Tunneling session detection to provide single-sign on (SSO) functionality for a VPN gateway
View Patent ↗A VPN gateway is described that provides single sign-on (SSO) functionality with respect to remote users who have established tunneling sessions with the VPN gateway and who attempt to access a protected resource. The VPN gateway may receive, from a client device, a security assertion request that includes a request for a security assertion to be made by the VPN gateway with respect to a user of a private network associated with the VPN gateway, determine whether the security assertion request was received via a tunneling session established for the user between the client device and the VPN gateway, and issue a security assertion for the user in response to determining that the security assertion request was received via the tunneling session. In this way, a VPN gateway may act as an SSO identity provider for users that have an established tunneling session with the gateway.
1. A method comprising:
presenting a user interface configured to receive user input specifying whether tunneling session detection should be used to provide security assertions without requiring a user to re-authenticate with a VPN gateway device;
establishing, with the VPN gateway device, a tunneling session for a user of a private network associated with the VPN gateway device, the tunneling session being established between a client device and the VPN gateway device;
receiving, with the VPN gateway device, a security assertion request from the client device, the security assertion request including a request for a security assertion to be made by the VPN gateway device with respect to the user of the private network associated with the VPN gateway device;
determining, with the VPN gateway device, whether the security assertion request was received via the tunneling session established for the user between the client device and the VPN gateway device; and
issuing, with the VPN gateway device, a security assertion for the user in response to determining that the security assertion request was received via the tunneling session.
2. The method of claim 1 , wherein issuing the security assertion for the user comprises issuing the security assertion for the user without requiring the user to re-authenticate with the VPN gateway device.
3. The method of claim 1 , wherein determining whether the security assertion request was received via the tunneling session comprises:
determining whether the security assertion request was received via the tunneling session based on a source internet protocol (IP) address specified in the security assertion request.
4. The method of claim 1 , wherein determining whether the security assertion request was received via the tunneling session comprises:
determining whether the security assertion request was received via the tunneling session based on whether a source internet protocol (IP) address specified in the security assertion request is a private IP address associated with a private network to which access is controlled by the VPN gateway device.
5. The method of claim 4 , wherein determining whether the security assertion request was received via the tunneling session based on whether the source IP address is a private IP address comprises:
determining whether the source IP address is a private IP address associated with a private network to which access is controlled by the VPN gateway device; and
determining that the security assertion request was received via the tunneling session in response to determining that the source IP address is a private IP address associated with the private network.
6. The method of claim 4 , wherein determining whether the security assertion request was received via the tunneling session based on whether the source IP address is a private IP address comprises:
determining whether the source IP address is a private IP address associated with a private network to which access is controlled by the VPN gateway device;
determining whether the private IP address is associated with a valid tunneling session for the user specified in the security assertion request; and
determining that the security assertion request was received via the tunneling session in response to determining that the source IP address is a private IP address associated with the private network and that the private IP address is associated with a valid tunneling session for the user.
7. The method of claim 1 , further comprising:
causing the client device to send security assertion requests to the VPN gateway device via the tunneling session.
8. The method of claim 7 , wherein causing the client device to send security assertion requests to the VPN gateway device via the tunneling session comprises:
causing a hostname for receiving security assertion requests at the VPN gateway device to be resolved by the client device to a private IP address associated with the VPN gateway device upon establishment of the tunneling session between the client device and the VPN gateway device.
9. The method of claim 8 , wherein prior to establishment of the tunneling session, a name resolver in the client device is configured to query a first name server that associates the hostname for receiving security assertions requests with a public IP address associated with the VPN gateway device, and wherein causing the hostname for receiving security assertion requests at the VPN gateway device to be resolved by the client device to a private IP address comprises:
configuring the name resolver in the client device to query a second name server different than the first name server upon establishment of the tunneling session between the client device and the VPN gateway device, the second name server associating the hostname for receiving security assertion requests with the private IP address associated with the VPN gateway device.
10. The method of claim 8 , wherein causing the hostname for receiving security assertion requests at the VPN gateway device to be resolved by the client device to a private IP address comprises:
placing an entry in a host table of the client device upon establishment of the tunneling session between the client device and the VPN gateway device, the entry associating the hostname for receiving security assertion requests with the private IP address associated with the VPN gateway device.
11. The method of claim 1 , wherein the client device includes a VPN handler that is configured to send the security assertion request to the VPN gateway device via the tunneling session when the tunneling session is established.
12. A method for issuing security assertions with a VPN gateway device that is associated with a first hostname, the method comprising:
presenting a user interface configured to receive user input specifying a second hostname for receiving security assertion requests at the VPN gateway device, the second hostname being different than the first hostnames;
establishing, with the VPN gateway device, a tunneling session for a user of a private network associated with the VPN gateway device, the tunneling session being established between a client device and the VPN gateway device;
receiving, with the VPN gateway device, a security assertion request from the client device, the security assertion request including a request for a security assertion to be made by the VPN gateway device with respect to the user of the private network associated with the VPN gateway device;
determining, with the VPN gateway device, whether the security assertion request was received via the tunneling session established for the user between the client device and the VPN gateway device; and
issuing, with the VPN gateway device, a security assertion for the user in response to determining that the security assertion request was received via the tunneling session.
