Single sign on with multiple authentication factors
The authentication of a client to multiple server resources with a single sign-on procedure using multiple factors is disclosed. One contemplated embodiment is a method in which a login session is initiated with the authentication system of a primary one of the multiple server resources. A first set of login credentials is transmitted thereto, and validated. A token is stored on the client indicating that the initial authentication was successful, which is then used to transition to a secondary one of the multiple resources. A second set of login credentials is also transmitted, and access to the secondary one of the multiple resources is granted on the basis of a validated token and second set of login credentials.
1. A method for authenticating a client to multiple domains of an enterprise computing environment, each of the multiple domains comprising a standalone authentication system, the method comprising:
initiating a login session with a first standalone authentication system of a primary domain of the multiple domains, the primary domain comprising a first set of applications and a first directory, wherein access to the first set of applications is limited to users with existing accounts defined in the first directory;
transmitting a first set of credentials from the client to the first standalone authentication system;
validating the client by the first standalone authentication system based upon the first set of credentials;
storing, on the client, a token received from the first standalone authentication system;
transmitting, during the login session, the token and a second set of login credentials different than the first set of credentials to a secondary domain of the multiple domains subsequent to the transmitting of the first set of credentials to the first standalone authentication system, the secondary domain comprising a second set of applications and a second directory, wherein access to the second set of applications is limited to a subset of the users with existing accounts, wherein the subset is defined in the second directory, wherein the second set of login credentials is transmitted outside of the token and exists on the client prior to the client transmitting the first set of credentials to the first standalone authentication system; and
validating the client by a second standalone authentication system of the secondary domain based upon the transmitted token and the second set of login credentials.
2. The method of claim 1 , wherein the token and the second set of login credentials are transmitted in separate transmissions.
3. The method of claim 1 , wherein the token includes an account identifier associated with a user account on the primary domain and the secondary domain of the multiple domains.
4. The method of claim 1 , wherein the second set of login credentials is a digital certificate.
5. The method of claim 4 , wherein the digital certificate is stored on the client.
6. The method of claim 4 , wherein the digital certificate is stored on an external hardware device readable by the client.
7. The method of claim 4 , wherein the digital certificate is associated with a complementary client application of the second standalone authentication system of the secondary domain.
8. The method of claim 4 , wherein the digital certificate is associated with a client application independent of the second standalone authentication system of the secondary domain.
9. The method of claim 1 , further comprising: transmitting the second set of login credentials from the client to the first standalone authentication system of the primary domain; wherein validating the client to the primary domain is further based upon the second set of login credentials.
10. A method for authenticating a client to multiple domains of an enterprise computing environment, each of the multiple domains comprising a standalone authentication system, comprising:
receiving, during a login session, a first set of credentials from the client to a first standalone authentication system of a primary domain of the multiple domains, the primary domain comprising a first set of applications and a first directory, wherein access to the first set of applications is limited to users with existing accounts defined in the first directory;
validating the client to the primary domain based upon the first set of credentials;
transmitting to the client a token in response to a successful validation of the first set of credentials;
receiving on a secondary domain of the multiple domains, during the login session, the token and a second set of login credentials different from the first set of credentials subsequent to the receiving of the first set of credentials by the first standalone authentication system, the secondary domain comprising a second set of applications and a second directory, wherein access to the second set of applications is limited to a subset of the users with existing accounts, wherein the subset is defined in the second directory, wherein the second set of login credentials is transmitted outside of the token and exists on the client prior to the client transmitting the first set of credentials to the first standalone authentication system; and
validating the client by a second standalone authentication system of the secondary domain based upon the received token and the second set of login credentials.
11. The method of claim 10 , wherein the token and the second set of login credentials are received by the secondary domain through separate transmissions.
12. The method of claim 10 , wherein the token includes an account identifier associated with a user account on the primary domain and the secondary domain of the multiple domains.
13. The method of claim 10 , wherein the second set of login credentials is a digital certificate.
14. The method of claim 13 , wherein the digital certificate is stored on the client.
15. The method of claim 13 , wherein the digital certificate is stored on an external hardware device readable by the client.
16. The method of claim 13 , wherein the digital certificate is associated with a complementary client application of the second standalone authentication system of the secondary domain.
17. The method of claim 13 , wherein the digital certificate is associated with a client application independent of the second standalone authentication system of the secondary domain.
18. The method of claim 10 , further comprising: receiving the second set of login credentials on the primary domain; wherein: validating the client to the primary domain is further based upon the second set of login credentials; and transmitting the token is in response to a successful validation of the second set of login credentials.
19. An article of manufacture comprising a non-transitory program storage medium readable by a computer, the non-transitory program storage medium tangibly embodying one or more programs of instructions executable by the computer to perform a method for authenticating a client to multiple domains of an enterprise computing environment, each of the multiple domains comprising a standalone authentication system, the method comprising:
receiving, during a login session, a first set of credentials from the client to a first standalone authentication system of a primary domain of the multiple domains, the primary domain comprising a first set of applications and a first directory, wherein access to the first set of applications is limited to users with existing accounts defined in the first directory;
validating the client to the primary domain based upon the first set of credentials;
transmitting to the client a token in response to a successful validation of the first set of credentials;
receiving on a secondary domain of the multiple domains, during the login session, the token and a second set of login credentials different from the first set of credentials subsequent to the receiving of the first set of credentials by the first standalone authentication system, the secondary domain comprising a second set of applications and a second directory, wherein access to the second set of applications is limited to a subset of the users with existing accounts, wherein the subset is defined in the second directory, wherein the second set of login credentials is transmitted outside of the token and exists on the client prior to the client transmitting the first set of credentials to the first standalone authentication system; and
validating the client by a second standalone authentication system of the secondary domain based upon the received token and the second set of login credentials.
20. The article of manufacture of claim 19 , wherein the token and the second set of login credentials are received by the secondary domain through separate transmissions.