Securely authorizing access to remote resources
Methods and an apparatus are provided for securely authorizing access to remote resources. For example, a method is provided that includes receiving a request to determine whether a user device communicatively coupled to a resource server is authorized to access at least one resource hosted by the resource server and determining whether the user device communicatively coupled to the resource server is authorized to access the at least one resource hosted by the resource server based at least in part on whether the user device communicatively coupled to the resource server has been issued a management identifier. The method further includes providing a response indicating that the user device communicatively coupled to the resource server is authorized to access the at least one resource hosted by the resource server in response to a determination that the user device communicatively coupled to the resource server is authorized to access the at least one resource hosted by the resource server. The method yet further includes providing a response indicating that the user device communicatively coupled to the resource server is not authorized to access the at least one resource hosted by the resource server in response to a determination that the user device communicatively coupled to the resource server is not authorized to access the at least one resource hosted by the resource server.
1. A method for authorizing access to a cloud-based content repository, comprising:
receiving a management identifier that indicates a mobile device is being managed by a management service;
transmitting an access request including the management identifier to the content repository;
determining whether the mobile device can access the resource identifier based on validity of the management identifier and whether the mobile device is in compliance with a configuration profile from the management service, wherein the compliance is checked at the time of receiving the access request; and
denying access to the content repository based on a determination that the mobile device is non-compliant with the configuration profile.
2. The method of claim 1 , wherein the management identifier comprises a certificate.
3. The method of claim 1 , wherein:
transmitting the request further comprises transmitting, in addition to the management identifier, authentication credentials for accessing the content repository.
4. The method of claim 1 , further comprising receiving access based on determining, for a second access request, that the mobile device complies with the configuration profile.
5. The method of claim 4 , further comprising:
determining a subset of content for which access should be granted based on the management identifier and evaluation of compliance with the configuration profile.
6. The method of claim 1 , wherein the access request further comprises an address of a management server.
7. The method of claim 6 , further comprising providing, from the content repository to the management server, the management identifier, wherein the management server determines the validity of the management identifier.
8. The method of claim 1 , wherein receiving access to the content repository is preconditioned on bringing the mobile device into compliance with an encryption policy.
9. A computer-readable medium comprising instructions which, when executed by a processor, perform a method for authorizing access to a cloud-based content repository, comprising:
receiving a management identifier that indicates a mobile device is being managed by a management service;
transmitting an access request including the management identifier to the content repository;
determining whether the mobile device can access the resource identifier based on validity of the management identifier and whether the mobile device is in compliance with a configuration profile received from the management service, wherein the compliance is checked at the time of receiving the access request; and
denying access to the content repository based on a determination that the mobile device is non-compliant with the configuration profile.
10. The computer-readable medium of claim 9 , wherein the management identifier comprises a certificate.
11. The computer-readable medium of claim 9 , wherein transmitting the request further comprises transmitting, in addition to the management identifier, authentication credentials for accessing the content repository.
12. The computer-readable medium of claim 9 , wherein the method further comprises receiving access based on determining, for a second access request, that the mobile device complies with the configuration profile.
13. The computer-readable medium of claim 9 , wherein the method further comprises:
determining a subset of content for which access should be granted based on the management identifier and evaluation of compliance with the configuration profile.
14. The computer-readable medium of claim 9 , wherein:
the access request further comprises an address of a management server, and
the method further comprises providing, from the content repository to the management server, the management identifier, wherein the management server determines the validity of the management identifier.
15. The computer-readable medium of claim 9 , wherein receiving access to the content repository is preconditioned on bringing the mobile device into compliance with an encryption policy.
16. A system for authorizing access to a cloud-based content repository, comprising:
a mobile device;
a content repository; and
a management server, wherein
the mobile device provides a request to access the cloud-based content repository, the request including a management identifier;
the management server receives the management identifier from the cloud-based content repository,
the management server determines whether the management identifier is valid and whether the mobile device is in compliance with a configuration profile received from the management service, wherein the compliance is checked at the time of receiving the access request, and
the mobile device is denied access to the cloud-based content repository, based on a determination that the mobile device is non-compliant with a configuration profile from the management service.
17. The system of claim 16 , wherein the management identifier comprises a certificate.
18. The system of claim 16 , wherein:
the mobile device further provides authentication credentials for accessing the cloud-based content repository, and
the mobile device receives the access to the cloud-based content repository when the authentication credentials are validated.
19. The system of claim 16 , wherein at least one of the management server or the mobile device further:
evaluates, upon generating the request, whether the mobile device complies with the configuration profile.
20. The system of claim 16 , wherein:
the management server further determines a subset of content for which access should be granted based on the management identifier and evaluation of compliance with the configuration profile, and
the mobile devices receives access to the subset of content in the cloud-based content repository.