Single sign-on for unmanaged mobile devices

Patent metadata

Field	Value
Publication number	US-10965664-B2
Application number	US-201816236802-A
Country	US
Kind code	B2
Filing date	Dec 31, 2018
Priority date	Jun 15, 2015
Publication date	Mar 30, 2021
Grant date	Mar 30, 2021

Abstract

Disclosed are various examples for providing a single sign-on experience for mobile applications that may or may not be managed. A first application executed in a client device sends an access request to a service provider. The first application receives a redirection response from the service provider that redirects the first application to an identity provider. The first application then receives a further redirection response from the identity provider that causes the first application to request an identity assertion from a second application executed in the client device. The first application receives the identity assertion from the second application. The first authentication then authenticates with the service provider using the identity assertion.

First claim

Therefore, the following is claimed:

1. A non-transitory computer-readable medium embodying a program executable in a client device, the program, when executed by the client device, being configured to cause the client device to at least:
receive a first request for an identity assertion from a client application executed in the client device, the first request being initially redirected from a service provider to an identity provider and subsequently redirected from the identity provider to the program, the first request received through a uniform resource locator (URL) corresponding to the program, the URL having a unique identifier;
authenticate with the identity provider using at least one security credential;
send a second request for the identity assertion to the identity provider;
receive the identity assertion from the identity provider; and
send the identity assertion to the client application.

2. The non-transitory computer-readable medium of claim 1 , wherein the program, when executed by the client device, is further configured to cause the client device to at least:
render a user interface configured to receive the at least one security credential from a user of the client device; and
receive the at least one security credential through the user interface.

3. The non-transitory computer-readable medium of claim 1 , wherein the second request for the identity assertion includes an identification of the client application.

4. The non-transitory computer-readable medium of claim 1 , wherein the first request for the identity assertion is received through a local uniform resource locator (URL), wherein the local URL includes callback information corresponding to the client application.

5. A system, comprising:
a computing device;
a first client application executable by the computing device;
a second client application executable by the computing device; and
the first client application is configured to cause the computing device to at least:
send an access request to a service provider;
receive a first redirection response to an identity provider from the service provider;
request an identity assertion from the identity provider in response to the first redirection response;
receive a second redirection response to the second client application from the identity provider;
request the identity assertion from the second client application in response to the second redirection response, wherein the identity assertion is requested through a uniform resource locator (URL) corresponding to the second client application, the URL having a unique identifier;
receive the identity assertion from the second client application, wherein the identity assertion is generated by the identity provider; and

authenticate with the service provider using the identity assertion.

6. The system of claim 5 , wherein the first client application requests the identity assertion from the second client application by a local uniform resource locator (URL).

7. The system of claim 5 , wherein the second client application is configured to facilitate a single sign-on for a plurality of client applications executable in the computing device.

8. The system of claim 5 , wherein the first client application is further configured to cause the computing device to at least:
receive a session token from the service provider after authenticating; and
subsequently authenticate with the service provider using the session token.

9. The system of claim 5 , wherein at least one of the first redirection response or the second redirection response comprises security assertion markup language (SAML).

10. The system of claim 5 , wherein the second client application is further configured to cause the computing device to at least:
authenticate with the identity provider;
receive the identity assertion from the identity provider; and
return the identity assertion to the first client application.

11. The system of claim 10 , wherein the second client application is further configured to cause the computing device to at least:
render a user interface configured to receive at least one security credential from a user;
receive the at least one security credential from the user; and
authenticate with the identity provider using the at least one security credential.

12. The system of claim 10 , wherein the second client application is further configured to cause the computing device to at least send an identification of the first client application to the identity provider.

13. The system of claim 10 , wherein the second client application returns the identity assertion to the first client application by calling a local uniform resource locator (URL) that encodes the identity assertion.

14. A method, comprising:
sending, by a first application executed in a client device, an access request to a service provider;
receiving, by the first application, a first redirection response from the service provider;
requesting, by the first application, an identity assertion from an identity provider in response to the first redirection response;
receiving, by the first application, a second redirection response from the identity provider;
requesting, by the first application, the identity assertion from a second application executed in the client device in response to the second redirection response, wherein the identity assertion is requested through a uniform resource locator (URL) corresponding to the second client application, the URL having a unique identifier;
receiving, by the first application, the identity assertion from the second application, wherein the identity assertion is generated by the identity provider; and
authenticating the first application with the service provider using the identity assertion.

15. The method of claim 14 , wherein requesting the identity assertion from the second application further comprises sending a request for the identity assertion to the second application by calling a local uniform resource locator (URL) that encodes the request for the identity assertion.

16. The method of claim 15 , wherein the local URL includes callback information corresponding to the first application.

17. The method of claim 16 , wherein the callback information comprises an identifier corresponding to the first application.

18. The method of claim 14 , further comprising:
requesting, by the second application, at least one security credential from a user;
authenticating the second application with the identity provider using the at least one security credential.

19. The method of claim 14 , further comprising obtaining, by the second application, the identity assertion from the identity provider.

20. The method of claim 19 , wherein obtaining the identity assertion from the identity provider further comprises sending a request for the identity assertion to the identity provider, the request for the identity assertion specifying an identifier of the first application.

Assignees

• Airwatch Llc

Inventors

• Rykowski Adam
• Jain Ashish
• Olds Dale Roberts
• Xu Emily Hong
• Barday Kabir
• Austin Kyle
• Kommireddy Sridhara Babu

Classifications

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04W12/068

  using credential vaults, e.g. password manager applications or one time password [OTP] applications · CPC title

• H04L63/0815 Primary

  providing single-sign-on or federations · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• G06F21/44

  Program or device authentication · CPC title