System and method for proxying federated authentication protocols

1. A computer-implemented method comprising:

at one or more instances of a federated authentication proxy on a server:

receiving a service provider identity request from a service provider;

transmitting a proxy identity request based on the service provider identity request to a configured identity provider;

receiving an identity request assertion from the configured identity provider;

performing a second layer of authentication of the service provider identity request;

determining a proxy identity assertion based on the identity request assertion and results of the second layer of authentication; and

transmitting the proxy identity assertion to the service provider as a response to the service provider identity request.

2. The computer-implemented method of claim 1 , wherein:

the determining the proxy identity assertion includes determining that the service provider identity request is valid when the identity request assertion indicates that the service provider identity request is valid and the second layer of authentication of the service provider identity request is successful.

3. The computer-implemented method of claim 2 , wherein:

the determining the proxy identity assertion includes determining that the service provider identity request is not valid when either the identity request assertion indicates the service provider identity request is not valid or the second layer of authentication of the service provider identity request is unsuccessful.

4. The computer-implemented method of claim 1 , further comprising:

emulating a service provider in a first instance of the federated authentication proxy when receiving the service provider identity request and determining the proxy identity assertion; and

emulating an identity provider in a second instance of the federated authentication proxy when transmitting to and receiving from the configured identity provider.

5. The computer-implemented method of claim 4 , further comprising:

in association with a managing account, configuring the first instance and the second instance of the federated authentication proxy; and

prior to the transmitting the proxy identity request, selecting the second instance according to an identifier of the managing account from the first instance.

6. The computer-implemented method of claim 4 , wherein the first instance and the second instance of the federated authentication proxy are implemented using a security assertion markup language protocol (SAML).

7. The computer-implemented method of claim 4 , wherein the first instance and the second instance of the federated authentication proxy are implemented using an OpenID Connect protocol.

8. An apparatus comprising:

a non-transitory computer readable medium configured to store instructions; and

a processor configured to execute the instructions to implement one or more instances of a federated authentication proxy on a server and to perform:

receiving a service provider identity request from a service provider;

transmitting a proxy identity request based on the service provider identity request to a configured identity provider;

receiving an identity request assertion from the configured identity provider;

performing a second layer of authentication of the service provider identity request;

determining a proxy identity assertion based on the identity request assertion and results of the second layer of authentication; and

transmitting the proxy identity assertion to the service provider as a response to the service provider identity request.

9. The apparatus of claim 8 , wherein the processor is configured to perform the determining the proxy identity assertion by determining that the service provider identity request is valid when the identity request assertion indicates that the service provider identity request is valid and the second layer of authentication of the service provider identity request is successful.

10. The apparatus of claim 9 , wherein the processor is further configured to perform the determining the proxy identity assertion by determining that the service provider identity request is not valid when either the identity request assertion indicates the service provider identity request is not valid or the second layer of authentication of the service provider identity request is unsuccessful.

11. The apparatus of claim 8 , wherein the processor is further configured to perform:

emulating a service provider in a first instance of the federated authentication proxy when receiving the service provider identity request and determining the proxy identity assertion; and

emulating an identity provider in a second instance of the federated authentication proxy when transmitting to and receiving from the configured identity provider.

12. The apparatus of claim 11 , wherein the processor is further configured to perform:

in association with a managing account, configuring the first instance of the federated authentication proxy and the second instance of the federated authentication proxy; and

prior to the transmitting the proxy identity request, selecting the second instance according to an identifier of the managing account from the first instance.

13. The apparatus of claim 11 , wherein the processor is configured to implement the first instance and the second instance of the federated authentication proxy using a security assertion markup language protocol (SAML).

14. The apparatus of claim 11 , wherein the processor is configured to implement the first instance and the second instance of the federated authentication proxy using an OpenID Connect protocol.

15. A non-transitory computer readable medium storing instructions that, when executed by a processor of a proxy server, cause the processor to implement one or more instances of a federated authentication proxy and to perform:

receiving a service provider identity request from a service provider;

transmitting a proxy identity request based on the service provider identity request to a configured identity provider;

receiving an identity request assertion from the configured identity provider;

performing a second layer of authentication of the service provider identity request;

determining a proxy identity assertion based on the identity request assertion and results of the second layer of authentication; and

transmitting the proxy identity assertion to the service provider as a response to the service provider identity request.

16. The non-transitory computer readable medium of claim 15 , wherein the instructions to cause the processor to perform the determining include instructions to cause the processor to perform:

determining that the service provider identity request is valid when the identity request assertion indicates that the service provider identity request is valid and the second layer of authentication of the service provider identity request is successful.

17. The non-transitory computer readable medium of claim 16 , wherein the instructions to cause the processor to perform the determining further include instructions to cause the processor to perform:

determining that the service provider identity request is not valid when either the identity request assertion indicates the service provider identity request is not valid or the second layer of authentication of the service provider identity request is unsuccessful.

18. The non-transitory computer readable medium of claim 15 , further comprising instructions to cause the processor to perform:

emulating a service provider in a first instance of the federated authentication proxy when receiving the service provider identity request and determining the proxy identity assertion; and

emulating an identity provider in a second instance of the federated authentication proxy when transmitting to and receiving from the configured identity provider.

19. The non-transitory computer readable medium of claim 18 , further comprising instructions to cause the processor to perform:

in association with a managing account, configuring the first instance of the federated authentication proxy and the second instance of the federated authentication proxy; and

prior to the transmitting the proxy identity request, selecting the second instance according to an identifier of the managing account from the first instance.

20. The non-transitory computer readable medium of claim 18 , wherein the first instance and the second instance of the federated authentication proxy are implemented using a security assertion markup language protocol (SAML).