Systems and methods for authentication brokering
In some aspects, the techniques described herein relate to a method including: sending, by a token software development kit and to a credential broker, a request, wherein the request includes a unique identifier of a client application; receiving, at the token software development kit and from the credential broker; a response, wherein the response includes a service ticket; instantiating a token object in a memory space of the client application, wherein the token object includes the service ticket as a first attribute of the token object; instantiating a context object in the memory space of the client application, wherein the context object includes the token object as an attribute of the context object; providing the context object to the client application; and authenticating, by the client application to a service, using the context object.
1 . A method comprising:
sending, by a token software development kit included in a client application and to a credential broker, a request for a service ticket comprising a unique identifier for the client application, wherein the credential broker is configured to query an application attestation datastore for network services that the client application is authorized to make service requests to using the unique identifier of the client application as a lookup key, to receive, as a result of the querying and from the application attestation datastore, a service identifier for one of the network services; to receive a ticket granting ticket from a key distribution center, wherein the ticket granting ticket is encrypted and corresponds to the service identifier, to request the service ticket that facilitates authentication with a network service from the key distribution center based on the ticket granting ticket received, and to receive the service ticket from the key distribution center;
receiving, at the token software development kit and from the credential broker, a response, wherein the response comprising the service ticket;
instantiating, by the token software development kit, a token object in a memory space of the client application, wherein the token object includes the service ticket as a first attribute of the token object;
instantiating, by the token software development kit, a context object in the memory space of the client application, wherein the context object includes the token object as an attribute of the context object;
providing, by the token software development kit, the context object to the client application;
authenticating, by the client application to the network service, using the context object.
2 . The method of claim 1 , wherein the service ticket is a binary representation of the service ticket received from the credential broker.
3 . The method of claim 2 , wherein the binary representation is a bit array.
4 . The method of claim 1 , wherein the service ticket is instantiated as an object in the memory space of the client application.
5 . The method of claim 4 , comprising:
instantiating a user principal object in the memory space of the client application, wherein the token object includes the user principal object as a second attribute of the token object.
6 . The method of claim 5 , wherein the token software development kit comprises a Token class, a ServiceTicket class, and a UserPrincipal class, and the ServiceTicket class and the UserPrincipal class are component classes of the Token class.
7 . The method of claim 6 , wherein the service ticket is instantiated as an object of the ServiceTicket class, the user principal object is instantiated as an object of the UserPrincipal class, and the token object is instantiated as an object of the Token class.