Multi-device single sign-on

1. A system for multi-device single sign-on (SSO) comprising:

at least one computing device;

a management service executed by the at least one computing device, wherein the management service causes the at least one computing device to at least:

complete enrollment of a client device as a managed device with the management service, the management service configured to communicate with a management component installed on the client device;

in response to a request to access a service that is redirected to an identity provider service, receive a request for a user-and-device token from the client device, the request identifying a user account;

generate the user-and-device token in response to the request; and

transmit the user-and-device token to the client device, wherein the client device provides the user-and-device token to an application on the client device that communicates with the identity provider.

2. The system of claim 1 , wherein the request for the user-and-device token is embedded in a client-side script executed by a browser on the client device.

3. The system of claim 2 , wherein the client-side script makes a request to a localhost port associated with the management component on the client device to obtain the user-and-device token.

4. The system of claim 1 , wherein the management service signs the user-and-device token using a private key corresponding to the management service.

5. The system of claim 4 , wherein the identity provider service validates the user-and-device token using a public key corresponding to the private key before issuing an authentication token to the application.

6. The system of claim 1 , wherein the identity provider issues an authentication token in response to the user account being associated with a SSO session from another device.

7. The system of claim 1 , wherein the identity provider requests credentials associated with the user account from the application in response to the user account not being associated with a SSO session from another device.

8. A non-transitory computer-readable medium comprising machine-readable instructions, wherein the instructions, when executed by at least one processor, cause a computing device to at least:

complete enrollment of a client device as a managed device with a management service, the management service executed remotely from the client device and configured to communicate with a management component installed on the client device;

in response to a request to access a service that is redirected to an identity provider service, receive a request for a user-and-device token from the client device, the request identifying a user account;

generate the user-and-device token in response to the request; and

transmit the user-and-device token to the client device, wherein the client device provides the user-and-device token to an application on the client device that communicates with the identity provider.

9. The non-transitory computer-readable medium of claim 8 , wherein the request for the user-and-device token is embedded in a client-side script executed by a browser on the client device.

10. The non-transitory computer-readable medium of claim 9 , wherein the client-side script makes a request to a localhost port associated with the management component on the client device to obtain the user-and-device token.

11. The non-transitory computer-readable medium of claim 8 , wherein the management service signs the user-and-device token using a private key corresponding to the management service.

12. The non-transitory computer-readable medium of claim 11 , wherein the identity provider service validates the user-and-device token using a public key corresponding to the private key before issuing an authentication token to the application.

13. The non-transitory computer-readable medium of claim 8 , wherein the identity provider issues an authentication token in response to the user account being associated with a single sign-on (SSO) session from another device.

14. The non-transitory computer-readable medium of claim 8 , wherein the identity provider requests credentials associated with the user account from the application in response to the user account not being associated with a single sign-on (SSO) session from another device.

15. A method comprising:

completing enrollment of a client device as a managed device with an management service, the management service executed remotely from the client device and configured to communicate with a management component installed on the client device;

in response to a request to access a service that is redirected to an identity provider service, receiving a request for a user-and-device token from the client device, the request identifying a user account;

generating the user-and-device token in response to the request; and

transmitting the user-and-device token to the client device, wherein the client device provides the user-and-device token to an application on the client device that communicates with the identity provider.

16. The method of claim 15 , wherein the request for the user-and-device token is embedded in a client-side script executed by a browser on the client device.

17. The method of claim 16 , wherein the client-side script makes a request to a localhost port associated with the management component on the client device to obtain the user-and-device token.

18. The method of claim 15 , further comprising signing the user-and-device token using a private key corresponding to the management service.

19. The method of claim 18 , wherein the identity provider service validates the user-and-device token using a public key corresponding to the private key before issuing an authentication token to the application.

20. The method of claim 15 , wherein the identity provider requests credentials associated with the user account from the application in response to the user account not being associated with a single sign-on (SSO) session from another device.