App free authentication across channels
The technology disclosed teaches performing biometric app free authentication or authorization of a user to access a web-based application, with the user interacting with a workstation browser running on a workstation to access the web-based application using built-in resources of a smart/mobile device. A web application uses methods to authenticate and authorize users before the users are permitted to access the application. A demand exists for improving the security and ease of use of authentication and access management. Access management and authentication of users has evolved to more than just entering a username and password. Multi-factor authentication (MFA) is common. The numerous paths involved in authentication use numerous forms of identification of users during the authentication journey. An opportunity arises to combine paths used for non-standard circumstances with device codes and biometrics for users to log into web applications conveniently and securely without installing another app for authentication and authorization.
1 . A method of app free authentication or authorization of a user to access a web-based application, wherein the user is interacting with a workstation browser running on a workstation to access the web-based application and using resources of a smart/mobile device for biometric authentication, including:
using the workstation browser, requesting access to the web-based application and sending an authorization server at least a username;
receiving, at the workstation browser, an encoding of parameters including at least a user code or the username plus a universal resource indicator (URI), and transmitting a version of the encoding to the smart/mobile device;
using the smart/mobile device to process the version of the encoding, including decoding at least the user code or the username plus the URI and using decoded parameters to initiate contact, directly or indirectly, with the authorization server;
receiving a message from the authorization server triggering biometric authentication by the smart/mobile device;
using biometric authentication resources of the smart/mobile device, authenticating the user, signing the message to define a signed message and sending the signed message to the authorization server; and
receiving, at the workstation browser, access to the web-based application, responsive to the signed message.
2 . The method of claim 1 , wherein the version of the encoding transmitted to the smart/mobile device is a QR code.
3 . The method of claim 2 , wherein the QR code encodes the user code, the username and the URI.
4 . The method of claim 1 , wherein the version of the encoding transmitted to the smart/mobile device is by near field communications (NFC) or Bluetooth.
5 . The method of claim 1 , wherein the URI is a universal resource locator (URL).
6 . The method of claim 1 , further including in the encoding received at the workstation browser both the URI and a universal resource locator (URL).
7 . The method of claim 1 , further including in the encoding received at the workstation browser the user code, the username and the URI assigned by the authorization server.
8 . A method of app free authentication or authorization by an authorization server of a user to access a web-based application using a workstation browser running on a workstation, and further using resources of a smart/mobile device for biometric authentication, including:
receiving at the authorization server a request from the workstation browser for access to the web-based application, the request including at least a username of the user;
sending the workstation browser an encoding of parameters including at least a user code or the username plus a universal resource indicator (URI), in a format suitable for transmission to the smart/mobile device;
receiving from the smart/mobile device a call made to the URI to initiate biometric authentication by the smart/mobile device;
sending the smart/mobile device approval to proceed with biometric authentication for access to the web-based application;
receiving a signed message from the smart/mobile device indicating successful biometric authentication using the resources of the smart/mobile device, authenticating the user responsive to the signed message and generating a token held by the authorization server that authorizes the workstation browser to access the web-based application; and
sending the workstation browser a redirection for access to the web-based application.
9 . The method of claim 8 , wherein the encoding sent to the workstation browser for transmission to the smart/mobile device is a QR code.
10 . The method of claim 9 , wherein the QR code encodes the user code, the username and the URI.
11 . The method of claim 8 , wherein the encoding sent to the workstation browser for transmission to the smart/mobile device is by near field communications (NFC) or Bluetooth.
12 . The method of claim 8 , wherein the URI is a universal resource locator (URL).
13 . The method of claim 8 , further including in the encoding sent to the workstation browser both the URI and a universal resource locator (URL).
14 . The method of claim 8 , further including in the encoding sent to the workstation browser the user code, the username and the URI assigned by the authorization server.
15 . A non-transitory computer readable media impressed with instructions that, when executed on processing hardware of a workstation and a smart/mobile device, cause the processing hardware to implement actions for app free authentication or authorization for a user to access a web-based application, wherein the user is interacting with a workstation browser running on the workstation to access the web-based application and using resources of the smart/mobile device for biometric authentication, the actions including:
using the workstation browser, requesting access to the web-based application and sending an authorization server at least a username;
receiving at the workstation browser an encoding of parameters including at least a user code or the username plus a universal resource indicator (URI), and transmitting a version of the encoding to the smart/mobile device;
using the smart/mobile device to process the version of the encoding, including decoding at least the user code or the username plus the URI and using decoded parameters to initiate contact, directly or indirectly, with the authorization server;
receiving a message from the authorization server triggering biometric authentication by the smart/mobile device;
using biometric authentication resources of the smart/mobile device, authenticating the user, signing the message to define a signed message and sending the signed message to the authorization server; and
receiving, at the workstation browser, access to the web-based application, responsive to the signed message.
16 . The non-transitory computer readable media of claim 15 , wherein the version of the encoding sent to the workstation browser for transmission to the smart/mobile device is a QR code.
17 . A computer system including a workstation having memory, a workstation browser, and a smart/mobile device, wherein the non-transitory computer readable media of claim 15 includes the memory of the workstation and memory of the smart/mobile device holding respective parts of the instructions.
18 . The computer system of claim 17 , wherein a version of the encoding implemented by the instructions to be sent to the workstation browser for transmission to the smart/mobile device is a QR code.
19 . A non-transitory computer readable media impressed with instructions that, when executed on processing hardware of a workstation and a smart/mobile device, cause the processing hardware to implement actions for app free authorization by an authorization server of a user to access a web-based application using a workstation browser running on the workstation and using resources of the smart/mobile device for biometric authentication, the actions including:
receiving at the authorization server a request from the workstation browser for access to the web-based application, the request including at least a username of the user;
sending the workstation browser an encoding of parameters including at least a user code or the username plus a universal resource indicator (URI), in a format suitable for transmission to the smart/mobile device;
receiving from the smart/mobile device a call made to the URI to initiate biometric authentication by the smart/mobile device;
sending the smart/mobile device approval to proceed with biometric authentication for access to the web-based application;
receiving a signed message from the smart/mobile device indicating successful biometric authentication using the resources of the smart/mobile device, authenticating the user responsive to the signed message and generating a token held by the authorization server that authorizes the workstation browser to access the web-based application; and
sending the workstation browser a redirection for access to the web-based application.
20 . The non-transitory computer readable media of claim 19 , wherein a version of the encoding sent to the workstation browser for transmission to the smart/mobile device is a QR code.
21 . A computer system including the authorization server having memory, wherein the non-transitory computer readable media of claim 19 includes the memory of the authorization server holding the instructions.
22 . The computer system of claim 21 , wherein a version of the encoding implemented by the instructions to be sent to the workstation browser for transmission to the smart/mobile device is a QR code.