Application user single sign-on
Systems and methods are disclosed for accessing protected data. A computing device may have a secured stared storage accessible by two or more applications operating on the mobile device. The computing device may obtain a first token from an authorization service to verify user identity for a first application. The first token may be stored in the shared storage area, and be accessible to one or more applications sharing the storage space. In response to a user attempt to access a web service using a second application, the user identity may be verified using the first token. The authorization service may verify user credentials, and send a second token to the computing device. The second token may be a proxy ticket authorizing access and exchange of protected data between the second application and a web service. The second token may also be stored in the secure storage area.
1. A system for accessing protected data, the system comprising:
a secure storage that is established in response to downloading an application onto a computing device;
a processor; and
a memory storing a set of instructions that, when executed by the processor, cause the system to at least:
obtain a first token associated with a user identity for accessing a first application;
store the first token in the secure storage;
send, to an authorization service, the first token, an identifier of a second application, and a device identifier;
receive, from the authorization service, a second token authorizing communication between the second application and a web service;
store the second token in the secure storage to replace the first token; and
access, from the web service, protected data associated with the user identity.
2. The system of claim 1 , wherein the instructions cause the system to:
receive user credentials for a login to the first application;
send the user credentials to the authorization service; and
verify the user credentials at the authorization service.
3. The system of claim 1 , wherein the secure storage is a keychain on an operating system of the computing device.
4. The system of claim 1 , wherein the secure storage is shared between two or more applications on the computing device.
5. The system of claim 1 , wherein at least one of the tokens are valid for a predetermined period of time.
6. The system of claim 1 , wherein the first token is a proxy granting ticket (POT).
7. The system of claim 1 , wherein the second token is a proxy ticket (PT).
8. A method for accessing protected data, comprising:
obtaining a first token associated with a user identity for accessing a first application on a computing device;
storing the first token in a secure storage on the computing device, wherein the secure storage is established in response to downloading an application on the computing device;
sending, to an authorization service, the first token, an identifier of a second application, and a computing device identifier;
receiving, from the authorization service, a second token authorizing communication between the second application and a web service;
storing the second token in the secure storage to replace the first token; and
accessing, from the web service, protected data associated with the user identity.
9. The method of claim 8 , further comprising:
determining whether the first token is available in the secure storage; and
requesting user credentials if the token is unavailable.
10. The method of claim 8 , wherein the first token is a proxy granting ticket and the second token is a proxy ticket.
11. The method of claim 8 , comprising entering a user name and password to obtain the token.
12. The method of claim 8 , wherein the secure storage is a keychain on an operating system of the computing device.
13. The method of claim 8 , wherein the secure storage is shared between two or more applications on the computing device.
14. The method of claim 8 , wherein authorizing a communication between the second application and the web service comprises establishing a session for a period of time.
15. A non-transitory computer-readable storage medium comprising instructions stored thereon that, when executed by a computing device, cause the computing device to at least:
obtain a first token associated with a user identity for accessing a first application;
store the first token in a secure storage, wherein the secure storage is established in response to downloading an application on the computing device;
send, to an authorization service, the first token, an identifier of a second application, and a device identifier;
receive, from the authorization service, a second token authorizing communication between the second application and a web service;
store the second token in the secure storage to replace the first token; and
access, from the web service, protected data associated with the user identity.
16. The non-transitory computer-readable storage medium of claim 15 , comprising instructions to:
receive user credentials for a log in to the first application;
send the user credentials to the authorization service; and
verify the user credentials at the authorization service.
17. The non-transitory computer-readable storage medium of claim 15 , wherein the secure storage is a keychain on an operating system of the computing device.
18. The non-transitory computer-readable storage medium of claim 15 , wherein the secure storage is shared between two or more applications on the computing device.
19. The non-transitory computer-readable storage medium of claim 15 , wherein at least one of the tokens are valid for a predetermined period of time.
20. The non-transitory computer-readable storage medium of claim 15 , wherein the first token is a proxy granting ticket and the second token is a proxy ticket.