System and method for proxying federated authentication protocols

Patent metadata

Field	Value
Publication number	US-9491175-B2
Application number	US-201414517078-A
Country	US
Kind code	B2
Filing date	Oct 17, 2014
Priority date	Feb 22, 2013
Publication date	Nov 8, 2016
Grant date	Nov 8, 2016

Abstract

A system and method that include receiving a service provider identity request through a federated authentication protocol; transmitting a proxy identity request to a configured identity provider; receiving an identity assertion; facilitating execution of a second layer of authentication; determining a proxy identity assertion based on the identity assertion and the second layer of authentication; and transmitting the proxy identity assertion to the service provider.

First claim

What is claimed is:

1. A method comprising:
at a proxy server:
responsive to a service provider identity request in accordance with a federated authentication protocol, determining a proxy identity assertion based on execution of a second layer of authentication, and
providing the determined proxy identity assertion to a service provider corresponding to the service provider identity request;

wherein the proxy server determines the proxy identity assertion based on execution of the second layer of authentication and based on an identity assertion obtained from an identity provider;
wherein the identity assertion is received responsive to the proxy server transmitting a proxy identity request to the identity provider;
wherein the service provider identity request is received from the service provider by emulating an identity provider in a first instance of a federated authentication protocol;
wherein the proxy identity request is transmitted by emulating a service provider in a second instance of a federated authentication protocol; and
wherein the identity assertion is received by emulating a service provider in the second instance of a federated authentication protocol.

2. The method of claim 1 , further comprising, in association with a managing account instance, configuring the first instance and the second instance; and prior to transmitting the proxy identity request to the identity provider, selecting the second instance according to an identifier of the managing account from the first instance.

3. The method of claim 1 , wherein the federated authentication protocol of the first instance and the second instance is a security assertion markup language protocol (SAML).

4. The method of claim 1 , wherein the federated authentication protocol of the first instance and the second instance is an OpenID Connect protocol.

5. The method of claim 1 , wherein the first instance is of a first type of protocol; wherein the second instance is of a second type of protocol; and wherein the first type of protocol and second type of protocol are different.

6. The method of claim 5 , further comprising translating attributes between the first type of protocol and the second type of protocol.

7. The method of claim 6 , wherein the second type of protocol is a lightweight directory access protocol (LDAP).

8. The method of claim 6 , wherein translating attributes between the first type of protocol and the second type of protocol comprises translating from attributes of a security assertion markup authentication protocol (SAML) and scopes of an OpenID Connect protocol.

9. The method of claim 1 , wherein the proxy server is installed within an internal network.

10. A method comprising:
at a proxy server:
responsive to a service provider identity request in accordance with a federated authentication protocol, determining a proxy identity assertion based on execution of a second layer of authentication, and
providing the determined proxy identity assertion to a service provider corresponding to the service provider identity request;

wherein determining a proxy identity assertion comprises:
determining whether the second layer of authentication is successful;
responsive to a determination that the second layer is successful, obtaining an identity assertion from an identity provider responsive to transmitting a proxy identity request to the identity provider, and determining the proxy identity assertion based on the obtained identity assertion; and
responsive to a determination that the second layer is not successful, providing the determined proxy identity assertion comprises providing a failed proxy identity assertion to the service provider.

11. A method for single sign-on comprising:
at a proxy server:
responsive to an identity assertion of an identity provider in accordance with a federated authentication protocol, determining a proxy identity assertion based on execution of a second layer of authentication, and
providing the determined proxy identity assertion to a service provider;
wherein the proxy server determines the proxy identity assertion based on execution of the second layer of authentication and based on the identity assertion of the identity provider;
wherein the identity assertion is in accordance with a first instance of a federated authentication protocol, and wherein the proxy identity assertion is provided to the service provider in accordance with a second instance of a federated authentication protocol;
wherein the proxy server provides the determined proxy identity assertion to a service provider by emulating an identity provider in the second instance of a federated authentication protocol.

12. The method of claim 11 , further comprising, in association with a managing account instance, configuring the first instance and the second instance; and prior to providing the determined proxy identity assertion to the service provider, selecting the second instance according to an identifier of the managing account from the first instance.

13. The method of claim 12 , wherein the first instance and second instance are different types of federated authentication protocols, and further comprising translating attributes between the first type of protocol and the second type of protocol.

14. The method of claim 11 , further comprising if the second layer of authentication is unsuccessful, returning an error message to the identity provider.

15. The method of claim 11 , wherein the first instance of a federated authentication protocol is a protocol of claim-based access control authorization of an active directory federation service.

Assignees

• Duo Security Inc

Inventors

• Oberheide Jon
• Song Douglas

Classifications

• H04L63/0884 Primary

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L63/0815

  providing single-sign-on or federations · CPC title