Abstract: This invention provides improved methods for generation of hematopoietic precursor cells from a pluripotent stem cell and hematopoietic precursor cells generated thereof. The hematopoietic precursor cells express CXCR4 or runx1c and are capable of homing and/or engraftment in bone marrow.

Abstract: A method for multi-protocol logout. The method includes receiving, by a first identity provider, a logout request from a user agent, wherein the first identity provider executes in a federation manager, and initiating a logout on a service provider associated with the first identity provider based on the logout request by the first identity provider. The method further includes identifying, by the federation manager, a plurality of identity providers associated with the user agent, wherein the plurality of identity providers communicate using heterogeneous federation protocols, and initiating, by the federation manager, a logout on each of the plurality of identity providers based on the logout request using the plurality of heterogeneous federation protocols. The method further includes initiating, by the plurality of identity providers, a logout of each service provider corresponding to the plurality of identity providers, identifying a status of each logout, and sending the status to the user agent.

Abstract: A mechanism is disclosed for enabling an attribute provider service (APS), which provides access to one or more attributes, to control access to the attributes at the attribute level. In one implementation, a request is received, which specifies a particular attribute that is desired to be accessed from an attribute repository. In response to this request, a policy that applies to the particular attribute is accessed. The policy is then processed to determine whether access to the particular attribute is to be allowed or denied. With the above mechanism, it is possible to control access to attributes at the attribute level rather than at the service level. Because access control is exercised at such a low level, an administrator can exercise much tighter and precise control over how attributes provided by an APS are accessed.

Abstract: A method for managing access to multiple applications using a central server. The method includes receiving a user name and password from an application for a user, generating identity assertion information using the user name and password, generating an artifact associated with the identity assertion information, sending the artifact to the application, receiving the artifact and a request for the identity assertion information from a second application, verifying the validity of the artifact, and sending the identity assertion information to the second application. The second application uses the identity assertion information to authorize the user to access the second application.

Abstract: Embodiments of the present invention provide a circle of trust on a network. The circle of trust is configured by exchanging credential of a first and a second affiliated entity. The credentials of the first affiliated entity is stored in a trusted partner list of the second affiliated entity. The credentials of the second affiliated entity is stored in a trusted partner list of the first affiliated entity. Thereafter, a circle of trust session may be provided when a client device initiates use of a resource on a relying party device by providing an authentication assertion reference. The identity of the issuing party of the authentication is determined as a function of the authentication assertion reference. The relying party sends an authentication query containing its credential to the issuing party. The issuing party determines if the relying party is a trusted entity based upon whether the relying party's credential is contained in the trusted partner list of the issuing party.

Abstract: A method for authentication. The method includes receiving a re-directed access request for a resource associated with a second authentication level, where a user has requested, the user is associated with a session, and the session associated with a first authentication level. The method further includes identifying a second authentication context using the second authentication level, generating an authentication request using the second authentication context, and sending the authentication request to an identity provider. In response the identity provider identifies an authentication scheme corresponding to the second authentication context, obtains authentication information from the user, authenticates the user using the authentication information, and generates an assertion, in response to successful authentication, using the second authentication level, and the authentication scheme.

Abstract: A method for multi-protocol logout. The method includes receiving, by a first identity provider, a logout request from a user agent, wherein the first identity provider executes in a federation manager, and initiating a logout on a service provider associated with the first identity provider based on the logout request by the first identity provider. The method further includes identifying, by the federation manager, a plurality of identity providers associated with the user agent, wherein the plurality of identity providers communicate using heterogeneous federation protocols, and initiating, by the federation manager, a logout on each of the plurality of identity providers based on the logout request using the plurality of heterogeneous federation protocols. The method further includes initiating, by the plurality of identity providers, a logout of each service provider corresponding to the plurality of identity providers, identifying a status of each logout, and sending the status to the user agent.

Abstract: A mechanism is disclosed for providing a user's web service provider's (WSP's) access information to a web service consumer (WSC). In one embodiment, a directory service provider (DSP) receives, from a WSC, a request for a particular user's WSP access information. The request contains identifying information that is associated with the particular user. A repository indicates, for each user, an associated user characteristic. Each user characteristic is associated with a separate template object that indicates one or more WSP instances' access information. In response to receiving the request, the DSP determines, from the repository, the user characteristic that is associated with the particular user. The DSP sends, in a response to the WSC's request, the one or more WSP instances' access information that is indicated in the template object that is associated with the particular user's associated user characteristic. The WSC may use the WSP access information to direct a query to a particular WSP.

