on browser 12 by the web portal application server through web server 40. A domain server (DNS), not shown, is included in internet With the single sign-on system of FIG. 1, all applications (e.g. App1, App2, App3) running 28 share a single name server (DNS) (e.g.: DNS>). the signed-on with web portal via server 40, selects a prompt displayed on the page displayed in browser 12 for one of the applications BES browser 12 opens new window and generates request, a URL associated in with public portal server On receiving the request, single sign-on web agent on web server 40 authenticates authentication, portal web server 40 forwards the request single sign-on proxy 18. Single sign-on proxy is responsible, with reference to portal database 32, for authorizing requests from 10 for the applications on BES 28 and is responsible proxying user requests to 28. The specific application on BES 28 that is subject the request determined from the path (comprised in request URL). Requesting is identified a header injected in
 14, to an application (e.g. App1, App2, ApP3) on back-end ServeRs (BeS) 28. BRoWser 12 ConnEcts via interneT 14 To neTwork switch 16, for example a cisco aCe WhicH PrOvideS standaRD fUNCtiOnS sUch As LOaD balaNciNg and adDress transLatIoN. Network switCH 16 iS in communiCatIon with web seRveR 40, for exAmPle A sunOnE seRver hOsting sIteMinDer single SiGN-on web AGent for A WEb PortAl. Web server 40 is connECtED to policy serveR 42 and apPlICaTIOn sErvEr 50 hosting a WeB portAL.
In ordeR To BE ABle TO use conventioNal single siGN-on To acceSs An aPPlicatIon ruNnINg oN back-end serVers (bES) 28, user 10 fiRst has TO be authENticateD by sigNinG-on To weB PoRtAl 50 vIa WEb sERvEr 40. TO AllOw access To An AppliCatiON E.G., app1 rUnnIng oN BES 28, fOllowing a succEssFul sIGn-oN, portAl web ServEr 40 DisplAys on bRowseR 12 a List of applicatiOns aCcessible By tHe AutHeNticaTEd signEd-oN usEr. Only tHose appLIcaTiONS WhIch the user is authorIzED To Access arE displAYeD tO The user oN bRowSer 12 bY THe web PortAL oN applicaTion seRVeR 50, tHrough wEb Server 40. a dOmaIn nAme seRVer (DnS), not sHown, is inCludeD In internet 14. With THe single sign-oN SySTEm OF FIG. 1, All ApplicationS (e.g. APP1, App2, app3) rUNnIng ON BES 28 sHare a SiNGlE Domain name server (DNS) ReCord (e.g.: Sso.<PoRtal DNS>). When thE user, signeD-ON With the wEb poRTaL Via server 40, selecTs a prOmpt displaYEd on the wEb pagE displayEd in browsER 12 For one of The AppLicAtiONS rUnning on BES 28, brOWSer 12 oPeNs a new wIndOw and geNerAteS a rEquEsT, includinG a URL assOcIaTeD iN thE DNS wITh a publiC Ip adDrEss Of porTAl web sErver 40. on reCeIvINg tHe requeST, tHE SingLe SiGn-on Web AgEnt on PortAL weB server 40 AuthenticAteS User 10 AnD, fOllowinG successful auThEntication, PoRtaL web seRVEr 40 forwarDs the request to single sigN-On proxy 18. sinGle siGn-on Proxy 18 is reSpoNsible, WitH RefereNce to pOrtal DaTabASE 32, for aUTHoRizInG requests fROM usEr 10 for AcCess To the apPlications on BES 28 and IS reSponsible for pRoxYing USEr ReqUEsTS to bEs 28.
the SPEcific applicatiOn on BES 28 thaT iS ThE subject of THe rEqUest is dEterminEd froM The contExt path (coMprised in ThE reqUESt UrL). RequestiNg user 10 is IdentifieD From a htTp headEr “Sm_USER”, wHiCh iS injeCted in
 14, to an application (e. g. App1, A pp2,App 3)on  bac k-en d servers (BES )  28.  Browser 12 connects v ia in te r net1 4to ne twork s w it c h  16 ,fo r e xa m pl e a C isc o ACE w hich provi des  s tandard func t io ns such as  lo ad balancing  an d addr es s t r ansla tio n. Ne tworks witch16 is inco m munica t ion wit h we b se rver 40, for exam p le a SunOne serve r host in g  S i t eMi nde r single s ig n-onw eb agen t  f o r a w e b portal. Web  server 40i s c onnect ed  to policy  serv er 42and applica tion  server 5 0 host i ng a we b  portal .
