Single sign-on through customer authentication systems
Described herein is a system, method, and non-transitory computer readable medium related to a service provider using a third party identity provider to authenticate a user with improved security. An authentication token is received from the identity provider, and can be verified against internal configuration information. The internal configuration information includes data that is not included in the authentication token, and therefore, is not vulnerable to some security attacks, such as a man-in-the-middle attack. After the authentication token is verified, the internal configuration information and authentication token may be used to create a custom identifier, referred to as an identity ID. The identity ID may be used by the service provider to verify user access to resources.
1. A method of authentication, the method comprising:
receiving by a service provider, based on an attempt by a user device to access a resource, an authentication request from the user device that indicates an identity provider and an entity associated with the user device;
redirecting the authentication request to the identity provider;
receiving from the identity provider, based on the authentication request, an authentication token and user information associated with the user device;
validating the authentication token against internal configuration information of the service provider,
wherein the internal configuration information includes information corresponding to information included in at least one of the authentication token or the user information, and information absent from the authentication token and the user information;
generating, based on the authentication token, the user information, and the internal configuration information, an identity ID; and
enabling, based on the identity ID, the user device to access the resource.
2. The method of claim 1 , further comprising:
receiving from the entity, based on the attempt by the user device to access the resource, a login address and a client ID; and
associating a login context with the login address and the client ID.
3. The method of claim 2 , wherein the receiving the authentication request further comprises:
receiving the authentication request via the login context; and
identifying the login address and client ID based on the login context; and
wherein the redirecting the authentication request further comprises redirecting the authentication request based on the login address and the client ID.
4. The method of claim 1 , wherein the authentication token comprises a user identifier,
wherein the validating the authentication token further comprises verifying that the user identifier is associated with the entity.
5. The method of claim 1 , wherein the generating creating of the identity ID further comprises hashing the authentication token, the user information, and the internal configuration information.
6. The method of claim 5 , wherein the authentication token comprises an entity identifier of the entity;
wherein the internal configuration information comprises an entity name that is different from the entity identifier; and
wherein the user information comprises an account identifier of an account that indicates a resource identifier for the resource.
7. The method of claim 1 , wherein the enabling the user device to access the resource comprises:
identifying, based on the identity ID, authorization information that indicates the resource; and
granting, based on the authorization information indicating the resource, the access to the resource.
8. A system for authentication, the system comprising:
a memory; and
at least one processor coupled to the memory and configured to perform operations comprising:
receiving by a service provider, based on an attempt by a user device to access a resource, an authentication request from the user device that indicates an identity provider and an entity associated with the user device;
redirecting the authentication request to the identity provider;
receiving from the identity provider, based on the authentication request, an authentication token and user information associated with the user device;
validating the authentication token against internal configuration information of the service provider,
wherein the internal configuration information includes information corresponding to information included in at least one of the authentication token or the user information, and information absent from the authentication token and the user information;
generating, based on the authentication token, the user information, and the internal configuration information, an identity ID; and
enabling, based on the identity ID, the user device to access the resource.
9. The system of claim 8 , the operations further comprising:
receiving from the entity, based on the attempt by the user device to access the resource, a login address and a client ID; and
associating a login context with the login address and the client ID.
10. The system of claim 9 , the operations further comprising:
receiving the authentication request via the login context; and
identifying the login address and client ID based on the login context; and
wherein the redirecting the authentication request further comprises redirecting the authentication request based on the login address and the client ID.
11. The system of claim 8 , wherein the authentication token comprises a user identifier,
wherein the validating the authentication token further comprises verifying that the user identifier is associated with the entity.
12. The system of claim 8 , wherein the generating the identity ID further comprises hashing the authentication token, the user information, and the internal configuration information.
13. The system of claim 8 , wherein the enabling the user device to access the resource comprises:
identifying, based on the identity ID, authorization information that indicates the resource; and
granting, based on the authorization information indicating the resource, the access to the resource.
14. A non-transitory computer-readable medium having instructions stored thereon that, when executed by at least one computing device, cause the at least one computing device to perform operations comprising:
receiving by a service provider, based on an attempt by a user device to access a resource, an authentication request from the user device that indicates an identity provider and an entity associated with the user device;
redirecting the authentication request to the identity provider;
receiving from the identity provider, based on the authentication request, an authentication token and user information associated with the user device;
validating the authentication token against internal configuration information of the service provider,
wherein the internal configuration information includes information corresponding to information included in at least one of the authentication token or the user information, and information absent from the authentication token and the user information;
generating, based on the authentication token, the user information, and the internal configuration information, an identity ID; and
enabling, based on the identity ID, the user device to access the resource.
15. The non-transitory computer-readable medium of claim 14 , wherein the operations further comprise:
receiving from the entity, based on the attempt by the user device to access the resource, a login address and a client ID; and
associating a login context with the login address and the client ID.
16. The non-transitory computer-readable medium of claim 15 , wherein the operations further comprise:
receiving the authentication request via the login context; and
identifying the login address and client ID based on the login context; and
wherein the redirecting the authentication request further comprises redirecting the authentication request based on the login address and the client ID.
17. The non-transitory computer-readable medium of claim 14 , wherein the authentication token comprises a user identifier,
wherein the validating the authentication token further comprises verifying that the user identifier is associated with the entity.
18. The non-transitory computer-readable medium of 14 , wherein the generating the identity ID further comprises hashing the authentication token, the user information, and the internal configuration information.
19. The non-transitory computer-readable medium of claim 14 , wherein the authentication token comprises an entity identifier of the entity;
wherein the internal configuration information comprises an entity name that is different from the entity identifier; and
wherein the user information comprises an account identifier of an account that indicates a resource identifier for the resource.
20. The non-transitory computer-readable medium device of claim 14 , wherein the enabling the user device to access the resource comprises:
identifying, based on the identity ID, authorization information that indicates the resource; and
granting, based on the authorization information indicating the resource, the access to the resource.