Single sign on for native and wrapped web resources on mobile devices

Patent metadata

Field	Value
Publication number	US-2016119323-A1
Application number	US-201414520643-A
Country	US
Kind code	A1
Filing date	Oct 22, 2014
Priority date	Oct 22, 2014
Publication date	Apr 28, 2016
Grant date	—

Abstract

A method includes performing operations as follows on a processor: associating a single sign on module with a native application residing on a mobile device, detecting, using the single sign on module, user invocation of the native application, the native application to request access to a resource from a service provider server, determining, using the single sign on module, whether the mobile device has a token stored thereon that indicates the user has been previously authenticated with an identity provider server, sending, using the single sign on module, the token to the identity provider server when the token is determined to be stored on the mobile device, receiving, at the single sign on module, an identity assertion for the user from the identity provider server responsive to sending the token to the identity provider server, and providing, using the single sign on module, the identity assertion to the native application. The service provider server is independent of the identity provider server.

First claim

That which is claimed:

1 . A method, comprising:
performing operations as follows on a processor: associating a single sign on module with a native application residing on a mobile device; detecting, using the single sign on module, user invocation of the native application, the native application to request access to a resource from a service provider server; determining, using the single sign on module, whether the mobile device has a token stored thereon that indicates the user has been previously authenticated with an identity provider server; sending, using the single sign on module, the token to the identity provider server when the token is determined to be stored on the mobile device; receiving, at the single sign on module, an identity assertion for the user from the identity provider server responsive to sending the token to the identity provider server; and providing, using the single sign on module, the identity assertion to the native application; wherein the service provider server is independent of the identity provider server.

2 . The method of claim 1 , further comprising:
sending, using the native application, a request to access the resource to the service provider, the request to access the resource comprising the identity assertion.

3 . The method of claim 2 , further comprising:
wherein the identity assertion comprises a Security Association Markup Language (SAML) identity assertion.

4 . The method of claim 1 , further comprising:
requesting, using the single sign on module, identity credentials from the user when the token is determined not to be stored on the mobile device; receiving, at the single sign on module, the identity credentials from the user; and sending, using the single sign on module, the identity credentials to the identity provider server.

5 . The method of claim 4 , further comprising:
receiving, at the single sign on module, the token from the identity provider server.

6 . The method of claim 4 , wherein the identity credentials comprise a user name and a user password.

7 . The method of claim 4 , wherein the identity credentials comprise multi-factor authentication credentials comprising answers to multiple questions.

8 . The method of claim 1 , wherein the token has an expiration date associated therewith, the token being invalid after the expiration date.

9 . A method, comprising:
performing operations as follows on a processor: associating a single sign on module with a browser residing on a mobile device; detecting, using the single sign on module, user invocation of a Web resource via the browser; sending, using the single sign on module, a token to an identity provider server, the token indicating that the user has been previously authenticated with the identity provider server; receiving, at the single sign on module, an identity assertion for the user from the identity provider server responsive to sending the token to the identity provider server; and providing, using the single sign on module, the identity assertion to the browser; wherein the service provider server is independent of the identity provider server.

10 . The method of claim 1 , further comprising:
sending, using the browser, a request to access the Web resource to a service provider, the request to access the resource comprising the identity assertion.

11 . The method of claim 10 , further comprising:
wherein the identity assertion comprises a Security Association Markup Language (SAML) identity assertion.

12 . The method of claim 9 , further comprising:
determining, using the single sign on module, whether the mobile device has the token stored thereon responsive to user invocation of the browser; requesting, using the single sign on module, identity credentials from the user when the token is determined not to be stored on the mobile device; receiving, at the single sign on module, the identity credentials from the user; and sending, using the single sign on module, the identity credentials to the identity provider server.

13 . The method of claim 12 , further comprising:
receiving, at the single sign on module, the token from the identity provider server.

14 . The method of claim 12 , wherein the identity credentials comprise a user name and a user password.

15 . The method of claim 12 , wherein the identity credentials comprise multi-factor authentication credentials comprising answers to multiple questions.

16 . The method of claim 9 , wherein the token has an expiration date associated therewith, the token being invalid after the expiration date.

17 . A computer program product, comprising:
a tangible computer readable storage medium comprising computer readable program code embodied in the medium that when executed by a processor causes the processor to perform operations comprising: associating a single sign on module with a native application residing on a mobile device; detecting, using the single sign on module, user invocation of the native application, the native application to request access to a resource from a service provider server; determining, using the single sign on module, whether the mobile device has a token stored thereon that indicates the user has been previously authenticated with an identity provider server; sending, using the single sign on module, the token to the identity provider server when the token is determined to be stored on the mobile device; receiving, at the single sign on module, an identity assertion for the user from the identity provider server responsive to sending the token to the identity provider server; and providing, using the single sign on module, the identity assertion to the native application; wherein the service provider server is independent of the identity provider server.

18 . The method of claim 17 , further comprising:
sending, using the native application, a request to access the resource to the service provider, the request to access the resource comprising the identity assertion.

19 . The method of claim 17 , further comprising:
requesting, using the single sign on module, identity credentials from the user when the token is determined not to be stored on the mobile device; receiving, at the single sign on module, the identity credentials from the user; and sending, using the single sign on module, the identity credentials to the identity provider server.

20 . The method of claim 19 , further comprising:
receiving, at the single sign on module, the token from the identity provider server.

Assignees

• Ca Inc

Inventors

• Krishna Vikas

Classifications

• G06F21/41

  where a single sign-on provides access to a plurality of computers · CPC title

• H04L63/0815 Primary

  providing single-sign-on or federations · CPC title