Single sign-on framework for browser-based applications and native applications

1. A system for providing a single sign-on capability to at least one application installed on a client device, comprising:

the client device; and

an identity provider application executable by the client device, the identity provider application causing the client device to at least:

register the identity provider application as a local identity provider on the client device using an application programming interface (API) associated with an operating system of the client device, wherein the identity provider application specifies a particular identity provider server address for an identity provider service for which the identity provider application is the local identity provider;

obtain a user credential associated with a user account;

authenticate the user credential for the user account with the identity provider service;

obtain a request to validate an installation of an application installed on the client device based upon the user account;

validate the installation of the application based upon at least one parameter embedded within the request, the installation of the application being validated by extracting a package family name from the request to authenticate the installation of the application, generating a session identifier associated with the request to authenticate the installation of the application and providing the session identifier and an encryption key to the installation of the application;

request an authentication key from the identity provider service; and

provide the authentication key to the application, wherein the application authenticates the user account with the identity provider service using the authentication key.

2. The system of claim 1 , wherein the encryption key comprises a symmetric key or data from which the symmetric key is generated by the application.

3. The system of claim 2 , wherein the installation of the application is further validated by:

receiving the session identifier and the package family name encrypted by the symmetric key;

decrypting the session identifier and the package family name; and

validating the package family name associated with the application stored in session data associated with the session identifier.

4. The system of claim 3 , wherein validating the package family name associated with the application stored in session data associated with the session identifier comprises validating the package family name is a whitelisted package family name.

5. The system of claim 2 , wherein the authentication key is provided to the application through an application program interface (API) call associated with the operating system.

6. The system of claim 5 , wherein the authentication key is provided to the application in an encrypted form, wherein the authentication key is further encrypted using the symmetric key.

7. The system of claim 1 , wherein the authentication key comprises a hash message authentication code (HMAC) key generated by the identity provider service.

8. A method for providing a single sign-on capability to at least one application installed on a client device, comprising:

registering an identity provider application as a local identity provider on the client device using an application programming interface (API) associated with an operating system of the client device, wherein the identity provider application specifies a particular identity provider server address for an identity provider service for which the identity provider application is the local identity provider;

obtaining a user credential associated with a user account,

authenticating the user credential for the user account with the identity provider service;

obtaining a request to validate an installation of an application installed on the client device based upon the user account;

validating the installation of the application based upon at least one parameter embedded within the request, the installation of the application validated by extracting a package family name from the request to authenticate the installation of the application, generating a session identifier associated with the request to authenticate the installation of the application, and providing the session identifier and an encryption key to the installation of the application;

requesting an authentication key from the identity provider service;

providing the authentication key to the application, wherein the application authenticates the user account with the identity provider service using the authentication key.

9. The method of claim 8 , wherein the encryption key comprises a symmetric key or data from which the symmetric key is generated by the application.

10. The method of claim 9 , wherein the installation of the application is further validated by:

receiving the session identifier and the package family name encrypted by the symmetric key;

decrypting the session identifier and the package family name; and

validating the package family name associated with the application stored in session data associated with the session identifier.

11. The method of claim 10 , wherein validating the package family name associated with the application stored in session data associated with the session identifier comprises validating the package family name is a whitelisted package family name.

12. The method of claim 9 , wherein the authentication key is provided to the application through an application program interface (API) call associated with the operating system.

13. The method of claim 12 , wherein the authentication key is provided to the application in an encrypted form, wherein the authentication key is further encrypted using the symmetric key.

14. The method of claim 8 , wherein the authentication key comprises a hash message authentication code (HMAC) key generated by the identity provider service.

15. A non-transitory computer-readable medium comprising machine-readable instructions providing a single sign-on capability to at least one application installed on a client device, wherein when executed by a processor of the client device, the machine-readable instructions cause the client device to at least:

register an identity provider application as a local identity provider on the client device using an application programming interface (API) associated with an operating system of the client device, wherein the identity provider application specifics a particular identity provider server address for an identity provider service for which the identity provider application is the local identity provider;

obtain a user credential associated with a user account;

authenticate the user credential for the user account with the identity provider service;

obtain a request to validate an installation of an application installed on the client device based upon the user account;

validate the installation of the application based upon at least one parameter embedded within the request, the installation of the application validated by extracting a package family name from the request to authenticate the installation of the application, generating a session identifier associated with the request to authenticate the installation of the application, and providing the session identifier and an encryption key to the installation of the application;

request an authentication key from the identity provider service; and

provide the authentication key to the application, wherein the application authenticates the user account with the identity provider service using the authentication key.

16. The non-transitory computer-readable medium of claim 15 , wherein the encryption key comprises a symmetric key or data from which the symmetric key is generated by the application.

17. The non-transitory computer-readable medium of claim 16 , wherein the installation of the application is further validated by:

receiving the session identifier and the package family name encrypted by the symmetric key;

decrypting the session identifier and the package family name; and

validating the package family name associated with the application stored in session data associated with the session identifier.

18. The non-transitory computer-readable medium of claim 17 , wherein validating the package family name associated with the application stored in session data associated with the session identifier comprises validating the package family name is a whitelisted package family name.

19. The non-transitory computer-readable medium of claim 16 , wherein the authentication key is provided to the application through an application program interface (API) call associated with the operating system.

20. The non-transitory computer-readable medium of claim 15 , wherein the authentication key comprises a hash message authentication code (HMAC) key generated by the identity provider service.