Authentication service
Disclosed are various approaches for relaying and caching authentication credentials. A single sign-on (SSO) token is received, the SSO token representing a user account authenticated with an identity manager. An authentication request is then sent to a service that is federated with the identity manager in response to receipt of the SSO token, the authentication request including the SSO token. An access token is received in response to the authentication request, the access token providing access to the service for the user account authenticated with the identity manager for a predefined period of time. The access token and a link between the access token and the SSO token are then cached.
1. A system for relaying authentication credentials, comprising:
a computing device comprising a processor and a memory; and
machine-readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least:
send an authentication request to a federated service, the authentication request comprising an SSO token associated with a user account;
receive an access token, the access token providing access to the federated service for the user account;
receive a request for the access token from a polling service executing on the computing device, the access token being cached in a data store of the computing device; and
provide the access token to the polling service.
2. The system of claim 1 , wherein the machine-readable instructions, when executed by the processor, further cause the computing device to at least:
receive a refresh token together with the access token;
send the refresh token to the federated service in response to an expiration of the access token; and
receive a second access token, the second access token providing access to the federated service for the user account.
3. The system of claim 1 , wherein the machine-readable instructions, when executed by the processor, further cause the computing device to at least determine whether the request for the access token is valid based at least in part on whether the polling service is authorized to access the access token.
4. The system of claim 1 , wherein the machine-readable instructions, when executed by the processor, further cause the computing device to at least determine that a user associated with the user account is authorized to access the federated service based at least in part on one or more access permissions.
5. The system of claim 1 , wherein the machine-readable instructions, when executed by the processor, further cause the computing device to at least receive the SSO token and an identifier corresponding to the user account.
6. The system of claim 1 , wherein the request for the access token comprises a user identifier corresponding to the user account.
7. The system of claim 1 , wherein the request for the access token comprises an identifier corresponding to the federated service.
8. A method for relaying authentication credentials, comprising:
sending, by a computing device, an authentication request to a federated service, the authentication request comprising an SSO token associated with a user account;
receiving, by the computing device, an access token, the access token providing access to the federated service for the user account;
receiving, by the computing device, a request for the access token from a polling service executing on the computing device, the access token being cached in a data store of the computing device; and
providing, by the computing device, the access token to the polling service.
9. The method of claim 8 , further comprising:
receiving, by the computing device, a refresh token together with the access token;
sending, by the computing device, the refresh token to the federated service in response to an expiration of the access token; and
receiving, by the computing device, a second access token, the second access token providing access to the federated service for the user account.
10. The method of claim 8 , further comprising determining, by the computing device, whether the request for the access token is valid based at least in part on whether the polling service is authorized to access the access token.
11. The method of claim 8 , further comprising determining, by the computing device, that a user associated with the user account is authorized to access the federated service based at least in part on one or more access permissions.
12. The method of claim 8 , further comprising receiving, by the computing device, the SSO token and an identifier corresponding to the user account.
13. The method of claim 8 , wherein the request for the access token comprises a user identifier corresponding to the user account.
14. The method of claim 8 , wherein the request for the access token comprises an identifier corresponding to the federated service.
15. A non-transitory computer-readable medium for relaying authentication credentials, the non-transitory computer-readable medium comprising machine-readable instructions that, when executed by a processor, cause a computing device to at least:
send an authentication request to a federated service, the authentication request comprising an SSO token associated with a user account;
receive an access token, the access token providing access to the federated service for the user account;
receive a request for the access token from a polling service executing on the computing device, the access token being cached in a data store of the computing device; and
provide the access token to the polling service.
16. The non-transitory computer-readable medium of claim 15 , wherein the machine-readable instructions, when executed by the processor, further cause the computing device to at least:
receive a refresh token together with the access token;
send the refresh token to the federated service in response to an expiration of the access token; and
receive a second access token, the second access token providing access to the federated service for the user account.
17. The non-transitory computer-readable medium of claim 15 , wherein the machine-readable instructions, when executed by the processor, further cause the computing device to at least determine whether the request for the access token is valid based at least in part whether the polling service is authorized to access the access token.
18. The non-transitory computer-readable medium of claim 15 , wherein the machine-readable instructions, when executed by the processor, further cause the computing device to at least determine that a user associated with the user account is authorized to access the federated service based at least in part on one or more access permissions.
19. The non-transitory computer-readable medium of claim 15 , wherein the machine-readable instructions, when executed by the processor, further cause the computing device to at least receive the SSO token and an identifier corresponding to the user account.
20. The non-transitory computer-readable medium of claim 15 , wherein the request for the access token comprises at least one of a user identifier corresponding to the user account and an identifier corresponding to the federated service.