Policy based authentication
Methods and systems for expedited authentication for mobile applications are described herein. A user of a mobile device may authenticate with an enterprise system, and thereby be granted access to enterprise applications and services on the mobile device. The user may then activate an application in a managed partition of the mobile device. The application may determine that the enterprise system supports expedited authentication. The application may request expedited authentication, and the request may be compared to policies for expedited authentication. If the request is permitted, the application may be granted access to an authorization code for expedited authentication. The application may then perform the expedited authentication, and the user may be granted access to the application when the expedited authentication has completed.
1. A computer-implemented method comprising:
providing at least one application programming interface (API) absent receipt of data indicative of user authentication, the API configured to enable access to one or more applications of a computing device;
determining an availability of the API based on one or more rules received by the computing device; and
exchanging an authorization code for an access token in response to determining that the API is available, the access token being configured to provide access to an application of the one or more applications.
2. The method of claim 1 , wherein determining the availability of the API comprises comparing a current time to permitted times, in the one or more rules, for accessing the application.
3. The method of claim 1 , wherein determining the availability of the API comprises comparing a current location of the computing device to permitted locations, in the one or more rules, for accessing the application.
4. The method of claim 1 , wherein the application is a secure application executing within a managed partition of a mobile device.
5. The method of claim 1 , wherein the one or more rules indicate one or more time periods during which the application may be accessed.
6. The method of claim 1 , wherein the one or more rules indicate one or more geographic areas in which the application may be accessed.
7. The method of claim 1 , wherein the one or more rules are stored independent of the application.
8. A computer-implemented method comprising:
receiving, in response to an authentication request based on authentication credentials for a client agent, one or more rules for expedited authentication, the authentication credentials corresponding to a user account;
determining, based on the one or more rules, to provide expedited authentication to an application executing within a managed partition of a computing device; and
providing, to the application, an access token authenticating the user account with the application.
9. The method of claim 8 , further comprising:
receiving, from the application, an authorization cookie; and
transmitting, to the application and in response to the authorization cookie, the access token.
10. The method of claim 8 , wherein the determining to provide expedited authentication to the application comprises comparing a current time to permitted times, in the one or more rules, for accessing the application.
11. The method of claim 8 , wherein the determining to provide expedited authentication to the application comprises comparing a current location associated with the user account to permitted locations, in the one or more rules, for accessing the application.
12. The method of claim 8 , wherein the determining is performed based on one or more policy files stored independent of the application.
13. The method of claim 8 , wherein the client agent comprises an application programming interface (API) for expedited authentication.
14. The method of claim 13 , wherein the application communicates with the client agent via the API for expedited authentication.
15. A method comprising:
determining, by an application, that an expedited authentication application programming interface (API) is available at a client agent in response to receipt of a request to activate the application, the application configured to access data within a managed partition of a mobile device;
exchanging, by the application, an authorization code with the client agent to receive an access token; and
authorizing, based on the received access token, access to the application.
16. The method of claim 15 , wherein the application is configured to interact with the expedited authentication API.
17. The method of claim 15 , wherein exchanging the authorization code comprises exchanging, via the expedited authentication API, the authorization code.
18. The method of claim 15 , wherein authorizing the access to the application comprises implementing application settings corresponding to a user account.
19. The method of claim 15 , wherein the determining is performed based on one or more policy files received independent of the application.
20. The method of claim 15 , wherein the client agent provides the application access to the managed partition.