Method and system for seamless single sign-on (SSO) for native mobile-application initiated open-ID connect (OIDC) and security assertion markup language (SAML) flows

Patent metadata

Field	Value
Publication number	US-11140146-B2
Application number	US-201816233998-A
Country	US
Kind code	B2
Filing date	Dec 27, 2018
Priority date	Dec 27, 2018
Publication date	Oct 5, 2021
Grant date	Oct 5, 2021

Abstract

A method, a non-transitory computer readable medium, and a mobile device are disclosed for accessing a resource hosted on a relying party server from a mobile device. The method includes: hosting a native application on the mobile device, the native mobile device having a user agent for pre-authenticated users; receiving a redirection request from an authentication server for an authentication token for a pre-authenticated user in response to a request for the resource hosted on the relying party server; sending the authentication token for the pre-authenticated user from the user agent of the mobile device to the authentication server in response to the redirection request form the authentication server; and authenticating the authentication token from the user agent on the authentication server and generating an authentication cookie for the authenticated user to access the resource on the relying party server.

First claim

What is claimed is:

1. A method for accessing a resource hosted on a relying party server from a mobile device, the method comprising:
hosting, on the mobile device, a native application, the mobile device including a user agent for pre-authenticated users;
receiving, on the native application on the mobile device, a redirection request from an authentication server for an authentication token for a pre-authenticated user in response to a request for the resource hosted on the relying party server;
sending, from the user agent on the mobile device, the authentication token for the pre-authenticated user to the authentication server in response to the redirection request form the authentication server;
receiving, on the native application on the mobile device, an authentication cookie for the authenticated user to access the resource on the relying party server, the authentication cookie being received in response to the authentication server authenticating the authentication token received from the user agent of the mobile device;
sending, by the native application on the mobile device, the authentication cookie to the relying party server; and
accessing, by the native application on the mobile device, the resource hosted on the relying party server.

2. The method according to claim 1 , further comprising:
authenticating the pre-authenticated user on the mobile device via a single sign-on (SSO) method.

3. The method according to claim 2 , further comprising:
upon authentication of the pre-authenticated user, registering an intent to be called for the pre-authenticated user with an operating system (OS) of the mobile device, the intent to be called configured to respond to the redirection request from the authentication server with the authentication token for the pre-authenticated user from the user agent of the mobile device upon receipt.

4. The method according to claim 1 , wherein the authentication server is an OpenID Connect (OIDC) provider or a Security Assertion Markup Language (SAML) Identity Provider, and the relying party server is an OIDC Relying Party or a SAML Service Provider.

5. The method according to claim 1 , wherein the authentication token is a JSON Web Token (JWT).

6. The method according to claim 1 , wherein an operating system of the mobile device continuously waits for the redirection request from the authentication server with the authentication token for the pre-authenticated user from the user agent of the mobile device to avoid loss of flow of the request for the resource hosted on the relying party server.

7. The method according to claim 6 , wherein the redirection request from the authentication server via the user agent is configured to operate concurrently with requests for resources hosted on the relying party server via a Web Browser on the mobile device.

8. The method according to claim 1 , further comprising:
sending, from the native application on the mobile device, a request to the relying party server for the resource hosted on the relying party server;
receiving, on the native application on the mobile device, a redirection request from the relying party server;
sending, by the native application on the mobile device, a request without details on the pre-authenticated user to the authentication server; and
receiving, on the native application on the mobile device, the redirection request from the authentication server for the authentication token for the pre-authenticated user in response to the request for the resource hosted on the relying party server.

9. The method according to claim 1 , further comprising:
configuring the native application on the mobile device to authenticate the user for the resources hosted by the relying party server, the resources hosted by the replying party server being on-premises services or cloud services.

10. The method according to claim 1 , wherein the redirection request from the authentication server for the authentication token for the pre-authenticated user is constructed by the authentication server to find the user agent and to obtain the authentication token of the pre-authenticated user.

11. The method according to claim 1 , further comprising:
querying the user agent only when the authentication server detects that the user agent is from a supported mobile user agent.

12. The method according to claim 11 , wherein the supported mobile user agent is one or more of the following:
AppleWebKit, Mobile Safari, or 537.36 Chrome.

13. The method according to claim 1 , wherein the relying party server is a telecommunication service provider (TSP), an application service provider (ASP), a storage service provider (SSP) and/or an internet service provider (ISP).

14. The method according to claim 1 , wherein once the pre-authenticated user has been granted access to the resource hosted on the relying party server no further login is required.

15. A non-transitory computer readable medium storing computer readable program code executed by a processor for accessing a resource hosted on a relying party server from a mobile device, the process comprising:
hosting, on the mobile device, a native application, the mobile device including a user agent for pre-authenticated users;
receiving, on the native application on the mobile device, a redirection request from an authentication server for an authentication token for a pre-authenticated user in response to a request for the resource hosted on the relying party server;
sending, from the user agent on the mobile device, the authentication token for the pre-authenticated user to the authentication server in response to the redirection request form the authentication server;
receiving, on the native application on the mobile device, an authentication cookie for the authenticated user to access the resource on the relying party server, the authentication cookie being received in response to the authentication server authenticating the authentication token received from the user agent of the mobile device;
sending, by the native application on the mobile device, the authentication cookie to the relying party server; and
accessing, by the native application on the mobile device, the resource hosted on the relying party server.

16. The non-transitory computer readable medium according to claim 15 , further comprising:
authenticating the pre-authenticated user on the mobile device via a single sign-on (SSO) method.

17. The non-transitory computer readable medium according to claim 16 , further comprising:
upon authentication of the pre-authenticated user, registering an intent to be called for the pre-authenticated user with an operating system (OS) of the mobile device, the intent to be called configured to respond to the redirection request from the authentication server with the authentication token for the pre-authenticated user from the user agent of the mobile device upon receipt.

18. The non-transitory computer readable medium according to claim 15 , wherein the authentication server is an OpenID Connect (OIDC) provider or a Security Assertion Markup Language (SAML) Identity Provider, and the relying party server is an OIDC Relying Party or a SAML Service Provider; and
the authentication token is a JSON Web Token (JWT).

19. A mobile device having a native application for accessing a resource hosted on a relying party server from the mobile device, the mobile device comprising:
a processor;
a user interface; and
a memory having an operating system, a user agent having authentication tokens

Assignees

• Konica Minolta Laboratory Usa Inc

Inventors

• Suraparaju Rahul

Classifications

• H04L67/563

  Data redirection of data network streams · CPC title

• H04L63/0815 Primary

  providing single-sign-on or federations · CPC title

• G06F21/45

  Structures or tools for the administration of authentication · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/0807 Primary

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title