Systems and methods for leveraging authentication for cross operating system single sign on (SSO) capabilities

1. A method, comprising:

executing a basic input/output system (BIOS) on a client information handling system in a pre-boot environment before any operating system (OS) is booted to:

receive presented user credentials from a current local user of the client information handling system,

then use the presented user credential to determine whether to authenticate the current local user of the client information handling system,

then, only if it is determined by the BIOS to authenticate the current local user, store sign-on data evidencing successful authentication of the current local user by the BIOS in a local system storage and transmit a request for network access and/or services for the current local user across a network to a first remote network device, and

then receive and store an authentication token received across the network in the client information handling system from the first remote network device in response to the request for network access and/or services; and

then booting an OS on the client information handling system to a post-boot operating environment without requiring the current local user to enter any credentials during the OS booting or the post-boot operating environment, and executing the booted OS to:

retrieve the stored sign-on data from the local system storage,

then attempt to verify that the stored sign-on data retrieved from the local system storage corresponds to data previously stored by the BIOS evidencing successful authentication of the current local user by the BIOS,

then, only if it is determined by the OS to verify the retrieved stored sign-on data, allow post-boot sign-on to the OS and retrieve and provide the stored authentication token across the network from the client information handling system to at least one network service device to obtain access to one or more services of the network service device.

2. The method of claim 1 , where the first network device comprises an authentication server, and where the method further comprises operating the client information handling system in the pre-boot environment to execute the BIOS on the client information handling system to:

transmit a request for service/s across the network to the authentication server only if the current local user is authenticated on the client information handling system by the BIOS; and

then receive the authentication token from the authentication server in response to the request for service/s, and store the received authentication token on non-volatile system storage of the client information handling system.

3. The method of claim 2 , where the request for service/s comprises local user identification information for the current local user; and where the method further comprises:

checking the provided local user identification information versus a user identification database on the authentication server to verify that the current local user is included in the identification database as being authorized to access the requested one or more service/s; and

then providing the authentication token across the network from the authentication server to the client information handling system only if the current local user is determined to be included in the identification database as being authorized to access the requested one or more service/s.

4. The method of claim 2 , where the booting the OS on the client information handling system to a post-boot operating environment further comprises using the booted OS to perform the following without re-authenticating the current local user on the client information handling system:

retrieving the stored authentication token from the non-volatile system storage and providing the retrieved authentication token across the network from the client information handling system to the same or a different authentication server;

receiving a service ticket from the same or the different authentication server to access one or more services of the network service device without re-authenticating the current local user; and

storing the received service ticket in OS cache memory on the client information handling system.

5. The method of claim 4 , further comprising authenticating the provided authentication token from the client information handling system on the same or the different authentication server; and only providing the service ticket from the same or the different authentication server to the client information handling system if the provided authentication token is successfully authenticated.

6. The method of claim 4 , where the first remote network device is a Kerberos authentication server; where the authentication token is a Kerberos ticket-granting ticket (TGT); and where the service ticket is a temporary service ticket that includes an expiration time.

7. The method of claim 4 , where the booting the OS on the client information handling system to a post-boot operating environment further comprises using the booted OS to perform the following without re-authenticating the current local user on the client information handling system:

retrieving the service ticket from the OS cache memory on the client information handling system;

providing the retrieved service ticket across the network to the network service device; and

obtaining access to the one or more services from the network service device in response to the service ticket provided to the network service device.

8. The method of claim 1 , where the one or more services of the network service device comprise at least one of print services, file-sharing services, media-streaming services, cloud storage services, data processing services, virtual machine services, or computer gaming services.

9. The method of claim 1 , where the first remote network device is a Kerberos authentication server; and where the authentication token is a Kerberos ticket-granting ticket (TGT).

10. The method of claim 1 , where the network comprises the Internet or a corporate intranet.

11. The method of claim 1 , where the sign-on data stored by the BIOS comprises a key evidencing successful authentication of the current local user by the BIOS; and

where the method further comprises executing the booted OS to verify the retrieved stored sign-on data with the key.

