Unified workspace for thin, remote, and SAAS applications
Application-manager software authenticates a user of a client device over a channel. The authentication operation is performed using a directory service. The application-manager software presents a plurality of applications in a GUI displayed by the client device. The plurality of applications depends on the authentication, the client device, and the channel. And the plurality of applications includes a thin application and a software-as-a-service (SaaS) application. The application-manager software receives a selection as to an application from the user. If the selection is for the SaaS application, the application-manager software provisions the SaaS application. The provision includes automatically logging the user onto an account with a provider of the SaaS application using a single sign-on and connecting the user to the account so that the user can interact with the SaaS application. If the selection is for the thin application, the application manager software launches the thin application.
1. A method comprising:
receiving a request from a user to initiate a single sign-on session to access a software as a service (SaaS) application that does not support single sign-on authentication;
in response to the request, determining whether a token for the SaaS application can be generated based on an existing user session, comprising:
identifying a user session and determining whether the user session is alive;
in response to determining that the user session is alive, accessing the user's entitlement for the SaaS application and determining whether the user session satisfies policies of the user's entitlement; and
in response to determining that the user session satisfies the user's entitlement policies, creating a token for the SaaS application based on the user session, wherein the token provides access to a random password assigned to the user for single sign-on authentication to the SaaS application; and
using the token to perform single sign-on authentication to access the SaaS application.
2. The method of claim 1 , wherein a device of the user uses the token to perform the single sign-on to the SaaS application during the user session.
3. The method of claim 2 , wherein using the token to perform the single sign-on to the SaaS application comprises using the token to access the password associated with an account of the user and used by the single sign-on service to access the SaaS application.
4. The method of claim 1 , further comprising:
receiving a second request from a second user to initiate a single sign-on session to access a second SaaS application;
determining that a second user session of the second user is not alive;
in response to determining that the second user session is not alive, creating a session object for a new user session and redirecting the second user to a login interface;
performing authentication based on user input to the login interface; and
creating the single sign-on session for the second SaaS application.
5. The method of claim 4 , wherein performing authentication comprises:
receiving an authentication response from an identity provider;
adding session expiration data to the new user session; and
completing the authentication of the second user to the SaaS application.
6. The method of claim 1 , further comprising:
receiving a third request from a third user to initiate a single sign-on session to access the SaaS application;
identifying a third user session of the third user;
determining that the third user session is not valid; and
in response to determining that the third user session is not valid, redirecting to a SaaS service with an error message.
7. A system comprising:
one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
receiving a request from a user to initiate a single sign-on session to access a software as a service (SaaS) application that does not support single sign-on authentication;
in response to the request, determining whether a token for the SaaS application can be generated based on an existing user session, comprising:
identifying a user session and determining whether the user session is alive;
in response to determining that the user session is alive, accessing the user's entitlement for the SaaS application and determining whether the user session satisfies policies of the user's entitlement; and
in response to determining that the user session satisfies the user's entitlement policies, creating a token for the SaaS application based on the user session, wherein the token provides access to a random password assigned to the user for single sign-on authentication to the SaaS application; and
using the token to perform single sign-on authentication to access the SaaS application.
8. The system of claim 7 , wherein a device of the user uses the token to perform the single sign-on to the SaaS application during the user session.
9. The system of claim 8 , wherein using the token to perform the single sign-on to the SaaS application comprises using the token to access an encrypted the password associated with an account of the user and used by the single sign-on service to access the SaaS application.
10. The system of claim 7 , further operable to perform operations comprising:
receiving a second request from a second user to initiate a single sign-on session to access a second SaaS application;
determining that a second user session of the second user is not alive;
in response to determining that the second user session is not alive, creating a session object for a new user session and redirecting the second user to a login interface;
performing authentication based on user input to the login interface; and
creating the single sign-on session for the second SaaS application.
11. The system of claim 10 , wherein performing authentication comprises:
receiving an authentication response from an identity provider;
adding session expiration data to the new user session; and
completing the authentication of the second user to the SaaS application.
12. The system of claim 7 , further operable to perform operations comprising:
receiving a third request from a third user to initiate a single sign-on session to access the SaaS application;
identifying a third user session of the third user;
determining that the third user session is not valid; and
in response to determining that the third user session is not valid, redirecting to a SaaS service with an error message.
13. One or more non-transitory computer storage media encoded with computer program instructions that when executed by one or more computers cause the one or more computers to perform operations comprising:
receiving a request from a user to initiate a single sign-on session to access a software as a service (SaaS) application that does not support single sign-on authentication;
in response to the request, determining whether a token for the SaaS application can be generated based on an existing user session, comprising:
identifying a user session and determining whether the user session is alive;
in response to determining that the user session is alive, accessing the user's entitlement for the SaaS application and determining whether the user session satisfies policies of the user's entitlement; and
in response to determining that the user session satisfies the user's entitlement policies, creating a token for the SaaS application based on the user session, wherein the token provides access to a random password assigned to the user for single sign-on authentication to the SaaS application; and
using the token to perform single sign-on authentication to access the SaaS application.
14. The non-transitory computer storage media of claim 13 , wherein a device of the user uses the token to perform the single sign-on to the SaaS application during the user session.
15. The non-transitory computer storage media of claim 14 , wherein using the token to perform the single sign-on to the SaaS application comprises using the token to access the password associated with an account of the user and used by the single sign-on service to access the SaaS application.
16. The non-transitory computer storage media of claim 13 , wherein the computer program instructions, when executed, further cause the one or more computers to perform operations comprising:
receiving a second request from a second user to initiate a single sign-on session to access a second SaaS application;
determining that a second user session of the second user is not alive;
in response to determining that the second user session is not alive, creating a session object for a new user session and redirecting the second user to a login interface;
performing authentication based on user input to the login interface; and
creating the single sign-on session for the second SaaS application.
17. The non-transitory computer storage media of claim 16 , wherein performing authentication comprises:
receiving an authentication response from an identity provider;
adding session expiration data to the new user session; and
completing the authentication of the second user to the SaaS application.
18. The non-transitory computer storage media of claim 13 , wherein the computer program instructions, when executed, further cause the one or more computers to perform operations comprising:
receiving a third request from a third user to initiate a single sign-on session to access the SaaS application;
identifying a third user session of the third user;
determining that the third user session is not valid; and
in response to determining that the third user session is not valid, redirecting to a SaaS service with an error message.