Secure authentication of devices
Disclosed are various embodiments for an authentication service. A unique identifier is associated with a device access token for a client to be authenticated. An authentication identifier is sent to an authenticated client. The client to be authenticated communicates the authentication identifier and unique identifier to the authentication service to complete authentication.
1. A method, comprising:
obtaining, by a first computing device, a unique identifier generated by a third-party service, wherein the unique identifier is obtained from the third-party service via a device authorization service that serves as an intermediary by redirecting communications between the first computing device and the third-party service during authentication;
obtaining, by the first computing device, from a second computing device, an authentication identifier embodying an authentication state with respect to the third-party service;
communicating, by the first computing device, the unique identifier and the authentication identifier to the third-party service; and
in response to communicating the unique identifier and the authentication identifier to the third-party service, receiving, by the first computing device, a service authentication token from the third-party service that can be presented to the third-party service to access functionality or content provided by the third-party service.
2. The method of claim 1 , wherein the third-party service authenticates the first computing device based at least in part upon the unique identifier and the authentication identifier.
3. The method of claim 1 , wherein the device authorization service is distinct from the third-party service.
4. The method of claim 1 , wherein the unique identifier is obtained in response to a communication of a device access token to the third-party service.
5. The method of claim 1 , wherein obtaining, by the first computing device, the authentication identifier further comprises decoding a representation of the authentication identifier obtained from the second computing device.
6. The method of claim 5 , wherein the representation of the authentication identifier is obtained through a near-field communication (NFC) communication interface, a personal area network interface, a wireless network interface, or an infrared communications interface.
7. The method of claim 6 , wherein the authentication identifier is obtained via a push channel between the first computing device and the second computing device.
8. The method of claim 1 , wherein the second computing device is authenticated with the third-party service, and the authentication state corresponds to the second computing device.
9. A system, comprising:
a first computing device; and
an application executable by the first computing device, the application causing the first computing device to at least:
obtain a unique identifier generated by a third-party service, wherein the unique identifier is obtained from the third-party service via a device authorization service that serves as an intermediary by redirecting communications between the first computing device and the third-party service during authentication;
obtain, from a second computing device, an authentication identifier embodying an authentication state with respect to the third-party service;
communicate the unique identifier and the authentication identifier to the third-party service; and
in response to the unique identifier and the authentication identifier being communicated to the third-party service, receive a service authentication token from the third-party service that can be presented to the third-party service to access functionality or content provided by the third-party service.
10. The system of claim 9 , wherein the third-party service authenticates the first computing device based at least in part upon the unique identifier and the authentication identifier.
11. The system of claim 9 , wherein the unique identifier is obtained in response to a communication of a device access token to the third-party service.
12. The system of claim 9 , wherein the authentication identifier is obtained by decoding a representation of the authentication identifier obtained from the second computing device.
13. The system of claim 12 , wherein the representation of the authentication identifier is obtained through a near-field communication (NFC) communication interface, a personal area network interface, a wireless network interface, or an infrared communications interface.
14. The system of claim 13 , wherein the authentication identifier is obtained via a push channel between the first computing device and the second computing device.
15. A non-transitory computer-readable medium embodying a program executable in a first computing device, the program, when executed, causing the first computing device to at least:
obtain a unique identifier generated by a third-party service, wherein the unique identifier is obtained from the third-party service via a device authorization service that serves as an intermediary by redirecting communications between the first computing device and the third-party service during authentication;
obtain, from a second computing device, an authentication identifier embodying an authentication state with respect to the third-party service;
communicate the unique identifier and the authentication identifier to the third-party service; and
in response to the unique identifier and the authentication identifier being communicated to the third-party service, receive a service authentication token from the third-party service that can be presented to the third-party service to access functionality or content provided by the third-party service.
16. The non-transitory computer-readable medium of claim 15 , wherein the third-party service authenticates the first computing device based at least in part upon the unique identifier and the authentication identifier.
17. The non-transitory computer-readable medium of claim 15 , wherein the unique identifier is obtained in response to a communication of a device access token to the third-party service.
18. The non-transitory computer-readable medium of claim 17 , wherein the authentication identifier is obtained by decoding a representation of the authentication identifier obtained from the second computing device.
19. The non-transitory computer-readable medium of claim 15 , wherein the device authorization service implements a protocol or policy that indicates that the third-party service should communicate the unique identifier to the device authorization service for forwarding to the first computing device.
20. The system of claim 9 , wherein the device authorization service implements a protocol or policy that indicates that the third-party service should communicate the unique identifier to the device authorization service for forwarding to the first computing device.