12. An information handling system, comprising:

at least one programmable integrated circuit; and

non-volatile system storage coupled to the programmable integrated circuit, the system storage comprising one or more non-volatile storage devices;

where the programmable integrated circuit is programmed to execute a basic input/output system (BIOS) in a pre-boot environment before any operating system (OS) is booted to:

receive presented user credentials from a current local user of the client information handling system,

then use the presented user credential to determine whether to authenticate the current local user of the information handling system across a network with a first remote network device,

then, only if it is determined by the BIOS to authenticate the current local user, store sign-on data evidencing successful authentication of the current local user by the BIOS in a local system storage and transmit a request for network access and/or services for the current local user across a network to a first remote network device, and

then receive and store in the system storage an authentication token received across the network in the information handling system from the first remote network device in response to the request for network access and/or services; and

where the programmable integrated circuit is programmed to then boot an OS on the information handling system to a post-boot operating environment without requiring the current local user to enter any credentials during the OS booting or the post-boot operating environment, and executing the booted OS to:

retrieve the stored sign-on data from the local system storage,

then attempt to verify that the stored sign-on data retrieved from the local system storage corresponds to data previously stored by the BIOS evidencing successful authentication of the current local user by the BIOS,

then, only if it is determined by the OS to verify the retrieved stored sign-on data, allow post-boot sign-on to the OS and retrieve and provide the stored authentication token across the network from the information handling system to at least one network service device to obtain access to one or more services of the network service device.

13. The information handling system of claim 12 , where the first network device comprises an authentication server, and where the programmable integrated circuit is programmed to operate in the pre-boot environment to execute the BIOS to:

then transmit a request for service/s across the network to the authentication server only if the current local user is authenticated on the information handling system by the BIOS; and

then receive the authentication token from the authentication server in response to the request for service/s and store the received authentication token on non-volatile system storage of the information handling system.

14. The information handling system of claim 13 , where the request for service/s comprises local user identification information for the current local user.

15. The information handling system of claim 13 , where the programmable integrated circuit is programmed to then boot the OS to a post-boot operating environment and use the booted OS to perform the following without re-authenticating the current local user on the information handling system:

retrieve the stored authentication token from the non-volatile system storage and provide the retrieved authentication token across the network from the information handling system to the same or a different authentication server;

receive a service ticket from the same or the different authentication server to access one or more services of the network service device without re-authenticating the current local user; and

store the received service ticket in OS cache memory on the information handling system.

16. The information handling system of claim 15 , further comprising non-volatile memory and one or more input/output (I/O) devices coupled to the programmable integrated circuit; and where the programmable integrated circuit is programmed to receive the user credentials provided to the BIOS by the current local user via the I/O devices, and to store the received service ticket in the OS cache memory.

17. The information handling system of claim 15 , where the first remote network device is a Kerberos authentication server; where the authentication token is a Kerberos ticket-granting ticket (TGT); and where the service ticket is a temporary service ticket that includes an expiration time.

18. The information handling system of claim 15 , where the programmable integrated circuit is programmed to then use the booted OS to perform the following without re-authenticating the current local user on the information handling system:

retrieve the service ticket from the OS cache memory on the information handling system;

provide the retrieved service ticket across the network to the network service device; and

obtain access to the one or more services from the network service device in response to the service ticket provided to the network service device.

19. The information handling system of claim 12 , where the one or more services of the network service device comprise at least one of print services, file-sharing services, media-streaming services, cloud storage services, data processing services, virtual machine services, or computer gaming services.

20. The information handling system of claim 12 , where the first remote network device is a Kerberos authentication server; and where the authentication token is a Kerberos ticket-granting ticket (TGT).

21. The information handling system of claim 12 , where the network comprises the Internet or a corporate intranet.

22. The information handling system of claim 12 , where the sign-on data stored by the BIOS comprises a key evidencing successful authentication of the current local user by the BIOS; and where the programmable integrated circuit is programmed to execute the booted OS to verify the retrieved stored sign-on data with the key.