Pervasive resource identification

1. A method comprising:

receiving, at data processing hardware, an authentication request from a first application service, the authentication request requesting authentication of a user of a user device;

obtaining, at the data processing hardware, device information associated with the user device of the user;

generating, by the data processing hardware, a unique opaque identifier for the user device based on the device information;

obtaining, at the data processing hardware, authentication credentials from the user device, the authentication credentials verifying an identity of the user;

in response to receiving the authentication credentials from the user device:

generating, by the data processing hardware, an authentication token; and

encoding, by the data processing hardware, the unique opaque identifier for the user device into the authentication token;

transmitting, by the data processing hardware, the authentication token to the first application service, the authentication token when received by the first application service allowing the first application service to adjust an interaction with the user device based on the unique opaque identifier;

receiving, at the data processing hardware, a second authentication request from a second application service, the second authentication request requesting authentication of the user of the user device;

obtaining, at the data processing hardware, the device information associated with the user device of the user;

determining, by the data processing hardware, that the device information is associated with the unique opaque identifier of the user device;

generating, by the data processing hardware, a second authentication token;

encoding, by the data processing hardware, the unique opaque identifier into the second authentication token; and

transmitting, by the data processing hardware, the second authentication token to the second application service.

2. The method of claim 1 , wherein:

the first application service determines that the second application service received the same unique opaque identifier as the first application service; and

the first application service determines, based on the unique opaque identifier, that the first application service and the second application service are interacting with the same user device.

3. The method of claim 1 , further comprising:

receiving, by the data processing hardware, an information request from the first application service requesting the device information, the information request including the unique opaque identifier; and

transmitting, by the data processing hardware, to the first application service, at least a portion of the device information associated with the user device of the user based on the unique opaque identifier.

4. The method of claim 1 , further comprising, after receiving the authentication request from the first application service:

transmitting, by the data processing hardware, a credentials request to the user device requesting the authentication credentials and user consent to share the device information associated with the user device with the first application service; and

receiving, by the data processing hardware, a response to the credentials request comprising the authentication credentials and the user consent.

5. The method of claim 1 , wherein the device information comprises at least one of: a web cookie of the user device; an Internet Protocol address of the user device; or an operating system version of the user device.

6. The method of claim 1 , wherein the authentication token comprises a federated identity token.

7. The method of claim 6 , wherein the federated identity token comprises one of an OAuth token or a Security Assertions Markup Language (SAML) token.

8. The method of claim 6 , wherein the federated identity token comprises a proprietary or standards-based federated identity systems token.

9. The method of claim 1 , where encoding the unique opaque identifier into the authentication token comprises adding the unique opaque identifier as an attribute of the authentication token.

10. The method of claim 1 , wherein:

the user is associated with a plurality of user devices, and

each user device of the plurality of user devices is associated with a different unique opaque identifier.

11. A system comprising:

data processing hardware; and

memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising:

receiving an authentication request from a first application service, the authentication request requesting authentication of a user of a user device;

obtaining device information associated with the user device of the user;

generating a unique opaque identifier for the user device based on the device information;

obtaining authentication credentials from the user device, the authentication credentials verifying an identity of the user;

in response to receiving the authentication credentials from the user device:

generating an authentication token; and

encoding the unique opaque identifier for the user device into the authentication token;

transmitting the authentication token to the first application service, the authentication token when received by the first application service allowing the first application service to adjust an interaction with the user device based on the unique opaque identifier;

receiving, at the data processing hardware, a second authentication request from a second application service, the second authentication request requesting authentication of the user of the user device;

obtaining, at the data processing hardware, the device information associated with the user device of the user;

determining, by the data processing hardware, that the device information is associated with the unique opaque identifier of the user device;

generating, by the data processing hardware, a second authentication token;

encoding, by the data processing hardware, the unique opaque identifier into the second authentication token; and

transmitting, by the data processing hardware, the second authentication token to the second application service.

12. The system of claim 11 , wherein:

the first application service determines that the second application service received the same unique opaque identifier as the first application service; and

the first application service determines, based on the unique opaque identifier, that the first application service and the second application service are interacting with the same user device.

13. The system of claim 11 , wherein the operations further comprise:

receiving an information request from the first application service requesting the device information, the information request including the unique opaque identifier; and

transmitting, to the first application service, at least a portion of the device information associated with the user device of the user based on the unique opaque identifier.

14. The system of claim 11 , wherein the operations further comprise, after receiving the authentication request from the first application service:

transmitting a credentials request to the user device requesting the authentication credentials and user consent to share the device information associated with the user device with the first application service; and

receiving a response to a credentials request comprising the authentication credentials and the user consent.

15. The system of claim 11 , wherein the device information comprises at least one of: a web cookie of the user device; an Internet Protocol address of the user device; or an operating system version of the user device.

16. The system of claim 11 , wherein the authentication token comprises a federated identity token.

17. The system of claim 16 , wherein the federated identity token comprises one of an OAuth token or a Security Assertions Markup Language (SAML) token.

18. The system of claim 16 , wherein the federated identity token comprises a proprietary or standards-based federated identity systems token.

19. The system of claim 11 , where encoding the unique opaque identifier into the authentication token comprises adding the unique opaque identifier as an attribute of the authentication token.

20. The system of claim 11 , wherein:

the user is associated with a plurality of user devices, and

each user device of the plurality of user devices is associated with a different unique opaque identifier.