Granted Patent B2

US 10,587,603 · App. 15/240,962 · Granted Mar 10, 2020

Inventors: Anil Lingamallu (Bellevue, WA); Nate Yocom (Bellevue, WA); Paul Moore (Bellevue, WA); Fei Chen (Bellevue, WA)

Assignee: IDAPTIVE, LLC

H04L63/0823G06F21/33G06F21/44H04L63/083H04L63/0815H04L63/0861H04L67/02G06F2221/2103H04L2463/082

Abstract

Claims (37)

1. Method for enabling zero sign-on (ZSO) through a standard web browser comprising:

enrolling a device which uses at least one standard web browser with a web service by:

authenticating a user of said device using an enrollment service of said web service configured to receive from said device a request for authentication;

said enrollment service sending a request for user credentials to an enrollment agent installed on said device;

said enrollment service receiving from said enrollment agent, user credentials obtained from the user;

said enrollment service authenticating the user with said web service using said obtained user credentials;

said enrollment service downloading to said enrollment agent, a device profile that contains a user certificate for the user with an accompanying authority certificate issued by said web service, said enrollment agent for storing the user and authority certificates to a predetermined location on the device, and configuring each of said at least one standard web browsers on said device to respond correctly to ZSO Uniform Resource Locator (URL) certificate challenges from said web service, wherein said configuring comprises adding a policy setting which enables auto selecting of URL certificates that contain a ZSO URL, and the user certificate and authority certificate stored in a keychain to present when connecting to the ZSO URL returns a challenge requesting a certificate.

2. The method defined by claim 1 wherein said web service is a device management service.

3. The method defined by claim 1 wherein said web service downloads said device profile to said enrollment agent for storing said user and authority certificates to a predetermined location on said device.

4. The method defined by claim 1 wherein said web service downloads said device profile to a device management agent for storing said user and authority certificates to a predetermined location on said device.

5. The method defined by claim 1 wherein authentication further comprises said enrollment service requiring multi-factor authentication, and said web service sends to said enrollment agent a request for prompting said user to supply additional information including one of a fingerprint swipe and an externally-generated token.

6. Method for enabling zero sign-on (ZSO) using a standard web browser comprising:

enrolling a device which uses at least one standard web browser with a web service by:

an installed enrollment agent on said device sending a request to said web service to authenticate a user of said device;

said installed enrollment agent receiving from an enrollment service of said web service a request for user credentials;

said installed enrollment agent providing said requested user credentials to said enrollment service;

after an authentication performed by said web service, said installed enrollment agent receiving from said web service a device profile including a user certificate for the user and an authority certificate issued by said web service;

said device storing said user certificate and authority certificate at a device location accessible by each of said at least one standard web browsers;

said installed enrollment agent configuring each of said at least one standard web browsers to respond correctly to a ZSO Uniform Resource Locator (URL) certificate challenge received from said web service, wherein said configuring comprises adding a policy setting which enables auto selecting of URL certificates that contain a ZSO URL, and the user certificate and authority certificate stored in a keychain to present when connecting to the ZSO URL returns a challenge requesting a certificate.

7. The method defined by claim 6 wherein said web service is a device management service.

8. The method defined by claim 6 wherein said policy setting is named AutoSelectCertificateForUrls.

9. The method defined by claim 6 wherein said configuring each of said at least one standard web browsers comprises storing the user certificate and authority certificate in a predetermined location for subsequent accessing by each of said at least one standard web browsers.

10. The method defined by claim 6 wherein said configuring each of said at least one standard web browsers comprises using a keychain application program interface (API) to set a certificate preference that ties a ZSO URL to the user certificate.

11. The method defined by claim 6 wherein said authentication comprises:

a) said enrollment agent contacting the web service's enrollment service to authenticate the user, said enrollment service for requesting user credentials from the enrollment agent;

b) said enrollment agent prompting the user to provide predetermined credentials to the enrollment agent;

c) said enrollment agent sending said provided predetermined credentials to said enrollment service.

12. The method defined by claim 11 wherein said predetermined credentials include a username and password.

13. The method defined by claim 11 wherein if the enrollment service requires multi-factor authentication, said enrollment agent prompting said user to supply additional information including one of a fingerprint swipe and an externally-generated token.

14. The method defined by claim 6 wherein said enrolling comprises:

a) said device sending a request to said web service to download said enrollment agent to said device;

b) said web service for processing said request and initiating a download of said enrollment agent;

c) said device downloading the enrollment agent from said web service, and after said downloading is complete, installing the enrollment agent on said device.

15. The method defined by claim 6 wherein said enrolling comprises:

a) said device sending a request to an external source to download said enrollment agent to said device;

b) said external source for processing said request and initiating a download of said enrollment agent

c) said device downloading the enrollment agent from said external source, and after said downloading is complete, installing the enrollment agent on said device.

Assignments (10)

Continuity (1)

Cited By (1)

US 12,683,767