Single sign-on framework for browser-based applications and native applications

1. A system for providing a single sign-on capability to a browser-based application accessed by a browser:

a client device comprising a processor and a memory, the client device executing the browser and configured to at least:

store an authentication key on the client device in response to a previous authentication of credentials associated with a user account;

transmit a request to authenticate access to the browser-based application from the client device to an identity provider server in response to the browser-based application accessing a link that requires federated user authentication;

receive an authentication challenge embedded in a tbauth request from the identity provider server in response to the request to authenticate access, the tbauth request including a uniform resource identifier (URI) for which an identity provider application on the client device is registered as a local identity provider;

retrieve the authentication key;

transmit the authentication key and the authentication challenge to the identity provider server; and

obtain an indication that the user account is authenticated by the identity provider server.

2. The system of claim 1 , wherein the client device is further configured to at least:

obtain a request to perform the previous authentication of the user account;

transmit at least one of a username and a password of the user account to the identity provider server;

obtain the authentication key from the identity provider server; and

store the authentication key on the client device.

3. The system of claim 1 , wherein the client device is further configured to at least redirect to a website that has federated authentication to the identity provider server in response to obtaining the indication that the user account is authenticated.

4. The system of claim 1 , wherein the indication that the user account is authenticated comprises an authentication token or a cookie.

5. The system of claim 4 , wherein the client device is further configured to store the authentication token or the cookie in a token store using an application programming interface (API) associated with an operating system executed by the client device.

6. The system of claim 1 , wherein the authentication key is retrieved from a token store by the identity provider application, wherein the identity provider application registers as a local identity provider using an application programming interface (API) associated with an operating system of the client device, wherein the identity provider application specifies a particular identity provider server address for the identity provider server for which the identity provider application is the local identity provider.

7. A method for providing a single sign-on capability to a browser-based application accessed by a browser on a client device, comprising:

storing an authentication key on the client device in response to a previous authentication of credentials associated with a user account;

transmitting a request to authenticate access to the browser-based application from the client device to an identity provider server in response to the browser-based application accessing a link that requires federated user authentication;

receiving an authentication challenge embedded in a tbauth request from the identity provider server in response to the request to authenticate access, the tbauth request including a uniform resource identifier (URI) for which an identity provider application on the client device is registered as a local identity provider;

retrieving the authentication key;

transmitting the authentication key and the authentication challenge to the identity provider server; and

obtaining an indication that the user account is authenticated by the identity provider server.

8. The method of claim 7 , further comprising:

obtaining a request to perform the previous authentication of the user account;

transmitting at least one of a username and a password of the user account to the identity provider server;

obtaining the authentication key from the identity provider server; and

storing the authentication key on the client device.

9. The method of claim 7 , further comprising redirecting to a website that has federated authentication to the identity provider server in response to obtaining the indication that the user account is authenticated.

10. The method of claim 7 , wherein the indication that the user account is authenticated comprises an authentication token or a cookie.

11. The method of claim 10 , further comprising storing the authentication token or the cookie in a token store using an application programming interface (API) associated with an operating system executed by the client device.

12. The method of claim 7 , wherein the authentication key is retrieved from a token store by the identity provider application, wherein the identity provider application registers as a local identity provider using an application programming interface (API) associated with an operating system of the client device, wherein the identity provider application specifies a particular identity provider server address for the identity provider server for which the identity provider application is the local identity provider.

13. A non-transitory computer-readable medium comprising machine-readable instructions providing a single sign-on capability to a browser-based application accessed by a browser on a client device, wherein when executed by a processor of the client device, the machine-readable instructions cause the client device to at least:

store an authentication key on the client device in response to a previous authentication of credentials associated with a user account;

transmit a request to authenticate access to the browser-based application from the client device to an identity provider server in response to the browser-based application accessing a link that requires federated user authentication;

receive an authentication challenge embedded in a tbauth request from the identity provider server in response to the request to authenticate access, the tbauth request including a uniform resource identifier (URI) for which an identity provider application on the client device is registered as a local identity provider;

retrieve the authentication key;

transmit the authentication key and the authentication challenge to the identity provider server; and

obtain an indication that the user account is authenticated by the identity provider server.

14. The non-transitory computer-readable medium of claim 13 , wherein the instructions further cause the client device to at least:

obtain a request to perform the previous authentication of the user account;

transmit at least one of a username and a password of the user account to the identity provider server;

obtain the authentication key from the identity provider server; and

store the authentication key on the client device.

15. The non-transitory computer-readable medium of claim 13 , wherein the indication that the user account is authenticated comprises an authentication token or a cookie.

16. The non-transitory computer-readable medium of claim 15 , wherein the machine-readable instructions further cause the computing device to at least store the authentication token or the cookie in a token store using an application programming interface (API) associated with an operating system executed by the client device.

17. The non-transitory computer-readable medium of claim 13 , wherein the authentication key is retrieved from a token store by the identity provider application, wherein the identity provider application registers as a local identity provider using an application programming interface (API) associated with an operating system of the client device, wherein the identity provider application specifies a particular identity provider server address for the identity provider server for which the identity provider application is the local identity provider.