Abstract: In accordance with one embodiment of the present invention, there is provided a mechanism for implementing navigation seamlessly between sites in a computing environment in order to access resources without having to require users or user agents to re-authenticate. In one embodiment, there is provided the ability to determine different attribute sets for use with different resources on a target site for a user or user agent authenticated with a first site seeking to access one or more resources of the second site without re-authenticating. In one embodiment, there is provided the ability to map accounts on a first site to accounts on the second site using a set of attributes selected from among attributes provided by an application on the first site. With this mechanism, it is possible for applications or other resources to share information about a user or a user agent across disparate web sites seamlessly.

Abstract: A method and system for dynamically generating web based user interfaces. In one embodiment, a method is disclosed for displaying a user interface over a network to a user. The method begins by reading an HTTP request for authentication from a browser associated with the user. The HTTP request comprises credential information associated with the user. Based on the credential information, a first plug-in module from a plurality of plug-in modules is invoked to authenticate the user. Also, each of the plurality of plug-in modules provide similar authentication services. An authentication user interface is dynamically generated based on the HTTP request and configuration properties that are defined by the first plug-in module.

Abstract: Embodiments of the present invention provide an open and interoperable single sign-on session in a heterogeneous communication network. The open and interoperable single sign-on system is configured by exchanging an entity identifier, an account mapping, an attribute mapping, a site attribute list, an action mapping and/or the like. The entity identifier, account mapping, attribute mapping, site attribute list, action mapping and the like for each partner entity is stored in a partner list accessable to the particular entity. Thereafter, the open and interoperable single sign-on session may be provided upon receipt of a SAML request or assertion containing an entity identifier. The entity identifier contained in the SAML request or assertion is looked-up in the partner list of the particular entity which received the SAML request or assertion. A record containing a matching entity identifier provides the applicable account mapping, attribute mapping, site attribute list, and/or action mapping.

Abstract: A system for providing service attribute information including a directory server containing a hierarchical data store associating users with service attributes through data inheritance, wherein the hierarchical data store includes an organization level and a role level, and attribute templates defined with respect to services and levels, an application for generating a query to the directory server for a service attribute of a particular user of the application, wherein the directory server, in response to the query, is for using inheritance rules from the hierarchical data store to determine and report a service attribute for the particular user of the application.

Abstract: The present invention is directed to the application of the Class of Service (CoS) feature in a directory server. The CoS feature allows user entries in a directory to be associated to service templates for multiple registered services in the directory. Once a service is registered, a CoS definition (service definition) may be created for that service under the organization entry. Once a service gets activated, an associated CoS template (service template) may be created for that service using its service definition. The template entries contain a list of shared attribute values and changes to these values get automatically applied to all the entries sharing the attribute. By creating these service definitions and templates under an organization entry, all the service privileges can be made available to all entries under the organization. Similarly, policies for resources can be defined for an organization and policy specific attributes can be made applicable to all the entries in the organization.

Abstract: Embodiments of the present invention provide a circle of trust on a network. The circle of trust is configured by exchanging credential of a first and a second affiliated entity. The credentials of the first affiliated entity is stored in a trusted partner list of the second affiliated entity. The credentials of the second affiliated entity is stored in a trusted partner list of the first affiliated entity. Thereafter, a circle of trust session may be provided when a client device initiates use of a resource on a relying party device by providing an authentication assertion reference. The identity of the issuing party of the authentication is determined as a function of the authentication assertion reference. The relying party sends an authentication query containing its credential to the issuing party. The issuing party determines if the relying party is a trusted entity based upon whether the relying party's credential is contained in the trusted partner list of the issuing party.

Abstract: Embodiments of the present invention provide an open and interoperable single sign-on session in a heterogeneous communication network. The open and interoperable single sign-on system is configured by exchanging an entity identifier, an account mapping, an attribute mapping, a site attribute list, an action mapping and/or the like. The entity identifier, account mapping, attribute mapping, site attribute list, action mapping and the like for each partner entity is stored in a partner list accessable to the particular entity. Thereafter, the open and interoperable single sign-on session may be provided upon receipt of a SAML request or assertion containing an entity identifier. The entity identifier contained in the SAML request or assertion is looked-up in the partner list of the particular entity which received the SAML request or assertion. A record containing a matching entity identifier provides the applicable account mapping, attribute mapping, site attribute list, and/or action mapping.

Abstract: The present invention is directed to the application of the Class of Service (CoS) feature in a directory server. The CoS feature allows user entries in a directory to be associated to service templates for multiple registered services in the directory. Once a service is registered, a CoS definition (service definition) may be created for that service under the organization entry. Once a service gets activated, an associated CoS template (service template) may be created for that service using its service definition. The template entries contain a list of shared attribute values and changes to these values get automatically applied to all the entries sharing the attribute. By creating these service definitions and templates under an organization entry, all the service privileges can be made available to all entries under the organization. Similarly, policies for resources can be defined for an organization and policy specific attributes can be made applicable to all the entries in the organization.