Identity proxy to provide access control and single sign on
Techniques to provide secure access to a cloud-based service are disclosed. In various embodiments, a request is received from a client app on a device to connect to a security proxy associated with the cloud-based service. A secure tunnel connection between the device and a node with which the security proxy is associated is used to establish the requested connection to the security proxy. Information associated with the secure tunnel is used to determine that the requesting client app is authorized to access the cloud-based service from the device and to obtain from an identity provider associated with the cloud-based service a security token to be used by the client app to authenticate to the cloud-based service.
1. A system, comprising:
a processor configured to:
receive a request associated with a first client app on a device to connect to the system, wherein the first client app is associated with a first cloud-based service;
determine that a secure tunnel associated with the device and a second cloud-based service exists, wherein a second client app is associated with the second cloud-based service, wherein the secure tunnel was used to authenticate the second client app to the second cloud-based service;
determine that information associated with the device is cached at the system;
use the determined information to obtain a security token to be used by the first client app to authenticate to the first cloud-based service; and
provide the security token to the first client app, wherein the secure tunnel and the security token are to be used by the client app to access to the first cloud-based service;
monitor a compliance posture of the device; and
block access to the first cloud-based service based at least in part on an indication that the compliance posture of the device has changed; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system of claim 1 , wherein the request is sent by the first client app in response to a redirect message received from the first cloud-based service.
3. The system of claim 2 , wherein the redirect message includes a URL or other locator associated with a security proxy.
4. The system of claim 1 , wherein a security proxy is associated with the system and the secure tunnel is established between the device and a tunnel server running on the system.
5. The system of claim 1 , wherein to establish the secure tunnel, the processor is configured to receive from the device a security certificate.
6. The system of claim 5 , wherein the processor is further configured to use information comprising the security certificate to determine one or more of device, app, user, and certificate information.
7. The system of claim 5 , wherein the processor is further configured to use information associated with the security certificate to determine that the first client app is authorized to access the first cloud-based service.
8. The system of claim 1 , wherein a secure proxy of the system comprises an identity provider proxy configured to have a chained identity provider or other trust-based relationship to the identity provider associated with the second cloud-based service.
9. The system of claim 8 , wherein the processor is further configured to determine that the secure tunnel has already been established and to establish the requested connection to the identity provider proxy on behalf of the first client app without requiring any further credential to be provided.
10. The system of claim 1 , wherein the security token comprises a Security Assertion Markup Language (SAML) assertion.
11. The system of claim 8 , wherein the security proxy comprises a delegated identity provider.
12. The system of claim 8 , wherein the security proxy comprises a service provider proxy.
13. The system of claim 12 , wherein the processor is configured to sign the security token as and on behalf of an identity provider proxy associated with the first cloud-based service.
14. A method, comprising:
receiving a request associated with a first client app on a device to connect to a security proxy server, wherein the first client app is associated with a first cloud-based service;
determining that a secure tunnel associated with the device and a second cloud-based service exists, wherein a second client app is associated with the second cloud-based service, wherein the secure tunnel was used to authenticate the second client app to the second cloud-based service;
determining that information associated with the device is cached at the security proxy server;
using the determined information to obtain a security token to be used by the first client app to authenticate to the first cloud-based service;
providing the security token to the first client app, wherein the secure tunnel and the security token are to be used by the client app to access to the first cloud-based service;
monitoring a compliance posture of the device; and
blocking access to the first cloud-based service based at least in part on an indication that the compliance posture of the device has changed.
15. The method of claim 14 , wherein the request is sent by the first client app in response to a redirect message received from the first cloud-based service.
16. The method of claim 15 , wherein the redirect message includes a URL or other locator associated with a security proxy.
17. The method of claim 14 , wherein a security proxy is associated with the system and the secure tunnel is established between the device and a tunnel server running on the system.
18. The method of claim 13 , wherein establishing the secure tunnel includes receiving from the device a security certificate.
19. A computer program product to provide secure access to a cloud-based service, the computer program product being embodied in a non-transitory computer readable storage device and comprising computer instructions for:
receiving a request associated with a first client app on a device to connect to a security proxy server, wherein the first client app is associated with a first cloud-based service;
determining that a secure tunnel associated with the device and a second cloud-based service exists, wherein a second client app is associated with the second cloud-based service, wherein the secure tunnel was used to authenticate the second client app to the second cloud-based service;
determining that information associated with the device is cached at the security proxy server;
using the determined information to obtain a security token to be used by the first client app to authenticate to the first cloud-based service;
providing the security token to the first client app, wherein the secure tunnel and the security token are to be used by the client app to access to the first cloud-based service;
monitoring a compliance posture of the device; and
blocking access to the cloud-based service based at least in part on an indication that the compliance posture of the device has changed.