13. The method of claim 1 , wherein the VPN gateway device is associated with a first hostname, and wherein the method further comprises:
presenting a user interface configured to receive user input specifying a second hostname for receiving security assertion requests at the VPN gateway device, the second hostname being different than the first hostname.
14. The method of claim 1 , wherein the VPN gateway device is a secure sockets layer (SSL) VPN gateway device configured to establish an SSL tunneling session.
15. The method of claim 1 , wherein the VPN gateway device is an Internet Protocol Security (IPSec) VPN gateway device configured to establish an IPSec tunneling session.
16. A virtual private network (VPN) gateway device comprising:
one or more processors configured to:
present a user interface configured to receive user input specifying whether tunneling session detection should be used to provide security assertions without requiring a user to re-authenticate with a VPN gateway device;
establish a tunneling session for a user of a private network associated with the VPN gateway device, the tunneling session being established between a client device and the VPN gateway device,
receive, from the client device, a security assertion request that includes a request for a security assertion to be made by the VPN gateway device with respect to the user of the private network associated with the VPN gateway device,
determine whether the security assertion request was received via the tunneling session established for the user between the client device and the VPN gateway device, and
issue a security assertion for the user in response to determining that the security assertion request was received via the tunneling session.
17. The device of claim 16 , wherein the security assertion module is further configured to issue the security assertion for the user without requiring the user to re-authenticate with the VPN gateway device.
18. The device of claim 16 , wherein the security assertion module is further configured to determine whether the security assertion request was received via the tunneling session based on a source internet protocol (IP) address specified in the security assertion request.
19. The device of claim 16 , wherein the security assertion module is further configured to determine whether the security assertion request was received via the tunneling session based on whether a source internet protocol (IP) address specified in the security assertion request is a private IP address associated with a private network to which access is controlled by the VPN gateway device.
20. The device of claim 19 , wherein the security assertion module is further configured to determine whether the source IP address is a private IP address associated with a private network to which access is controlled by the VPN gateway device, and determine that the security assertion request was received via the tunneling session in response to determining that the source IP address is a private IP address associated with the private network.
21. The device of claim 19 , wherein the security assertion module is further configured to determine whether the source IP address is a private IP address associated with a private network to which access is controlled by the VPN gateway device, determine whether the private IP address is associated with a valid tunneling session for the user specified in the security assertion request, and determine that the security assertion request was received via the tunneling session in response to determining that the source IP address is a private IP address associated with the private network and that the private IP address is associated with a valid tunneling session for the user.
22. The device of claim 16 , wherein the VPN gateway device further comprises:
a tunnel management module configured to cause the client device to send security assertion requests to the VPN gateway device via the tunneling session.
23. The device of claim 22 , wherein the tunnel management module is further configured to cause a hostname for receiving security assertion requests at the VPN gateway device to be resolved by the client device to a private IP address associated with the VPN gateway device upon establishment of the tunneling session between the client device and the VPN gateway device.
24. The device of claim 23 , wherein prior to establishment of the tunneling session, a name resolver in the client device is configured to query a first name server that associates the hostname for receiving security assertions requests with a public IP address associated with the VPN gateway device, and wherein the tunnel management module is further configured to configure the name resolver in the client device to query a second name server different than the first name server upon establishment of the tunneling session between the client device and the VPN gateway device, the second name server associating the hostname for receiving security assertion requests with the private IP address associated with the VPN gateway device.
25. The device of claim 23 , wherein the tunnel management module is further configured to place an entry in a host table of the client device upon establishment of the tunneling session between the client device and the VPN gateway device, the entry associating the hostname for receiving security assertion requests with the private IP address associated with the VPN gateway device.
26. The device of claim 16 , wherein the client device includes a VPN handler that is configured to send the security assertion request to the VPN gateway device via the tunneling session when the tunneling session is established.
27. The device of claim 16 , wherein the VPN gateway device is associated with a first hostname, and wherein the VPN gateway device is configured to present a user interface configured to receive user input specifying a second hostname for receiving security assertion requests at the VPN gateway device, the second hostname being different than the first hostname.
28. The device of claim 16 , wherein the VPN gateway device is a secure sockets layer (SSL) VPN gateway device configured to establish an SSL tunneling session.
29. The device of claim 16 , wherein the VPN gateway device is an Internet Protocol Security (IPSec) VPN gateway device configured to establish an IPSec tunneling session.
30. The method of claim 1 , further comprising:
authenticating, with the VPN gateway device, the user in response to determining that the security assertion request was not received via the tunneling session.
31. The device of claim 16 , wherein the VPN gateway device is further configured to authenticate the user in response to determining that the security assertion request was not received via the tunneling session.