Authentication using an intermediary
Technology related to authentication using an intermediary is disclosed. In one example, a method for authentication can include intercepting a first authentication response destined for a server. The first authentication response identifies a server authentication service and is digitally signed by an identity service provider. The first authentication response can be authenticated using a cryptographic key of the identity service provider to validate an identity service provider signature included in the first authentication response. In response to validating the identity service provider signature, a second authentication response can be sent to the server that identifies the server authentication service.
1 . A method for authentication implemented in cooperation with a network traffic management system comprising one or more network traffic management modules, service provider modules, identity provider modules, server modules or client modules, the method comprising:
intercepting, using a proxy server, a first authentication response destined for a server, wherein the first authentication response identifies a server authentication service of the server and is digitally signed by an identity service provider with an encrypted identity service provider signature included in the first authentication response, wherein the proxy server has a network address that matches a public network address of the server;
authenticating, using the proxy server, the first authentication response using a cryptographic key of the identity service provider to validate the encrypted identity service provider signature included in the first authentication response; and
in response to validating the encrypted identity service provider signature, sending a second authentication response from the proxy server to the server, wherein the second authentication response identifies the server authentication service of the server and comprises the encrypted identity service provider signature included in the first authentication response.
2 . The method of claim 1 , wherein the first authentication response is digitally signed by the identity service provider using a private key of a public-private key-pair, and the cryptographic key used to validate the identity service provider is a public key of the public-private key-pair.
3 . The method of claim 1 , wherein the first authentication response is authenticated on behalf of the server by emulating the server authentication service on a module of the network traffic management system that is different than the server.
4 . The method of claim 1 , wherein the first authentication response comprises a response payload generated by the identity service provider and authenticated using the identity service provider signature, the response payload comprising a uniform resource identifier for the server authentication service, and the second authentication response comprises the response payload and the identity service provider signature.
5 . The method of claim 1 , wherein intercepting the first authentication response destined for the server comprises receiving by the proxy server, on behalf of the server, the first authentication response that is addressed to a public network address of the server, and wherein sending the second authentication response to the server comprises translating the public network address of the server to a private network address of the server and sending the second authentication response to the private network address of the server.
6 . An authentication system comprising one or more network traffic management modules, server modules, or client modules, memory comprising programmed instructions stored thereon, and one or more processors configured to be capable of executing the stored programmed instructions to:
intercept, using a proxy server, a first authentication response destined for a server, wherein the first authentication response identifies a server authentication service of the server and is digitally signed by an identity service provider with an encrypted identity service provider signature included in the first authentication response, wherein the proxy server has a network address that matches a public network address of the server;
authenticate, using the proxy server, the first authentication response using a cryptographic key of the identity service provider to validate the encrypted identity service provider signature included in the first authentication response; and
in response to validating the encrypted identity service provider signature, send a second authentication response from the proxy server to the server, wherein the second authentication response identifies the server authentication service of the server and comprises the encrypted identity service provider signature included in the first authentication response.
7 . The authentication system of claim 6 , wherein the first authentication response and the second authentication response comply with a Security Assertion Markup Language protocol.
8 . The authentication system of claim 6 , wherein the processors are further configured to be capable of executing the stored programmed instructions to:
parse the first authentication response to obtain an attribute associated with a client device or a user of the client device that is identified in the first authentication response; and
use the obtained attribute to make an access control decision before sending the second authentication response to the server that identifies the server authentication service.
9 . The authentication system of claim 6 , wherein the processors are further configured to be capable of executing the stored programmed instructions to:
parse the first authentication response to obtain an attribute associated with a client device or a user of the client device that is identified in the first authentication response; and
use the obtained attribute to send data about the client device or the user of the client device each time the client device accesses the server computer.
10 . The authentication system of claim 6 , wherein the first authentication response comprises a method indicating that the first authentication response was requested by the server authentication service, and the second authentication response comprises a method indicating that the second authentication response was initiated by the identity service provider.
11 . A non-transitory computer readable medium having stored thereon instructions for authentication comprising executable code that, when executed by one or more processors, causes the processors to:
intercept, using a proxy server, a first authentication response destined for a server, wherein the first authentication response identifies a server authentication service of the server and is digitally signed by an identity service provider with an encrypted identity service provider signature included in the first authentication response, wherein the proxy server has a network address that matches a public network address of the server;
authenticate, using the proxy server, the first authentication response using a cryptographic key of the identity service provider to validate the encrypted identity service provider signature included in the first authentication response; and
in response to validating the encrypted identity service provider signature, send a second authentication response from the proxy server to the server, wherein the second authentication response identifies the server authentication service of the server and comprises the encrypted identity service provider signature included in the first authentication response.
12 . The non-transitory computer readable medium of claim 11 , wherein the first authentication response and the second authentication response comply with a Security Assertion Markup Language protocol.
13 . The non-transitory computer readable medium of claim 11 , wherein the first authentication response is authenticated on behalf of the server by emulating the server authentication service using the one or more processors.
14 . The non-transitory computer readable medium of claim 11 , further comprising instructions that, when executed by the one or more processors, causes the processors to:
parse the first authentication response to obtain an attribute associated with a client device or a user of the client device that is identified in the first authentication response; and
use the obtained attribute to make an access control decision before sending the second authentication response to the server that identifies the server authentication service.
15 . A network traffic management apparatus, comprising memory comprising programmed instructions stored thereon and one or more processors configured to be capable of executing the stored programmed instructions to:
intercept, using a proxy server, a first authentication response destined for a server, wherein the first authentication response identifies a server authentication service of the server and is digitally signed by an identity service provider with an encrypted identity service provider signature included in the first authentication response, wherein the proxy server has a network address that matches a public network address of the server;
authenticate, using the proxy server, the first authentication response using a cryptographic key of the identity service provider to validate the encrypted identity service provider signature included in the first authentication response; and
in response to validating the encrypted identity service provider signature, send a second authentication response from the proxy server to the server, wherein the second authentication response identifies the server authentication service of the server and comprises the encrypted identity service provider signature included in the first authentication response.
16 . The network traffic management apparatus of claim 15 , wherein the first authentication response and the second authentication response comply with a Security Assertion Markup Language protocol.
17 . The network traffic management apparatus of claim 15 , wherein the first authentication response is authenticated on behalf of the server by emulating the server authentication service using the one or more processors.
18 . The network traffic management apparatus of claim 15 , wherein the processors are further configured to be capable of executing the stored programmed instructions to:
parse the first authentication response to obtain an attribute associated with a client device or a user of the client device that is identified in the first authentication response; and
use the obtained attribute to make an access control decision before sending the second authentication response to the server that identifies the server authentication service.
19 . The network traffic management apparatus of claim 15 , wherein the processors are further configured to be capable of executing the stored programmed instructions to:
parse the first authentication response to obtain an attribute associated with a client device or a user of the client device that is identified in the first authentication response; and
use the obtained attribute to send data about the client device or the user of the client device each time the client device accesses the server.
20 . The network traffic management apparatus of claim 15 , wherein the first authentication response comprises a method indicating that the first authentication response was requested by the server authentication service, and the second authentication response comprises a method indicating that the second authentication response was initiated by the identity service provider.
21 . The network traffic management apparatus of claim 15 , wherein the processors are further configured to be capable of executing the stored programmed instructions to:
intercept a request destined for the server;
determine that the request is not an authentication response and that an entity associated with the intercepted request is not authenticated; and
send an authentication request addressed to the identity service provider, the authentication request formatted to masquerade as an authentication request from the server.