Application extension-based authentication on a device under third party management
Techniques are disclosed to provide application extension-based authentication on a device under third party management. In various embodiments, a unique identifier associated with an authentication app is stored on the device. An app extension framework that enables a native app to request, via an app extension associated with the authentication app, access to a service with which the native app is associated is provided. The authentication app is configured to use the unique identifier to determine a security posture of the device and to grant or deny access to the service based at least in part on the security posture of the device.
1. A device, comprising:
a memory configured to store a unique device identifier associated with an authentication app; and
a processor coupled to the memory and configured to provide an app extension framework that enables a native app to request, via an app extension associated with the authentication app, access to a service with which the native app is associated, the authentication app being configured to use the unique device identifier to determine a security posture of the device and to grant or deny access to the service based at least in part on the security posture of the device;
wherein the authentication app is configured to determine the security posture of the device at least in part by using the unique device identifier to query an access server with which the authentication app is associated; and
wherein the unique device identifier is different from a device vendor-assigned primary device identifier of the device and the access server is configured to map the unique device identifier to the device vendor-assigned primary device identifier of the device; and to use the device vendor-assigned primary device identifier of the device to obtain the security posture of the device from a third party device management server configured to manage the device.
2. The device of claim 1 , wherein the unique device identifier is different from a device vendor-assigned primary device identifier of the device.
3. The device of claim 1 , wherein the unique device identifier comprises a device vendor-assigned primary device identifier of the device.
4. The device of claim 1 , wherein the authentication app is installed on the device by the third party device management server configured to manage the device.
5. The device of claim 4 , wherein the third party device management server is further configured to provide the unique device identifier to the authentication app as installed on the device.
6. The device of claim 1 , wherein the app extension comprises a single sign-on extension.
7. The device of claim 1 , wherein the unique device identifier is different from a device vendor-assigned primary device identifier of the device and an operating system of the device prevents the authentication app from accessing a device vendor-assigned primary device identifier of the device.
8. The device of claim 1 , wherein the processor is further configured to route service access requests generated by the native app to the app extension associated with the authentication app.
9. The device of claim 1 , wherein the security posture is based at least in part on data indicating whether the device has been compromised.
10. The device of claim 1 , wherein the security posture is based at least in part on data indicating whether the service is permitted to be access via the device in a current context associated with the device.
11. The device of claim 1 , wherein the authentication app is configured to grant access at least in part by providing to the native app a token or other access data to access the service.
12. The device of claim 11 , wherein the authentication app receives token or other access data to access the service from an access server with which the authentication app is configured to communicate to determine the security posture of the device.
13. A method, comprising:
storing a unique device identifier associated with an authentication app on a device;
providing an app extension framework that enables a native app to request, via an app extension associated with the authentication app, access to a service with which the native app is associated, the authentication app being configured to use the unique device identifier to determine a security posture of the device and to grant or deny access to the service based at least in part on the security posture of the device;
wherein the authentication app is configured to determine the security posture of the device at least in part by using the unique device identifier to query an access server with which the authentication app is associated; and
wherein the unique device identifier is different from a device vendor-assigned primary device identifier of the device and the access server is configured to map the unique device identifier to the device vendor-assigned primary device identifier of the device; and to use the device vendor-assigned primary device identifier of the device to obtain the security posture of the device from a third party device management server configured to manage the device.
14. The method of claim 13 , wherein the authentication app is installed on the device by the third party device management server configured to manage the device.
15. The method of claim 14 , wherein the third party device management server is further configured to provide the unique device identifier to the authentication app as installed on the device.
16. The method of claim 13 , wherein the authentication app is configured to grant access at least in part by providing to the native app a token or other access data to access the service.
17. The method of claim 16 , wherein the authentication app receives token or other access data to access the service from an access server with which the authentication app is configured to communicate to determine the security posture of the device.
18. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
storing a unique device identifier associated with an authentication app on a device;
providing an app extension framework that enables a native app to request, via an app extension associated with the authentication app, access to a service with which the native app is associated, the authentication app being configured to use the unique device identifier to determine a security posture of the device and to grant or deny access to the service based at least in part on the security posture of the device;
wherein the authentication app is configured to determine the security posture of the device at least in part by using the unique device identifier to query an access server with which the authentication app is associated; and
wherein the unique device identifier is different from a device vendor-assigned primary device identifier of the device and the access server is configured to map the unique device identifier to the device vendor-assigned primary device identifier of the device; and to use the device vendor-assigned primary device identifier of the device to obtain the security posture of the device from a third party device management server configured to manage the device.
19. The computer program product of claim 18 , wherein the authentication app is installed on the device by the third party device management server configured to manage the device.
20. The computer program product of claim 19 , wherein the third party device management server is further configured to provide the unique device identifier to the authentication app as installed on the device.