Single sign-on for managed mobile devices using kerberos

Patent metadata

Field	Value
Publication number	US-10944738-B2
Application number	US-201715428467-A
Country	US
Kind code	B2
Filing date	Feb 9, 2017
Priority date	Jun 15, 2015
Publication date	Mar 9, 2021
Grant date	Mar 9, 2021

Abstract

Disclosed are various examples for single-sign on by way of managed mobile devices using Kerberos. For example, a certificate is received from a client device. In response, a Kerberos ticket-granting ticket is generated and sent to the client device. A request for a service ticket is later received from the client device. The request for the service ticket can include the ticket-granting ticket. The service ticket is then generated and sent to the client device. Subsequently, the service ticket is received from the client device and a security assertion markup language (SAML) response is sent to the client device in reply. The SAML response can provide authentication credentials for a service provider associated with the service ticket.

First claim

Therefore, the following is claimed:

1. A non-transitory computer-readable medium embodying a program executable by a processor of a computing device to cause the computing device to at least:
receive a certificate from a client device in response to a Kerberos challenge presented to the client device;
generate a ticket-granting ticket in response to validation of the certificate;
send the ticket-granting ticket to the client device;
receive a request for a service ticket associated with a service provider from the client device, wherein the request for the service ticket includes the ticket-granting ticket;
verify that a permission associated with the ticket-granting ticket authorizes the client device to receive the service ticket associated with the service provider;
generate the service ticket in response to a verification that the permission authorizes the client device to receive the service ticket;
send the service ticket to the client device;
receive the service ticket from the client device; and
send a security assertion markup language (SAML) response to the client device in response to the service ticket received from the client device, wherein the SAML response provides an authentication token for the service provider associated with the service ticket.

2. The non-transitory computer-readable medium of claim 1 , wherein the program further causes the computing device to at least receive a SAML authentication request from the client device.

3. The non-transitory computer-readable medium of claim 2 , wherein the program further causes the computing device to at least send the Kerberos challenge to the client device in response to receipt of the SAML authentication request.

4. The non-transitory computer-readable medium of claim 3 , wherein:
the Kerberos challenge is sent as a component of a hypertext transport protocol (HTTP) response that comprises a 401 unauthorized status code; and
the certificate is received from the client device in response to the Kerberos challenge.

5. The non-transitory computer-readable medium of claim 1 , wherein the program further causes the computing device to perform the validation of the certificate with an online certificate status protocol (OCSP) service.

6. The non-transitory computer-readable medium of claim 5 , wherein the ticket-granting ticket is generated in response to the validation of the certificate by the OCSP service.

7. A system, comprising:
a computing device comprising a processor and a memory; and
machine readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least:
receive a certificate from a client device in response to a Kerberos challenge presented to the client device;
generate a ticket-granting ticket in response to validation of the certificate;
send the ticket-granting ticket to the client device;
receive a request for a service ticket associated with a service provider from the client device, wherein the request for the service ticket includes the ticket-granting ticket;
verify that a permission associated with the ticket-granting ticket authorizes the client device to receive the service ticket associated with the service provider;
generate the service ticket in response to a verification that the permission authorizes the client device to receive the service ticket;
send the service ticket to the client device;
receive the service ticket from the client device; and
send a security assertion markup language (SAML) response to the client device in response to the service ticket received from the client device, wherein the SAML response provides an authentication token for the service provider associated with the service ticket.

8. The system of claim 7 , wherein the machine readable instructions, when executed by the processor, further cause the computing device to at least receive a SAML authentication request from the client device.

9. The system of claim 8 , wherein the machine readable instructions, when executed by the processor, further cause the computing device to at least send the Kerberos challenge to the client device in response to receipt of the SAML authentication request.

10. The system of claim 9 , wherein:
the Kerberos challenge is sent as a component of a hypertext transport protocol (HTTP) response that comprises a 401 unauthorized status code; and
the certificate is received from the client device in response to the Kerberos challenge.

11. The system of claim 7 , wherein the machine readable instructions, when executed by the processor, further cause the computing device to perform the validation of the certificate with an online certificate status protocol (OCSP) service.

12. The system of claim 11 , wherein the ticket-granting ticket is generated in response to the validation of the certificate by the OCSP service.

13. A method, comprising:
receiving a certificate from a client device in response to a Kerberos challenge presented to the client device;
generating a ticket-granting ticket in response to validation of the certificate;
sending the ticket-granting ticket to the client device;
receiving a request for a service ticket associated with a service provider from the client device, wherein the request for the service ticket includes the ticket-granting ticket;
verifying that a permission associated with the ticket-granting ticket authorizes the client device to receive the service ticket associated with the service provider;
generating the service ticket in response to a verification that the permission authorizes the client device to receive the service ticket;
sending the service ticket to the client device;
receiving the service ticket from the client device; and
sending a security assertion markup language (SAML) response to the client device in response to the service ticket received from the client device, wherein the SAML response provides an authentication token for the service provider associated with the service ticket.

14. The method of claim 13 , further comprising receiving a SAML authentication request from the client device.

15. The method of claim 13 , further comprising sending the Kerberos challenge to the client device in response to receipt of the SAML authentication request.

16. The method of claim 15 , wherein the Kerberos challenge is sent as a component of a hypertext transport protocol (HTTP) response that comprises a 401 unauthorized status code.

17. The method of claim 15 , wherein receiving the certificate from the client device occurs in response to sending the Kerberos challenge to the client device.

18. The method of claim 13 , wherein the validation of the certificate is performed with an online certificate status protocol (OCSP) service.

19. The method of claim 18 , wherein generating the ticket-granting ticket occurs in response to the validation of the certificate with the OC SP service.

20. The non-transitory computer-readable medium of claim 1 , wherein the SAML response further comprises an assertion that the client device is authorized to access the service provider.

Assignees

• Airwatch Llc

Inventors

• Rykowski Adam
• Barday Kabir
• Brannon Jonathan Blake

Classifications

• H04W12/37

  Managing security policies for mobile devices or for controlling mobile applications · CPC title

• H04W12/08

  Access security · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title