Methods for facilitating federated single sign-on (SSO) for internal web applications and devices thereof

1. A method for federated single sign-on (SSO) implemented by a network security system comprising one or more secure proxy apparatuses, identity provider devices, application servers, or client devices, the method comprising:

authenticating a user in response to a request to access a web application received from a client, validating that the authenticated user is authorized to access the web application, and obtaining security attribute data comprising an indication of the accessible web application for the user subsequent to the validation;

forwarding the received access request to an internal application server hosting the web application and receiving an authentication request in response to the forwarded access request; and

generating an SSO token based on the obtained security attribute data and sending the generated SSO token to the internal application server in response to the received authentication request to facilitate access to the web application by the user.

2. The method of claim 1 , wherein the access request is received from the client via an external communication network and forwarded to the internal application server via an internal communication network.

3. The method of claim 1 , further comprising redirecting the client to an identity provider device configured to collect credentials for the user, or sending the credentials for the user extracted from the received access request to the identity provider device, in order to facilitate the authentication of the user.

4. The method of claim 1 , wherein the authentication request is received from the client following redirection of the client for authentication by the internal application server and the method further comprises generating the SSO token based on at least a portion of the obtained security attribute data.

5. The method of claim 1 , further comprising:

initiating an authentication, authorization, and accounting (AAA) query based on contents of the received access request including credentials for the user;

receiving a response to the AAA query; and

authenticating or validating the user based on the received response to the AAA query.

6. A secure proxy apparatus, comprising memory comprising programmed instructions stored thereon and one or more processors configured to be capable of executing the stored programmed instructions to:

authenticate, by a network security device, a user in response to a request to access a web application received from a client, validate that the authenticated user is authorized to access the web application, and obtain security attribute data comprising an indication of the accessible web application for the user subsequent to the validation;

forward, by the network security device, the received access request to an internal application server hosting the web application and receive an authentication request in response to the forwarded access request; and

generate, by the network security device, an SSO token based on the obtained security attribute data and send the generated SSO token to the internal application server in response to the received authentication request to facilitate access to the web application by the user.

7. The secure proxy apparatus of claim 6 , wherein the access request is received from the client via an external communication network and forwarded to the internal application server via an internal communication network.

8. The secure proxy apparatus of claim 6 , wherein the processors are further configured to be capable of executing the stored programmed instructions to redirect, by the network security device, the client to an identity provider device configured to collect credentials for the user, or send the credentials for the user extracted from the received access request to the identity provider device, in order to facilitate the authentication of the user.

9. The secure proxy apparatus of claim 6 , wherein the authentication request is received from the client following redirection of the client for authentication by the internal application server and the processors are further configured to be capable of executing the stored programmed instructions to generate, by the network security device, the SSO token based on at least a portion of the obtained security attribute data.

10. The secure proxy apparatus of claim 6 , wherein the processors are further configured to be capable of executing the stored programmed instructions to:

initiate, by the network security device, an authentication, authorization, and accounting (AAA) query based on contents of the received access request including credentials for the user;

receive, by the network security device, a response to the AAA query; and

authenticate, by the network security device, or validate the user based on the received response to the AAA query.

11. A non-transitory computer readable medium having stored thereon instructions for federated single sign-on (SSO) comprising executable code that, when executed by one or more processors, causes the processors to:

authenticate a user in response to a request to access a web application received from a client, validate that the authenticated user is authorized to access the web application, and obtain security attribute data comprising an indication of the accessible web application for the user subsequent to the validation;

forward the received access request to an internal application server hosting the web application and receive an authentication request in response to the forwarded access request; and

generate an SSO token based on the obtained security attribute data and send the generated SSO token to the internal application server in response to the received authentication request to facilitate access to the web application by the user.

12. The non-transitory computer readable medium of claim 11 , wherein the access request is received from the client via an external communication network and forwarded to the internal application server via internal communication network.

13. The non-transitory computer readable medium of claim 11 , wherein the executable code, when executed by the processors, further causes the processors to redirect the client to an identity provider device configured to collect credentials for the user, or send the credentials for the user extracted from the received access request to the identity provider device, in order to facilitate the authentication of the user.

14. The non-transitory computer readable medium of claim 11 , wherein the authentication request is received from the client following redirection of the client for authentication by the internal application server and the executable code, when executed by the processors, further causes the processors to generate the SSO token based on at least a portion of the obtained security attribute data.

15. The non-transitory computer readable medium of claim 11 , wherein the executable code, when executed by the processors, further causes the processors to:

initiate an authentication, authorization, and accounting (AAA) query based on contents of the received access request including credentials for the user;

receive a response to the AAA query; and

authenticate or validate the user based on the received response to the AAA query.

16. A network security system, comprising one or more secure proxy apparatuses, identity provider devices, application servers, or client devices with memory comprising programmed instructions stored thereon and one or more processors configured to be capable of executing the stored programmed instructions to:

authenticate, by a network security device, a user in response to a request to access a web application received from a client, validate that the authenticated user is authorized to access the web application, and obtain security attribute data comprising an indication of the accessible web application for the user subsequent to the validation;

forward, by the network security device, the received access request to an internal application server hosting the web application and receive an authentication request in response to the forwarded access request; and

generate, by the network security device, an SSO token based on the obtained security attribute data and send the generated SSO token to the internal application server in response to the received authentication request to facilitate access to the web application by the user.

17. The network security system of claim 16 , wherein the access request is received from the client via an external communication network and forwarded to the internal application server via an internal communication network.

18. The network security system of claim 16 , wherein the processors are further configured to be capable of executing the stored programmed instructions to redirect, by the network security device, the client to an identity provider device configured to collect credentials for the user, or send the credentials for the user extracted from the received access request to the identity provider device, in order to facilitate the authentication of the user.

19. The network security system of claim 16 , wherein the authentication request is received from the client following redirection of the client for authentication by the internal application server and the processors are further configured to be capable of executing the stored programmed instructions to generate, by the network security device, the SSO token based on at least a portion of the obtained security attribute data.

20. The network security system of claim 16 , wherein the processors are further configured to be capable of executing the stored programmed instructions to:

initiate, by the network security device, an authentication, authorization, and accounting (AAA) query based on contents of the received access request including credentials for the user;

receive, by the network security device, a response to the AAA query; and

authenticate or validate, by the network security device, the user based on the received response to the AAA query.