Implementing single sign-on across a heterogeneous collection of client/server and web-based applications
View Patent ↗Leveraging an established authenticated session in obtaining authentication to a client application includes receiving a request for access to a client application requiring authentication of a requestor and determining whether there exist characteristics of leverageable authentications corresponding to established sessions having an authenticated state at a time of the determination. When the determination reveals characteristics of at least one leverageable authentication corresponding to an established session, and attempt is made to obtain access for the requestor to the client application based on the at least one leverageable authentication, and the requestor is provided with a notification related to the 1 attempt to obtain access for the requestor to the client application.
1. A method of leveraging an established authenticated session in obtaining authentication to an application, the method comprising:
receiving, at an application server system, an application token sent, over a network, by an access device as part of a request to establish an authenticated session with the application server system, the application token being specific to the application server system and being generated by a token generating system in response to a request from the access device, the token generating system generating the token by leveraging a persistent authenticated session established between the access device and another application server system, and the token generating system being different from the access device and the application server system;
validating, by the application server system, the application token, the validation being performed by the application server based on the application token and without requiring communication between the application server system and the token generating system after receipt of the application token; and
in response to the application validating the application token, establishing, by the application server system, an authenticated session with the access device.
2. The method of claim 1 wherein:
receiving the application token comprises receiving an application token that includes a checksum of the application token contents; and
validating the application token comprises validating the checksum included in the application token.
3. The method of claim 1 wherein:
receiving the application token comprises receiving an application token that is encrypted with a secret key; and
validating the application token comprises decrypting the application token using the secret key.
4. The method of claim 1 wherein receiving the application token comprises receiving an application token transmitted from the access device to the application server system using a browser client.
5. The method of claim 4 wherein receiving the application token transmitted from the access device to the application server system using a browser client comprises receiving an application token passed as query data on a uniform resource locator of the application server system returned to the access device from the token generating system in the form of a hypertext transfer protocol redirect in response to an image request.
6. The method of claim 1 wherein:
receiving the application token comprises receiving an application token that includes a timestamp that indicates when the token was generated; and
validating the application token comprises determining whether the application token is older than a configurable maximum age based on the timestamp and rejecting the application token in response to a determination that the application token is older than the configurable maximum age.
7. The method of claim 1 wherein:
receiving the application token comprises receiving an application token that includes a random number; and
validating the application token comprises validating that the random number included in the application token matches a random number included in an encrypted cookie that is only readable and writable by the application server system on a browser of the access device.
8. The method of claim 1 wherein the request to establish the authenticated session with the application server system is a request from a browser program of the access device and the token generating system generated the token by leveraging a persistent authenticated session established by a non-browser program of the access device.
9. The method of claim 1 wherein the request to establish the authenticated session with the application server system is a request from a non-browser program of the access device and the token generating system generated the token by leveraging a persistent authenticated session established by a browser program of the access device.
10. The method of claim 1 wherein the application token was generated by the token generating system in response to receiving a master token from the access device, the master token having been generated by the token generating system in response to the access device providing valid login credentials to the token generating system and having been stored on the access device.
11. A computer program product on a non-transitory computer storage medium comprising instruction operable for an application server system configured to perform operations comprising:
receiving an application token sent, over a network, by an access device as part of a request to establish an authenticated session with the application server system, the application token being specific to the application server system and being generated by a token generating system in response to a request from the access device, the token generating system generating the token by leveraging a persistent authenticated session established between the access device and another application server system, and the token generating system being different from the access device and the application server system;
validating the application token, the validation being performed by the application server based on the application token and without requiring communication between the application server system and the token generating system after receipt of the application token; and
in response to the application validating the application token, establishing an authenticated session with the access device.
12. The computer program product of claim 11 wherein:
receiving the application token comprises receiving an application token that includes a checksum of the application token contents; and
validating the application token comprises validating the checksum included in the application token.
13. The computer program product of claim 11 wherein:
receiving the application token comprises receiving an application token that is encrypted with a secret key; and
validating the application token comprises decrypting the application token using the secret key.
14. The computer program product of claim 11 wherein receiving the application token comprises receiving an application token transmitted from the access device to the application server system using a browser client.
15. The computer program product of claim 14 wherein receiving the application token transmitted from the access device to the application server system using a browser client comprises receiving an application token passed as query data on a uniform resource locator of the application server system returned to the access device from the token generating system in the form of a hypertext transfer protocol redirect in response to an image request.
16. The computer program product of claim 11 wherein:
receiving the application token comprises receiving an application token that includes a timestamp that indicates when the token was generated; and
validating the application token comprises determining whether the application token is older than a configurable maximum age based on the timestamp and rejecting the application token in response to a determination that the application token is older than the configurable maximum age.
17. The computer program product of claim 11 wherein:
receiving the application token comprises receiving an application token that includes a random number; and
validating the application token comprises validating that the random number included in the application token matches a random number included in an encrypted cookie that is only readable and writable by the application server system on a browser of the access device.
18. The computer program product of claim 11 wherein the request to establish the authenticated session with the application server system is a request from a browser program of the access device and the token generating system generated the token by leveraging a persistent authenticated session established by a non-browser program of the access device.
19. The computer program product of claim 11 wherein the request to establish the authenticated session with the application server system is a request from a non-browser program of the access device and the token generating system generated the token by leveraging a persistent authenticated session established by a browser program of the access device.
20. A system comprising:
means for receiving an application token sent, over a network, by an access device as part of a request to establish an authenticated session with an application server system, the application token being specific to the application server system and being generated by a token generating system in response to a request from the access device, the token generating system generating the token by leveraging a persistent authenticated session established between the access device and another application server system, and the token generating system being different from the access device and the application server system;
means for validating the application token, the validation being performed by the application server based on the application token and without requiring communication between the application server system and the token generating system after receipt of the application token; and
means for, in response to the application validating the application token, establishing an authenticated session with the access device.