Multi-device single sign-on
Disclosed are various approaches for extending a single sign-on (SSO) session to multiple devices. If a device is enrolled as a managed device with a management service, a SSO session can be extended to the device if the user has previously authenticated with an identity provider from another device. The user is authenticated on the second device using a user-and-device token issued by the management service with which the device is enrolled as a managed device.
1. A system for multi-device single sign-on (SSO) comprising:
at least one computing device;
a management service executed by the at least one computing device, wherein the management service causes the at least one computing device to at least:
complete enrollment of a client device as a managed device with the management service, the management service configured to communicate with a management component installed on the client device;
in response to a request to access a service that is redirected to an identity provider service, receive a request for a user-and-device token from the management component, the request identifying a user account;
generate the user-and-device token in response to the request; and
transmit the user-and-device token to the management component, wherein the management component provides the user-and-device token to an application on the client device, the application obtaining an authentication token for the service from the identity provider using the user-and-device token.
2. The system of claim 1 , wherein the request for the user-and-device token is embedded in a client-side script executed by a browser on the client device.
3. The system of claim 2 , wherein the client-side script makes a request to a localhost port associated with the management component on the client device to obtain the user-and-device token.
4. The system of claim 1 , wherein the management service signs the user-and-device token using a private key corresponding to the management service.
5. The system of claim 4 , wherein the identity provider service validates the user-and-device token using a public key corresponding to the private key before issuing the authentication token to the application.
6. The system of claim 1 , wherein the identity provider issues the authentication token in response to the user account being associated with a SSO session from another device.
7. The system of claim 1 , wherein the identity provider requests credentials associated with the user account from the application in response to the user account not being associated with a SSO session from another device.
8. A non-transitory computer-readable medium comprising machine-readable instructions, wherein the instructions, when executed by at least one processor, cause a computing device to at least:
complete enrollment of a client device as a managed device with a management service, the management service configured to communicate with a management component installed on the client device;
in response to a request to access a service that is redirected to an identity provider service, receive a request for a user-and-device token from the management component, the request identifying a user account;
generate the user-and-device token in response to the request; and
transmit the user-and-device token to the management component, wherein the management component provides the user-and-device token to an application on the client device, the application obtaining an authentication token for the service from the identity provider using the user-and-device token.
9. The non-transitory computer-readable medium of claim 8 , wherein the request for the user-and-device token is embedded in a client-side script executed by a browser on the client device.
10. The non-transitory computer-readable medium of claim 9 , wherein the client-side script makes a request to a localhost port associated with the management component on the client device to obtain the user-and-device token.
11. The non-transitory computer-readable medium of claim 8 , wherein the management service signs the user-and-device token using a private key corresponding to the management service.
12. The non-transitory computer-readable medium of claim 11 , wherein the identity provider service validates the user-and-device token using a public key corresponding to the private key before issuing the authentication token to the application.
13. The non-transitory computer-readable medium of claim 8 , wherein the identity provider issues the authentication token in response to the user account being associated with a SSO session from another device.
14. The non-transitory computer-readable medium of claim 8 , wherein the identity provider requests credentials associated with the user account from the application in response to the user account not being associated with a SSO session from another device.
15. A method comprising:
completing enrollment of a client device as a managed device with a management service, the management service configured to communicate with a management component installed on the client device;
in response to a request to access a service that is redirected to an identity provider service, receive a request for a user-and-device token from the management component, the request identifying a user account;
generate the user-and-device token in response to the request; and
transmit the user-and-device token to the management component, wherein the management component provides the user-and-device token to an application on the client device, the application obtaining an authentication token for the service from the identity provider using the user-and-device token.
16. The method of claim 15 , wherein the request for the user-and-device token is embedded in a client-side script executed by a browser on the client device.
17. The method of claim 16 , wherein the client-side script makes a request to a localhost port associated with the management component on the client device to obtain the user-and-device token.
18. The method of claim 15 , further comprising signing the user-and-device token using a private key corresponding to the management service.
19. The method of claim 18 , wherein the identity provider service validates the user-and-device token using a public key corresponding to the private key before issuing the authentication token to the application.
20. The method of claim 15 , wherein the identity provider requests credentials associated with the user account from the application in response to the user account not being associated with a SSO session from another device.