INTEGRATED AUTHENTICATION
Authentication to a network resource of a user associated with a mobile communication device is disclosed. A message is received from a device. The message includes a hardware identifier of the device, and identifies a network resource as the destination of the message. A user identity is associated with the hardware identifier, and is sufficient to obtain session credentials from an authentication resource. Session credentials are obtained from the authentication resource. The session credentials are used to authenticate the associated user identity to the network resource.
1 . A computer-implemented method for authentication to a network resource of a user associated with a mobile communication device, the method comprising:
receiving a message from a mobile communication device,
the message including a hardware identifier of the device, and
the message identifying the network resource as a destination of a first message;
associating a user identity with the hardware identifier, the user identity sufficient to obtain session credentials from an authentication resource;
obtaining session credentials from the authentication resource; and
using the session credentials to authenticate the associated user identity to the network resource.
2 . The computer-implemented method of claim 1 wherein:
the method is performed inside a firewall;
the network resource is inside the firewall; and
the device is outside the firewall.
3 . The computer-implemented method of claim 1 :
wherein the message comprises one of:
an HTTP message, and
an HTTPS message; and
further comprising:
after the receiving the message, and before the obtaining session credentials, proxying the received message to the network resource;
receiving a “401 Unauthorized” status code from the intranet resource in response to the proxied message, the status code indicating an option other than basic authentication.
4 . The computer-implemented method of claim 1 wherein:
the message comprises a file request.
5 . The computer-implemented method of claim 4 wherein:
the file request comprises a Server Message Block (SMB)/Common Internet File System (CIFS) message.
6 . A computer program product for authentication to a network resource of a user associated with a mobile communication device, the computer program product comprising:
a least one computer readable medium; and
at least one program module,
stored on the at least one medium, and
operable, upon execution by at least one processor to:
receive a message from a mobile communication device,
the message including a hardware identifier of the device, and
the message identifying the network resource as a destination of a first message;
associate a user identity with the hardware identifier, the user identity sufficient to obtain session credentials from an authentication resource;
obtain session credentials from the authentication resource; and
use the session credentials to authenticate the associated user identity to the network resource.
7 . The computer program product of claim 6 wherein:
each at least one processor is inside a firewall;
the network resource is inside the firewall; and
the device is outside the firewall.
8 . The computer program product of claim 6 :
wherein the message comprises one of:
an HTTP message, and
an HTTPS message; and
wherein the at least one program module is further operable to:
after the receiving the message, and before the obtaining session credentials, proxy the received message to the network resource;
receive a “401 Unauthorized” status code from the intranet resource in response to the proxied message, the status code indicating an option other than basic authentication.
9 . The computer program product of claim 6 wherein:
the message comprises a file request.
10 . The computer program product of claim 9 wherein:
the file request comprises a Server Message Block (SMB)/Common Internet File System (CIFS) message.
11 . A system for authentication to a network resource of a user associated with a mobile communication device, the system comprising:
at least one processor,
at least one computer readable medium in communication with the processor;
at least one program module,
stored on the at least one medium, and
operable to, upon execution by the at least one processor:
receive a message from a mobile communication device,
the message including a hardware identifier of the device, and the message identifying the network resource as a destination of a first message;
associate a user identity with the hardware identifier, the user identity sufficient to obtain session credentials from an authentication resource;
obtain session credentials from the authentication resource; and
use the session credentials to authenticate the associated user identity to the network resource.
12 . The system of claim 11 wherein:
each at least one processor is inside a firewall;
the network resource is inside the firewall; and
the device is outside the firewall.
13 . The system of claim 11 :
wherein the message comprises one of:
an HTTP message, and
an HTTPS message; and
wherein the at least one program module is further operable to:
after the receiving the message, and before the obtaining session credentials, proxy the received message to the network resource;
receive a “401 Unauthorized” status code from the intranet resource in response to the proxied message, the status code indicating an option other than basic authentication.
14 . The system of claim 11 wherein:
the message comprises a file request.
15 . The system of claim 14 wherein:
the file request comprises a Server Message Block (SMB)/Common Internet File System (CIFS) message.