Secure single sign on and conditional access for client applications
Methods and systems for implementing single sign on (SSO) and/or conditional access for client applications are described herein. The system may comprise an identity provider gateway, and the system may authenticate a user of the client application using the identity provider gateway. In some aspects, a secure communication tunnel may be established between the client application and the identity provider gateway, and the secure communication tunnel may use, for example, a client certificate. The identity provider gateway may grant or deny the client application access to one or more resources based on information associated with the client certificate.
1. A method comprising:
receiving, by a computing device, from a user device, and via a secure channel between the user device and the computing device, an authentication request associated with a client certificate;
determining whether the authentication request was received via the secure channel;
extracting, by the computing device, from the client certificate, and based on a determination that the authentication request was received via the secure channel, a device identifier for the user device;
sending, by the computing device and to a server, data indicating the device identifier associated with the user device;
receiving, by the computing device and from the server, data indicating whether the user device is compliant with one or more security policies; and
determining, by the computing device and based on the data indicating whether the user device is compliant with one or more security policies, whether to grant the user device access to a service.
2. The method of claim 1 , further comprising:
detecting a request, by the user device, to access the computing device;
intercepting, by a communication application, the request to access the computing device; and
establishing, by the communication application, the secure channel between the user device and the computing device.
3. The method of claim 1 , wherein the secure channel comprises a virtual private network (VPN) tunnel.
4. The method of claim 1 , further comprising:
establishing the secure channel between the user device and the computing device in response to a request, from a service provider of the service, to redirect the authentication request to the computing device.
5. The method of claim 1 , further comprising:
after determining to grant access to the service, retrieving, by the computing device, cached authentication data associated with the user device;
generating, by the computing device and using the cached authentication data, an authentication token; and
sending, by the computing device and to the user device, the authentication token.
6. The method of claim 5 , wherein the authentication token is configured to be used by the user device to access the service.
7. The method of claim 1 , further comprising:
determining, by the computing device, that authentication data associated with the user device is not cached at the computing device;
in response to determining that the authentication data is not cached at the computing device, sending, by the computing device and to the user device, a request for the authentication data from an identity provider device;
receiving, by the computing device, from the user device, and via the identity provider device, the authentication data associated with the user device; and
caching, by the computing device, the authentication data associated with the user device.
8. The method of claim 7 , further comprising:
retrieving, by the computing device, the cached authentication data associated with the user device;
generating, by the computing device and using the cached authentication data, an authentication token; and
sending, by the computing device and to the user device, the authentication token.
9. The method of claim 7 , further comprising:
after a predetermined amount of time, removing, by the computing device, the cached authentication data associated with the user device.
10. The method of claim 1 , further comprising:
after determining to grant access to the service, determining, by the computing device, and from information associated with the authentication request, a user identifier associated with a user of the user device;
generating, by the computing device and using the user identifier, an authentication token; and
sending, by the computing device and to the user device, the authentication token.
11. The method of claim 10 , further comprising:
after determining the user identifier, sending, by the computing device and to a directory service, a request for additional data associated with the user of the user device; and
receiving, by the computing device and from the directory service, the additional data associated with the user of the user device, wherein generating the authentication token comprises generating the authentication token using the user identifier and the additional data associated with the user received from the directory service.
12. An apparatus comprising:
a processor; and
memory storing computer-executable instructions that, when executed by the processor, cause the apparatus to:
receive, from a user device and via a secure channel between the apparatus and the user device, an authentication request associated with a client certificate;
determine whether the authentication request was received via the secure channel;
extract, from the client certificate and based on a determination that the authentication request was received via the secure channel, a device identifier for the user device;
send, to a server, data indicating the device identifier associated with the user device;
receive, from the server, data indicating whether the user device is compliant with one or more security policies; and
determine, based on the data indicating whether the user device is compliant with one or more security policies, whether to grant the user device access to a service.
13. The apparatus of claim 12 , wherein the memory stores computer-executable instructions that, when executed by the processor, cause the apparatus to:
after determining to grant access to the service, retrieve cached authentication data associated with the user device;
generate, using the cached authentication data, an authentication token; and
send, to the user device, the authentication token.
14. The apparatus of claim 13 , wherein the authentication token is configured to be used by the user device to access the service.
15. The apparatus of claim 12 , wherein the memory stores computer-executable instructions that, when executed by the processor, cause the apparatus to:
determine that authentication data associated with the user device is not cached at the apparatus;
in response to determining that the authentication data is not cached at the apparatus, send, to the user device, a request for the authentication data from an identity provider device;
receive, from the user device and via the identity provider device, the authentication data associated with the user device; and
cache the authentication data associated with the user device.
16. The apparatus of claim 15 , wherein the memory stores computer-executable instructions that, when executed by the processor, cause the apparatus to:
retrieve the cached authentication data associated with the user device;
generate, using the cached authentication data, an authentication token; and
send, to the user device, the authentication token.
17. The apparatus of claim 12 , wherein the memory stores computer-executable instructions that, when executed by the processor, cause the apparatus to:
after determining to grant access to the service, determine, from information associated with the authentication request, a user identifier associated with a user of the user device;
generate, using the user identifier, an authentication token; and
send, to the user device, the authentication token.
18. A system comprising:
a user device; and
a computing device,
wherein the user device comprises:
a processor; and
memory storing computer-executable instructions that, when executed by the processor of the user device, cause the user device to:
send, to the computing device and via a secure channel between the user device and the computing device, an authentication request associated with a client certificate, and
wherein the computing device comprises:
a processor; and
memory storing computer-executable instructions that, when executed by the processor of the computing device, cause the computing device to:
determine whether the authentication request was received via the secure channel;
extract, from the client certificate and based on a determination that the authentication request was received via the secure channel, a device identifier for the user device;
send, to a server, data indicating the device identifier associated with the user device;
receive, from the server, data indicating whether the user device is compliant with one or more security policies; and
determine, based on the data indicating whether the user device is compliant with one or more security policies, whether to grant the user device access to a service.
19. The system of claim 18 , wherein the memory of the user device stores computer-executable instructions that, when executed by the processor of the user device, cause the user device to:
detect a request to access the computing device;
intercept, by a communication application, the request to access the computing device; and
establish, by the communication application, the secure channel between the user device and the computing device.
20. The system of claim 18 , wherein the memory of the user device stores computer-executable instructions that, when executed by the processor of the user device, cause the user device to:
establish the secure channel between the user device and the computing device in response to a request, from a service provider of the service, to redirect the authentication request to the computing device.