System and method for proxying federated authentication protocols

Patent metadata

Field	Value
Publication number	US-10764286-B2
Application number	US-201816228578-A
Country	US
Kind code	B2
Filing date	Dec 20, 2018
Priority date	Feb 22, 2013
Publication date	Sep 1, 2020
Grant date	Sep 1, 2020

Abstract

A system and method that include receiving a service provider identity request through a protocol; transmitting a proxy identity request to a configured identity provider; receiving an identity assertion; determining a proxy identity assertion based on the identity assertion; and transmitting the proxy identity assertion to the service provider.

First claim

What is claimed is:

1. A method for providing a proxy identity assertion for a service provider, comprising:
simulating an identity provider in a first type of authentication protocol based on a service provider identity request;
simulating the service provider in a second type of authentication protocol different from the first type of authentication protocol to transmit a proxy identity request;
translating attributes between the first type of authentication protocol and the second type of authentication protocol; and
determining a proxy identity assertion.

2. The method of claim 1 , wherein the first type of authentication protocol and the second type of authentication protocol are federated authentication protocols.

3. The method of claim 1 , wherein the first type of authentication protocol and the second type of authentication protocol are OpenID Connect protocols.

4. The method of claim 1 , wherein the first type of authentication protocol and the second type of authentication protocol are security assertion markup language (SAML) protocols.

5. The method of claim 1 , further comprising executing an additional layer of authentication.

6. The method of claim 1 , further comprising transmitting the proxy identity request, wherein the transmitted proxy identity request is received at the identity provider.

7. The method of claim 1 , further comprising transmitting the proxy identity assertion from the identity provider to the service provider.

8. The method of claim 1 , further comprising:
prior to transmitting the proxy identity request, selecting the second type of authentication protocol according to an identifier of a managing account.

9. The method of claim 8 , wherein the identifier includes a uniform resource locator (URI).

10. The method of claim 9 , wherein the second type of authentication protocol is a lightweight directory access protocol (LDAP).

11. The method of claim 9 , wherein translating attributes between the first authentication type of protocol and the second type of authentication protocol comprises translating from attributes of a security assertion markup authentication protocol (SAML) and scopes of an OpenID Connect protocol.

12. The method of claim 1 , wherein one or more steps are performed at a proxy server.

13. The method of claim 12 , wherein the proxy server is installed within an internal network, and the method further comprises executing an additional layer of authentication within the internal network.

14. A system comprising:
a proxy server that comprises:
an identity provider interface that simulates an identity provider through a first type of protocol,
a service provider emulator that simulates a service provider through a second type of protocol,
a translation module that translates identity requests and identity assertions processed within the identity provider interface and the service provider emulator, and

an account system with a stored configuration of at least one managing account that includes configuration of the first type of protocol and the second type of protocol.

15. The system of claim 14 , wherein the proxy server is of a multi-tenant service of an additional layer of authentication, and the proxy server is configured to perform executing an additional layer of authentication by the proxy server.

16. The system of claim 15 , wherein the proxy server is configured to perform the executing the additional layer of authentication by authenticating an identity request among the identity requests with an additional device associated with an identity of the identity request.

17. The system of claim 15 , wherein the account system further comprises a stored configuration of the additional layer of authentication.

18. The system of claim 15 , wherein the translation module includes translation rules to translate between a security assertion markup language protocol and an Open ID Connect protocol.

19. The system of claim 15 , wherein the first type of protocol and the second type of protocol are federated authentication protocols.

20. A method for single sign-on, comprising:
configuring a first instance and a second instance of an authentication protocol;
receiving an identity assertion through the first instance;
simulating, in the second instance, an identity provider to transmit a proxy identity assertion; and
prior to transmitting the proxy identity assertion, selecting the second instance according to an identifier of a managing account from the first instance.

Assignees

• Duo Security Inc

Inventors

• Oberheide Jon
• Song Douglas

Classifications

• H04L63/0815

  providing single-sign-on or federations · CPC title

• H04L63/0884 Primary

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title