Hybrid authentication systems and methods
Disclosed are hybrid authentication systems and methods that enable users to seamlessly sign-on between cloud-based services and on-premises systems. A cloud-based authentication service receives login credentials from a user and delegates authentication to an on-premises authentication service proxy. The login credentials can be passed by the cloud-based authentication service to the on-premises authentication service proxy, for instance, as an access token in an authentication header. The access token can be a JavaScript Object Notation (JSON) Web Token (JWT) token that is digitally signed using JSON Web Signature. Some embodiments utilize a tunnel connection through which the cloud-based authentication service communicates with the on-premises authentication service proxy. Some embodiments leverage an on-premises identity management system for user management and authentication. In this way, there is no need for a cloud-based system to separately maintain and manage a user identity management system and/or having to sync with an on-premises identity management system.
1. A method for authenticating a user to an on-premises system through a cloud platform, the method comprising:
determining, by a cloud-based authentication service running on a first computer operating in a cloud computing environment, whether a tenant of the cloud computing environment is configured for hybrid authentication;
responsive to the tenant of the cloud computing environment being configured for hybrid authentication, presenting, by the cloud-based authentication service, a login page in a browser on a user device;
receiving, by the cloud-based authentication service through the login page in the browser on the user device, login credentials of a user associated with the tenant;
invoking, by the cloud-based authentication service responsive to receipt of the login credentials of the user, an on-premises authentication service through a tunnel server, the on-premises authentication service running on a second computer operating in an enterprise computing environment, wherein the tunnel server sends an authentication request to a tunnel agent, which forwards the authentication request to the on-premises authentication service, the authentication request containing the login credentials of the user, wherein the login credentials of the user is used by the on-premises authentication service to obtain a user profile for the user;
receiving, by the cloud-based authentication service through the tunnel agent and the tunnel server, the user profile for the user from the on-premises authentication service;
generating, by the cloud-based authentication service, an authentication code using the user profile;
communicating the authentication code to the browser running on the user device, wherein the browser forwards the authentication code generated by the cloud-based authentication service to a cloud-based application running within the browser; and
responsive to a request from the cloud-based application, passing an access token to the on-premises authentication service through the tunnel server and the tunnel agent, the request from the cloud-based application containing the authentication code generated by the cloud-based authentication service, the passing performed by the cloud-based authentication service, the on-premises authentication service verifying the access token and authenticating as the user to an on-premises content server.
2. The method according to claim 1 , wherein the tunnel server operates in the cloud computing environment and wherein the tunnel agent operates in the enterprise computing environment.
3. The method according to claim 1 , wherein the on-premises authentication service is a Web service acting as a proxy for the cloud-based authentication service operating in the cloud computing environment.
4. The method according to claim 1 , wherein the on-premises authentication service is operable to obtain the user profile for the user from an on-premises identity management system.
5. The method according to claim 1 , wherein the access token is passed, through the tunnel server and the tunnel agent, to the on-premises authentication service in an authentication header.
6. The method according to claim 1 , wherein the on-premises authentication service authenticates the user using an on-premises user authentication.
7. The method according to claim 1 , wherein the access token is a JavaScript Object Notation (JSON) Web Token (JWT) token that is digitally signed using JSON Web Signature.
8. A system for authenticating a user to an on-premises system through a cloud platform, comprising:
a processor;
a non-transitory computer readable medium; and
stored instructions translatable by the processor to perform:
determining whether a tenant of a cloud computing environment is configured for hybrid authentication;
responsive to the tenant of the cloud computing environment being configured for hybrid authentication, presenting a login page in a browser on a user device;
receiving, through the login page in the browser on the user device login credentials of a user associated with the tenant;
responsive to receipt of the login credentials of the user, invoking art on-premises authentication service through a tunnel server, the on-premises authentication service running on a computer operating in an enterprise computing environment, wherein the server sends an authentication request to a tunnel agent, which forwards the authentication request to the on-premises authentication service, the authentication request containing the login credentials of the user, wherein the login credentials of the user is used by the on-premises authentication service to obtain a user profile for the user;
receiving through the tunnel agent and the tunnel server, the user profile for the user from the on-premises authentication service;
generating an authentication code using the user profile;
communicating the authentication code to, the browser running on the user device, wherein the browser forwards the authentication code generated by the cloud-based authentication service to a cloud-based application running within the browser; and
responsive to a request from the cloud-based application, passing an access token to the on-premises authentication service through the tunnel server and the tunnel agent, the request from the cloud-based application containing the authentication code generated by the cloud-based authentication service, the on-premises authentication service verifying the access token and authenticating as the user to an on-premises content server.
9. The system of claim 8 , wherein the tunnel server operates in the cloud computing environment and wherein the tunnel agent operates in the enterprise computing environment.
10. The system of claim 8 , wherein the on-premises authentication service is a Web service acting as a proxy for a cloud-based authentication service operating in a cloud computing environment.
11. The system of claim 8 , wherein the on-premises authentication service is operable to obtain the user profile for the user from an on-premises identity management system.
12. The system of claim 8 , wherein the access token is passed, through the tunnel server and the tunnel agent, to the on-premises authentication service in an authentication header.
13. The system of claim 8 , wherein the on-premises authentication service authenticates the user using an on-premises user authentication.
14. The system of claim 8 , wherein the access token is a JavaScript Object Notation (JSON) Web Token (JWT) token that is digitally signed using JSON Web Signature.
15. A computer program product for authenticating a user to an on-premises system through a cloud platform, the computer program product comprising a non-transitory computer-readable medium storing instructions translatable by a processor to perform:
determining whether a tenant of cloud computing environment configured for hybrid authentication;
responsive to the tenant of the cloud computing environment being configured for hybrid authentication, presenting a login page in a browser on a user device;
receiving, through the login page in the browser on the user device, login credentials of a user associated with the tenant;
responsive to receipt of the login credentials of the user, invoking an on-premises authentication service through a tunnel server, the on-premises authentication service running on a computer operating in an enterprise computing environment, wherein the server sends an authentication request to a tunnel agent, which forwards the authentication request to the on-premises authentication service, the authentication request containing the login credentials of the user, wherein the login credentials of the user is used by the on-premises authentication service to obtain a user profile for the user;
receiving, through the tunnel agent and the tunnel server, the user profile for the user from the on-premises authentication service;
generating an authentication code using the user profile;
communicating the authentication code to the browser running on the user device, wherein the browser forwards the authentication code generated by the cloud-based authentication service to a cloud-based application running within the browser; and
responsive to, a request from the cloud-based application, passing an access token to the on-premises authentication service through the tunnel server and the tunnel agent, the request from the cloud-based application containing the authentication code generated by the cloud-based authentication service, the on-premises authentication service verifying the access token and authenticating a user to an on-premises content server.
16. The computer program product of claim 15 , wherein the tunnel server operates in the cloud computing environment and wherein the tunnel agent operates in the enterprise computing environment.
17. The computer program product of claim 15 , wherein the on-premises authentication service is a Web service acting as a proxy for a cloud-based authentication service operating in a cloud computing environment.
18. The computer program product of claim 15 , wherein the on-premises authentication service is operable to obtain the user profile for the user from an on-premises identity management system.
19. The computer program product of claim 15 , wherein the access token is passed, through the tunnel server and the tunnel agent, to the on-premises authentication service in an authentication header.
20. The computer program product of claim 15 , wherein the on-premises authentication service authenticates the user using an on-premises user authentication.