Single sign on with multiple authentication factors
View Patent ↗The authentication of a client to multiple server resources with a single sign-on procedure using multiple factors is disclosed. One contemplated embodiment is a method in which a login session is initiated with the authentication system of a primary one of the multiple server resources. A first set of login credentials is transmitted thereto, and validated. A token is stored on the client indicating that the initial authentication was successful, which is then used to transition to a secondary one of the multiple resources. A second set of login credentials is also transmitted, and access to the secondary one of the multiple resources is granted on the basis of a validated token and second set of login credentials.
1. A method for authenticating a client to multiple server resources each with a standalone authentication system, the method comprising:
initiating a login session with a first standalone authentication system of a primary one of the multiple server resources;
transmitting a first set of login credentials from the client to the first standalone authentication system of the primary one of the multiple server resources;
validating the client by the first standalone authentication system of the primary one of the multiple server resources based upon the first set of login credentials;
storing on the client a token received from the first standalone authentication system of the primary one of the multiple resources, the token being generated by the first standalone authentication system;
transmitting the token and a second set of login credentials different from the first set of login credentials to a secondary one of the multiple server resources, the second set of login credentials being retrieved from the client, wherein the second set of login credentials is transmitted outside of the token and exists on the client prior to the client transmitting the first set of login credentials to the first standalone authentication system; and
validating the client by a second standalone authentication system of the secondary one of the multiple server resources based upon the transmitted token and the second set of login credentials.
2. The method of claim 1 , wherein the token and the second set of login credentials are transmitted in separate transmissions.
3. The method of claim 1 , wherein the token includes an account identifier associated with a user account on the primary one and the secondary one of the multiple server resources.
4. The method of claim 1 , wherein the second set of login credentials is a digital certificate.
5. The method of claim 4 , wherein the digital certificate is stored on the client.
6. The method of claim 4 , wherein the digital certificate is stored on an external hardware device readable by the client.
7. The method of claim 4 , wherein the digital certificate is associated with a complementary client application of the second standalone authentication system of the secondary one of the multiple server resources.
8. The method of claim 4 , wherein the digital certificate is associated with a client application independent of the second standalone authentication system of the secondary one of the multiple server resources.
9. The method of claim 1 , further comprising:
transmitting the second set of login credentials from the client to the first standalone authentication system of the primary one of the multiple server resources;
wherein validating the client to the primary one of the multiple server resources is further based upon the second set of login credentials.
10. A method for authenticating a client to multiple server resources each with a standalone authentication system, comprising;
receiving a first set of login credentials from the client to a first standalone authentication system of a primary one of the multiple server resources;
validating the client to the primary one of the multiple server resources based upon the first set of login credentials;
transmitting to the client a token generated by the first standalone authentication system of the primary one of the multiple resources in response to a successful validation of the first set of login credentials, the token being generated by the first standalone authentication system;
receiving on a secondary one of the multiple server resources the token and a second set of login credentials different from the first set of login credentials, the second set of login credentials being retrieved from the client, wherein the second set of login credentials is transmitted outside of the token and exists on the client prior to the client transmitting the first set of login credentials to the first standalone authentication system; and
validating the client by a second standalone authentication system of the secondary one of the multiple server resources based upon the received token and the second set of login credentials.
11. The method of claim 10 , wherein the token and the second set of login credentials are received by the secondary one of the multiple server resources through separate transmissions.
12. The method of claim 10 , wherein the token includes an account identifier associated with a user account on the primary one and the secondary one of the multiple server resources.
13. The method of claim 10 , wherein the second set of login credentials is a digital certificate.
14. The method of claim 13 , wherein the digital certificate is stored on the client.
15. The method of claim 13 , wherein the digital certificate is stored on an external hardware device readable by the client.
16. The method of claim 13 , wherein the digital certificate is associated with a complementary client application of the second standalone authentication system of the secondary one of the multiple server resources.
17. The method of claim 13 , wherein the digital certificate is associated with a client application independent of the second standalone authentication system of the secondary one of the multiple server resources.
18. The method of claim 10 , further comprising:
receiving the second set of login credentials on the primary one of the multiple server resources;
wherein:
validating the client to the primary one of the multiple server resources is further based upon the second set of login credentials; and
transmitting the token is in response to a successful validation of the second set of login credentials.
19. An article of manufacture comprising a non-transitory program storage medium readable by a computer, the non-transitory program storage medium tangibly embodying one or more programs of instructions executable by the computer to perform a method for authenticating a client to multiple server resources each with a standalone authentication system, the method comprising;
receiving a first set of login credentials from the client to a first standalone authentication system of a primary one of the multiple server resources;
validating the client to the primary one of the multiple server resources based upon the first set of login credentials;
transmitting to the client a token generated by the first standalone authentication system of the primary one of the multiple resources;
receiving on a secondary one of the multiple server resources the token and a second set of login credentials different from the first set of login credentials, the second set of login credentials being retrieved from the client, wherein the second set of login credentials is transmitted outside of the token and exists on the client prior to the client transmitting the first set of login credentials to the first standalone authentication system; and
validating the client by a second standalone authentication system of the secondary one of the multiple server resources based upon the received token and the second set of login credentials.
20. The article of manufacture of claim 19 , wherein the token and the second set of login credentials are received by the secondary one of the multiple server resources through separate transmissions.