Single sign on with multiple authentication factors
View Patent ↗The authentication of a client to multiple server resources with a single sign-on procedure using multiple factors is disclosed. One contemplated embodiment is a method in which a login session is initiated with the authentication system of a primary one of the multiple server resources. A first set of login credentials is transmitted thereto, and validated. A token is stored on the client indicating that the initial authentication was successful, which is then used to transition to a secondary one of the multiple resources. A second set of login credentials is also transmitted, and access to the secondary one of the multiple resources is granted on the basis of a validated token and second set of login credentials.
1. A method for authenticating a client computer system to multiple server resources each with a standalone authentication system, the method comprising:
enrolling to receive a digital certificate, the digital certificate being associated with the client computer system and a user identity in a centralized directory;
storing the digital certificate on the client computer system;
initiating a web login session with the authentication system of a first server resource of the multiple server resources;
transmitting a first set of login credentials from the client computer system to the authentication system of the first server resource of the multiple server resources;
validating the client computer system to the first server resource of the multiple server resources based upon the first set of login credentials;
in response to successful validation of the client computer system to the first server resource of the multiple server resources, receiving a token from the authentication system of the first server resource of the multiple resources, the token associated with an account identifier referencing the user identity in the centralized directory, the token indicating that the first set of login credentials is associated with the user identity;
storing the token on the client computer system;
accessing server resources associated with the first server resource of the multiple server resources;
transmitting the token and a second set of login credentials comprising the digital certificate, wherein the digital certificate is different from the first set of login credentials, to a second server resource of the multiple server resources, the second set of login credentials being stored on the client computer system prior to transmission of the first set of login credentials to the authentication system of the first server resource of the multiple server resources;
validating the client computer system to the authentication system of the second server resource of the multiple server resources based upon the transmitted token and the second set of login credentials; and
in response to successful validation of the client computer system to the authentication system of the second server resource of the multiple server resources, accessing a sub resource associated with the second server resource of the multiple server resources.
2. The method of claim 1 , wherein the token is selected from a group consisting of: a browser cookie, a stay resident variable, and an application flag.
3. The method of claim 1 , wherein the token includes an account identifier associated with a user account on the first server resource and the second server resource of the multiple server resources.
4. The method of claim 1 , wherein the second set of login credentials is an X.509 digital certificate.
5. The method of claim 4 , wherein the X.509 digital certificate is stored in a client application.
6. The method of claim 4 , wherein the X.509 digital certificate is stored on an external hardware device readable by the client.
7. The method of claim 4 , wherein the X.509 digital certificate is associated with a complementary client application of the authentication system of the second server resource of the multiple server resources.
8. The method of claim 4 , wherein the X.509 digital certificate is associated with a client application independent of the authentication system of the second server resource of the multiple server resources.
9. The method of claim 1 , further comprising:
transmitting the second set of login credentials from the client computer system to the authentication system of the first server resource of the multiple server resources;
wherein the step of validating the client to the first server resource of the multiple server resources is further based upon the second set of login credentials.
10. A method for authenticating a client computer system to multiple server resources each with a standalone authentication system, comprising;
receiving an enrollment request from the client computer system for a digital certificate, the digital certificate being associated with the client computer system and a user identity in a centralized directory;
sending the digital certificate to the client computer system;
receiving a first set of login credentials sent from the client computer system to the authentication system of a first server resource of the multiple server resources;
validating the client computer system to the first server resource of the multiple server resources based upon the first set of login credentials;
transmitting to the client computer system a token generated by the authentication system of the first server resource of the multiple resources in response to a successful validation of the first set of login credentials;
receiving on a second server resource of the multiple server resources the token and a second set of login credentials different from the first set of login credentials, the second set of login credentials being received from the client computer system, the second set of login credentials comprising the digital certificate; and
validating the client computer system to the authentication system of the second server resource of the multiple server resources based upon the received token and the second set of login credentials, and allowing access to the second server resource in response to successfully validating the client computer system.
11. The method of claim 10 , wherein the token is selected from a group consisting of: a browser cookie, a stay resident variable, and an application flag.
12. The method of claim 10 , wherein the token includes an account identifier associated with a user account on the first server resource and the second server resource of the multiple server resources.
13. The method of claim 10 , wherein the second set of login credentials is an X.509 digital certificate.
14. The method of claim 13 , wherein the X.509 digital certificate is stored on the client computer system.
15. The method of claim 13 , wherein the X.509 digital certificate is stored on an external hardware device readable by the client computer system.
16. The method of claim 13 , wherein the X.509 digital certificate is associated with a complementary client application of the authentication system of the second server resource of the multiple server resources.
17. The method of claim 13 , wherein the X.509 digital certificate is associated with a client application independent of the authentication system of the second server resource of the multiple server resources.
18. The method of claim 10 , further comprising:
receiving the second set of login credentials on the primary one of the multiple server resources;
wherein:
the step of validating the client computer system to the first server resource of the multiple server resources is further based upon the second set of login credentials; and
the step of transmitting the token is in response to a successful validation of the second set of login credentials.
19. An article of manufacture comprising a non-transitory storage medium readable by a computer, the medium tangibly embodying one or more programs of instructions executable by the computer to perform a method for authenticating a client to multiple server resources each with a standalone authentication system, the method comprising:
receiving an enrollment request from the client for a digital certificate, the digital certificate being associated with the client and a user identity in a centralized directory;
receiving a first set of login credentials sent from the client to the authentication system of a first server resource of the multiple server resources;
validating the client to the first server resource of the multiple server resources based upon the first set of login credentials;
transmitting to the client a token generated by the authentication system of the first server resource of the multiple server resources;
receiving on a second server resource of the multiple server resources the token and a second set of login credentials different from the first set of login credentials, the second set of login credentials being received from the client, the second set of login credentials comprising the digital certificate;
validating the client to the authentication system of the second server resource of the multiple server resources based upon the received token and the second set of login credentials; and
in response to successful validation of the client to the authentication system of the second server resource of the multiple server resources, allowing access to at least one sub-resource associated with the second server resource of the multiple server resources.