Access to physical resources based through identity provider
Disclosed are various approaches for providing a virtual badge credential to a user's device that is enrolled with a management service as a managed device. Upon authentication of a user's identity via an identity provider, a virtual badge credential can be provided to an application on the client device. The virtual badge credential can be presented by the client device to access control readers to gain access to physical resources, such as doors and buildings, that are secured by the access control readers.
1. A system for accessing a physical resource comprising:
a client device comprising a processor and a memory; and
a physical access application executable by the client device, the physical access application causing the client device to at least:
initiate authentication of a user account with an identity provider associated with an enterprise, the identity provider authenticating access to a plurality of applications associated with the user account on behalf of the enterprise;
in response to authentication of the user account, obtain a virtual badge credential on behalf of the user account, the virtual badge credential being stored in a physical access control server, the physical access control server storing a plurality of badge credentials associated with user accounts;
store the virtual badge credential in storage accessible to the physical access application;
initiate a personal area network session with an access control reader associated with the physical resource; and
provide an encrypted virtual badge credential generated from the virtual badge credential to the access control reader over the personal area network session, wherein the access control reader determines that access to the physical resource is granted based upon the encrypted virtual badge credential.
2. The system of claim 1 , wherein the access control reader consults an access controller in communication with the physical access control server to determine that access to the physical resource is granted based upon the encrypted virtual badge credential.
3. The system of claim 1 , wherein the physical access application encrypts the virtual badge credential using a public key corresponding to a private key utilized by the access control reader to decrypt the encrypted virtual badge credential.
4. The system of claim 1 , wherein the physical access controller caches the virtual badge credential corresponding to the user account.
5. The system of claim 1 , wherein the virtual badge credential is generated on behalf of the user account by a third party system corresponding to a vendor of the access control reader.
6. The system of claim 1 , wherein the physical access application displays a visual credential on a display of the client device in response to initiating the personal area network session with the access control reader, the visual credential comprising at least one of a barcode in which an indication of the user account is embedded or a photograph of a user corresponding to the user account.
7. The system of claim 1 , wherein the client device is enrolled with a management service as a managed device, and the physical access control server is configured to determine whether the client device complies with at least one compliance policy as a condition of providing access to the physical resource.
8. A method comprising:
initiating authentication of a user account with an identity provider associated with an enterprise, the identity provider authenticating access to a plurality of applications associated with the user account on behalf of the enterprise;
in response to authentication of the user account, obtaining a virtual badge credential on behalf of the user account, the virtual badge credential being stored in a physical access control server, the physical access control server storing a plurality of badge credentials associated with user accounts;
storing the virtual badge credential in storage accessible to the physical access application;
initiating a personal area network session with an access control reader associated with a physical resource; and
providing an encrypted virtual badge credential generated from the virtual badge credential to the access control reader over the personal area network session, wherein the access control reader determines that access to the physical resource is granted based upon the encrypted virtual badge credential.
9. The method of claim 8 , wherein the access control reader consults an access controller in communication with the physical access control server to determine that access to the physical resource is granted based upon the encrypted virtual badge credential.
10. The method of claim 8 , wherein the physical access application encrypts the virtual badge credential using a public key corresponding to a private key utilized by the access control reader to decrypt the encrypted virtual badge credential.
11. The method of claim 8 , wherein the physical access controller caches the virtual badge credential corresponding to the user account.
12. The method of claim 8 , wherein the virtual badge credential is generated on behalf of the user account by a third party system corresponding to a vendor of the access control reader.
13. The method of claim 8 , wherein the physical access application displays a visual credential on a display of a client device in response to initiating the personal area network session with the access control reader, the visual credential comprising at least one of a barcode in which an indication of the user account is embedded or a photograph of a user corresponding to the user account.
14. The method of claim 8 , wherein a client device presenting the virtual badge credential is enrolled with a management service as a managed device, and the physical access control server is configured to determine whether the client device complies with at least one compliance policy as a condition of providing access to the physical resource.
15. A non-transitory computer-readable medium comprising machine-readable instructions, wherein when executed by a processor of at least one computing device, the machine-readable instructions cause the at least one computing device to at least:
initiate authentication of a user account with an identity provider associated with an enterprise, the identity provider authenticating access to a plurality of applications associated with the user account on behalf of the enterprise;
in response to authentication of the user account, obtain a virtual badge credential on behalf of the user account, the virtual badge credential being stored in a physical access control server, the physical access control server storing a plurality of badge credentials associated with user accounts;
store the virtual badge credential in storage accessible to the physical access application;
initiate a personal area network session with an access control reader associated with a physical resource; and
provide an encrypted virtual badge credential generated from the virtual badge credential to the access control reader over the personal area network session, wherein the access control reader determines that access to the physical resource is granted based upon the encrypted virtual badge credential.
16. The non-transitory computer-readable medium of claim 15 , wherein the access control reader consults an access controller in communication with the physical access control server to determine that access to the physical resource is granted based upon the encrypted virtual badge credential.
17. The non-transitory computer-readable medium of claim 15 , wherein the physical access application encrypts the virtual badge credential using a public key corresponding to a private key utilized by the access control reader to decrypt the encrypted virtual badge credential.
18. The non-transitory computer-readable medium of claim 15 , wherein the physical access controller caches the virtual badge credential corresponding to the user account.
19. The non-transitory computer-readable medium of claim 15 , wherein the virtual badge credential is generated on behalf of the user account by a third party system corresponding to a vendor of the access control reader.
20. The non-transitory computer-readable medium of claim 15 , wherein the physical access application displays a visual credential on a display of the at least one computing device in response to initiating the personal area network session with the access control reader, the visual credential comprising at least one of a barcode in which an indication of the user account is embedded or a photograph of a user corresponding to the user account.