Unified VPN and identity based authentication to cloud-based services
Techniques are disclosed to provide VPN and identity based authentication to cloud-based services. In various embodiments, a request to authenticate a user to a service is received. A user identity associated with one or both of the user and the request is determined based at least in part on data comprising the request. An identity assertion is generated based at least in part on the user identity. The identity assertion is provided to a requesting node with which the request to authenticate is associated.
1. A system, comprising:
a communication interface; and
a hardware processor coupled to the communication interface and configured to:
receive via the communication interface a request to authenticate a user to a service, wherein the request is received from a first device;
determine based at least in part on data comprising the request a user identity associated with one or both of the user and the request, wherein the user identity is determined based at least in part on a credential associated with a virtual private network (VPN) connection and the user identity is associated with a second device;
send a notification to the second device, wherein an agent on the second device is configured to respond to the notification at least in part by prompting a user of the second device to provide an input including a context assurance input that includes receiving from an environment in which the first device is located a context assurance data and the second device is configured to send data associated with the context assurance data to the hardware processor;
generate an identity assertion including by transforming the user identity according to a profile associated with the service to conform to a federated identity message expected by the service; and
provide the identity assertion via the communication interface to a requesting node with which the request to authenticate is associated.
2. The system of claim 1 , wherein the request to authenticate is associated with a redirection by the service to an identity provider associated with said system.
3. The system of claim 1 , wherein the request is received from a device not associated with the VPN.
4. The system of claim 3 , wherein the second device is associated with the VPN.
5. The system of claim 4 , wherein the second device comprises an enterprise-managed mobile device.
6. The system of claim 5 , wherein the hardware processor is further configured to receive security posture information associated with a mobile device and to generate the identity assertion based at least in part on a determination that the security posture information associated with the mobile device indicates the mobile device is in a secure state.
7. The system of claim 1 , wherein the input comprises a credential.
8. The system of claim 1 , wherein the context assurance input comprises one or more of a visual challenge that is displayed on a display of the first device and scanned using the second device; a Bluetooth or other near field emission of or communication from the first device to the second device; or other data displayed or otherwise provided as output by the first device and received by the second device via a direct path within a physical space within which both the first device and the second device are collocated.
9. The system of claim 4 , wherein the second device is associated with a second user having an approval authority with respect to the request, and wherein the hardware processor is configured to generate the identity assertion based at least in part on an approval response received via the second device.
10. The system of claim 1 , wherein the credential comprises a certificate.
11. The system of claim 10 , wherein the certificate includes a user attribute data associated with the service.
12. The system of claim 11 , wherein generating the identity assertion includes reading said user attribute data from the certificate and using at least a portion of the user attribute data read from the certificate to populate a data value of the identity assertion.
13. The system of claim 12 , wherein the hardware processor is further configured to obtain from an enterprise user directory additional user attributes to be included in the identity assertion.
14. The system of claim 1 , wherein the profile includes a rule mapping an entry in a user certificate field to an attribute in an attribute statement within the identity assertion to be provided to the service.
15. The system of claim 1 , wherein the profile includes a set of cascading rules such that if a first rule fails then a second rule is applied in which a component of a field in a user certificate is mapped to an attribute in an attribute statement within the identity assertion.
16. A method, comprising:
receiving via a communication interface a request to authenticate a user to a service, wherein the request is received from a first device;
using a hardware processor to determine based at least in part on data comprising the request a user identity associated with one or both of the user and the request, wherein the user identity is determined based at least in part on a credential associated with a virtual private network (VPN) connection and the user identity is associated with a second device;
sending a notification to the second device, wherein an agent on the second device is configured to respond to the notification at least in part by prompting a user of the second device to provide an input including a context assurance input that includes receiving from an environment in which the first device is located a context assurance data and the second device is configured to send data associated with the context assurance data to the hardware processor;
using the processor to generate an identity assertion including by transforming the user identity according to a profile associated with the service to conform to a federated identity message expected by the service; and
providing the identity assertion via the communication interface to a requesting node with which the request to authenticate is associated.
17. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
receiving a request to authenticate a user to a service, wherein the request is received from a first device;
determining based at least in part on data comprising the request a user identity associated with one or both of the user and the request, wherein the user identity is determined based at least in part on a credential associated with a virtual private network (VPN) connection and the user identity is associated with a second device;
sending a notification to the second device, wherein an agent on the second device is configured to respond to the notification at least in part by prompting a user of the second device to provide an input including a context assurance input that includes receiving from an environment in which the first device is located a context assurance data and the second device is configured to send data associated with the context assurance data to the hardware processor;
generating an identity assertion including by transforming the user identity according to a profile associated with the service to conform to a federated identity message expected by the service; and
providing the identity assertion to a requesting node with which the request to authenticate is associated.