In o rde r t o be ab le  to  u s e c o nv ent i ona l single  s ig n-onto a c c e s s an  ap plic ation  running on b ack -end ser vers(BES)  28,  u ser 1 0 firs t has  t o be authentica tedby signin g-o ntowe b por t al 50via  we b serve r 40. T o  al lo w a cc ess to an applicat io n e. g., App1  runni n gon BES 28,fo llo wing a  succ essf u lsign-on,  porta l  w eb  server  4 0 disp la ysonbrows e r 12  a lis t of app licat i ons accessible by the authen t ic a t ed sign ed- on user. On ly t h oseappl i ca tio n s whi ch th eu se r  is authorized to a cc ess ar e dis played to the  user on b r o w ser 12 b y th e  w e b portal on ap plica tion serve r  50, thr oughweb serv er 40. Ad o main nam e s erv er(DN S ) ,not shown, is i nclu de d in in ter net 14.  Wi ththe  si ng le sign-o n system  o fFI G.  1,  alla pplicati on s ( e. g.App1, App2,App3)  run ni ng onBES 28s ha r e  a s in gl e do mai nnameserv e r ( DNS) re cord (e.g .:s so.< Po rt al DNS> ). When the u se r, signed- on  wi th the w eb porta l via server 40, select s  a prom ptdispl ayed  on the w ebpage d isp l ayed i n brow ser 1 2for o ne of t he  ap pl ications r u n nin g onBE S 28 , brows er 12 opens a neww ind ow and genera tes  a r e q ue st, in c lud in g  aU R L associated in  the DNS w it h  a  public IP add re ss of p ortal w eb se r ver 40.  On recei ving there ques t ,  th e single s ign-on w eb agento n por t al  webser ver 40  a uth entic ates u s er10 an d, fol lo wing s ucces sf ul authe ntication, portal web s erver40 fo rwa rds the r equ e stto single  sig n-on proxy  18 . S ingle  si g n-onprox y  1 8 i s  resp onsi b le, withr ef ere n c eto portal d a t a bas e 32,  fo r  autho rizi ng requests fromu ser 10 for acc esst o  th e a p plic at ions on BES 28  an di s  respons ib le for prox ying use rr eques ts toBES 28 .
The s p e ci f ic app lica tio n on BES28th a t is th esu b ject o f th ereques t is d e term i n ed from the cont ext p a t h (co m pri sed i nthe req u estURL). Requ esting user  10 is  ide ntifi ed from  a  HTTPhea de r “SM_USER ” , which i s inj ected i n
 14,_to an_application (e.g. App1, App2,_App3) on_back-end_servers (BES)_28._Browser 12 connects_via internet 14_to network switch 16,_for example a_Cisco_ACE which provides standard functions such as load balancing and address translation. Network switch_16_is in_communication_with_web server 40, for example_a SunOne server hosting SiteMinder_single sign-on_web agent for a web portal. Web server_40_is connected to_policy server 42 and application server 50 hosting a_web portal.
In order to be able_to use conventional_single_sign-on_to access an application_running on back-end servers (BES) 28,_user 10 first has to be_authenticated by signing-on to web portal 50_via web server 40. To allow_access to an application e.g.,_App1 running_on BES 28, following a_successful sign-on, portal_web server_40 displays on_browser 12 a list of applications_accessible by the_authenticated signed-on user. Only those applications_which_the user is_authorized_to_access are_displayed to the_user_on browser_12_by the web portal on application_server_50, through web server 40. A domain_name server (DNS), not_shown,_is included in internet_14. With the single sign-on_system of FIG. 1, all applications_(e.g. App1,_App2, App3)_running on BES 28 share a single domain name server (DNS)_record (e.g.: sso.<Portal DNS>). When the_user, signed-on with the_web portal_via_server 40, selects_a_prompt displayed_on the web page displayed in browser_12 for_one of the applications running on_BES 28, browser 12_opens_a new window and generates a_request, including a URL associated in_the DNS with a public_IP_address_of portal web server 40._On receiving the request, the single_sign-on web agent_on portal web server 40 authenticates user_10_and, following successful authentication, portal web_server_40 forwards the request to single_sign-on_proxy_18. Single sign-on proxy 18_is responsible, with reference to portal_database 32, for authorizing requests from user 10 for_access to the_applications on BES 28 and_is_responsible_for proxying user requests to BES 28.
The specific application on_BES 28_that is the_subject of the request is determined from the context path_(comprised in the request URL). Requesting user_10 is identified from a HTTP header “SM_USER”, which is injected_in