System and method for transferring device identifying information

1. A system for assessing compliance of a client device while authenticating a user account comprising:

a data store comprising executable instructions; and

at least one computing device comprising at least one processor, wherein the instructions, when executed by the at least one processor, cause the at least one computing device to at least:

transmit, to the client device, instructions for certificate verification, the instructions comprising a command to transmit a certificate to a key distribution center, the certificate comprising a unique device identifier for the client device, wherein the unique device identifier is assigned by a management service during an enrollment of the client device;

receive, from the client device, a ticket obtained from the key distribution center, wherein the unique device identifier is embedded in the ticket by the key distribution center based on verification that the certificate is valid;

extract the unique device identifier from the ticket;

determine that credentials received from the client device authenticate against the user account;

transmit, to the management service, a request to verify compliance of the client device with at least one compliance rule, wherein the request comprises the unique device identifier; and

authenticate the user account for access through the client device.

2. The system of claim 1 , wherein the instructions, when executed by the at least one processor, further cause the at least one computing device to at least:

cache the unique device identifier and session data in the data store associated with the user account, the session data comprising a compliance status indicating that the client device complies with at least one compliance rule;

periodically poll a management service to determine an updated compliance status indicating that the client device still complies with the at least one compliance rule; and

update the session data based at least in part on the updated status and the unique device identifier.

3. The system of claim 2 , wherein the instructions, when executed by the at least one processor, further cause the at least one computing device to at least:

receive a single sign-on request including a username of the user account from a service provider;

obtain the session data associated with the user account from the data store;

generate a single sign-on token including a current compliance status from the session data that specifies that the client device complies with the at least one compliance rule, the current compliance status being stored in at least one of: a security assertion markup language (SAML) attribute field of the single sign-on token, an OAuth2 token attribute, or an OpenID Connect token attribute; and

transmit the single sign-on token to the service provider.

4. The system of claim 1 , wherein the instructions comprise:

a key distribution add-on module is configured to send the command to transmit the certificate to the key distribution center;

a device compliance add-on module is configured to determine that the client device complies with the at least one compliance rule; and

a ticket add-on module is configured to extract the unique device identifier from the ticket and provide the unique device identifier to a plurality of add-on modules.

5. The system of claim 1 , wherein the request to verify compliance is transmitted to an application programming interface (API) of the management service.

6. The system of claim 5 , wherein:

the data store comprises a shared key and a shared certificate that are shared with the management service;

the shared certificate is included in the request to verify compliance; and

the management service validates the shared certificate using the shared key prior to providing a compliance status indicating that the client device complies with the at least one compliance rule.

7. The system of claim 5 , wherein:

an agent on the client device enrolls with the management service prior to sending the credentials to the at least one computing device; and

a plurality of client applications executed on the client device access resources in the data store based at least in part on the user account being authenticated for access through the client device.

8. A non-transitory computer-readable medium embodying instructions for assessing compliance of a client device while authenticating a user account, wherein the instructions, when executed by at least one processor, cause at least one computing device to at least:

transmit, to the client device, instructions for certificate verification, the instructions comprising a command to transmit a certificate to a key distribution center, the certificate comprising a unique device identifier for the client device, wherein the unique device identifier is assigned by a management service during an enrollment of the client device;

receive, from the client device, a ticket obtained from the key distribution center, wherein the unique device identifier is embedded in the ticket by the key distribution center based on verification that the certificate is valid;

extract the unique device identifier from the ticket;

determine that credentials received from the client device authenticate against the user account;

transmit, to the management service, a request to verify compliance of the client device with at least one compliance rule, wherein the request comprises the unique device identifier; and

authenticate the user account for access through the client device.

9. The non-transitory computer-readable medium of claim 8 , wherein the instructions, when executed by the at least one processor, further cause the at least one computing device to at least:

cache the unique device identifier and session data associated with the user account, the session data comprising a compliance status indicating that the client device complies with at least one compliance rule;

periodically poll a management service to determine an updated compliance status indicating that the client device still complies with the at least one compliance rule; and

update the session data based at least in part on the updated status and the unique device identifier.

10. The non-transitory computer-readable medium of claim 9 , wherein the instructions, when executed by the processor, cause the at least one computing device to at least:

receive a single sign-on request including a username of the user account from a service provider;

obtain the session data associated with the user account;

generate a single sign-on token including a current compliance status from the session data that specifies that the client device complies with the at least one compliance rule, the current compliance status being stored in at least one of: a security assertion markup language (SAML) attribute field of the single sign-on token, an OAuth2 token attribute, or an OpenID Connect token attribute; and

transmit the single sign-on token to service provider.

11. The non-transitory computer-readable medium of claim 8 , wherein the instructions comprise:

a key distribution add-on module configured to send the command to transmit the certificate to the key distribution center;

a device compliance add-on module configured to determine that the client device complies with the at least one compliance rule; and

a ticket add-on module configured to extract the unique device identifier from the ticket and provide the unique device identifier to a plurality of add-on modules.

12. The non-transitory computer-readable medium of claim 8 , wherein the unique device identifier is stored in a Domain Name Server Subject Alternate Name field in the certificate.

13. The non-transitory computer-readable medium of claim 8 , wherein the request to verify compliance is transmitted to an application programming interface of the management service.

14. The non-transitory computer-readable medium of claim 13 , wherein a shared key and a shared certificate are shared with a management service, the shared certificate is included in the request to verify compliance, and the management service validates the shared certificate using the shared key prior to providing a compliance status indicating that the client device complies with the at least one compliance rule.

15. A method of assessing compliance of a client device while authenticating a user account, comprising:

transmitting, to the client device, instructions for certificate verification, the instructions comprising a command to transmit a certificate to a key distribution center, the certificate comprising a unique device identifier for the client device, wherein the unique device identifier is assigned by a management service during an enrollment of the client device;

receiving, from the client device, a ticket obtained from the key distribution center, wherein the unique device identifier is embedded in the ticket by the key distribution center based on verification that the certificate is valid;

extracting the unique device identifier from the ticket;

determining that credentials received from the client device authenticate against the user account;

transmitting, to the management service, a request to verify compliance of the client device with at least one compliance rule, wherein the request comprises the unique device identifier; and

authenticating the user account for access through the client device.

16. The method of claim 15 , further comprising:

caching the unique device identifier and session data associated with the user account, the session data comprising a compliance status indicating that client device complies with at least one compliance rule;

periodically polling a management service to determine an updated compliance status indicating that the client device still complies with the at least one compliance rule; and

updating the session data based at least in part on the updated status and the unique device identifier.

17. The method of claim 16 , further comprising:

receiving a single sign-on request including a username of the user account from a service provider;

obtaining the session data associated with the user account;

generating a single sign-on token including a current compliance status from the session data that specifies that the client device complies with the at least one compliance rule, the current compliance status being stored in at least one of: a security assertion markup language (SAML) attribute field of the single sign-on token, an OAuth2 token attribute, or an OpenID Connect token attribute; and

transmitting the single sign-on token to service provider.

18. The method of claim 15 , wherein:

a key distribution add-on module is configured to send the command to transmit the certificate to the key distribution center;

a device compliance add-on module is configured to determine that the client device complies with the at least one compliance rule; and

a ticket add-on module is configured to extract the unique device identifier from the ticket and provide the unique device identifier to a plurality of add-on modules.

19. The method of claim 15 , wherein the unique device identifier is stored in a Domain Name Server Subject Alternate Name field in the certificate.

20. The method of claim 15 , wherein the user account is authenticated for access through the client device based on: verification of the certificate, authentication of the credentials, and verification of compliance with the at least one compliance rule.