Application user single sign-on
Systems and methods are disclosed for accessing protected data. A computing device may have a secured stared storage accessible by two or more applications operating on the mobile device. The computing device may obtain a first token from an authorization service to verify user identity for a first application. The first token may be stored in the shared storage area, and be accessible to one or more applications sharing the storage space. In response to a user attempt to access a web service using a second application, the user identity may be verified using the first token. The authorization service may verify user credentials, and send a second token to the computing device. The second token may be a proxy ticket authorizing access and exchange of protected data between the second application and a web service. The second token may also be stored in the secure storage area.
1 . A system comprising:
a secure storage;
a processor; and
a memory configured to store a set of instructions that, when executed by the processor, cause the system to:
obtain a first token, associated with a user identity for accessing a first application, from a key store configured exclusively for storing cryptographic keys, the key store being hardware-backed and inaccessible for arbitrary identity tokens or application data;
store the first token in the secure storage;
send, to an authorization service, the first token and an identifier of a second application, wherein the identifier of the second application is passed as a parameter to a dynamically constructed authentication URL to enable access for the second application;
receive, from the authorization service, a second token authorizing communication with the second application, wherein the second token is associated with a stronger authentication process than the first token;
replace the first token by overwriting the first token in secure storage with the second token; and
invalidate the first token by transmitting a revocation instruction to the authorization service to disable server-side use of the first token and securely erasing the first token from the secure storage.
2 . The system of claim 1 , wherein the instructions cause the system to:
receive user credentials for a login to the first application;
send the user credentials to the authorization service; and
verify the user credentials at the authorization service.
3 . The system of claim 1 , wherein the secure storage is a keychain on an operating system of the computing device.
4 . The system of claim 1 , wherein the secure storage is shared between two or more applications on the computing device.
5 . The system of claim 1 , wherein at least one of the tokens are valid for a predetermined period of time.
6 . The system of claim 1 , wherein the first token is a proxy granting ticket (PGT).
7 . The system of claim 1 , wherein the second token is a proxy ticket (PT).
8 . A method comprising:
obtaining a first token, associated with a user identity for accessing a first application on a computing device, from a key store configured exclusively for storing cryptographic keys, the key store being hardware-backed and inaccessible for arbitrary identity tokens or application data;
storing the first token in a secure storage on the computing device;
sending, to an authorization service, the first token and an identifier of a second application, wherein the identifier of the second application is passed as a parameter to a dynamically constructed authentication URL to enable access for the second application;
receiving, from the authorization service, a second token authorizing communication with the second application, wherein the second token is associated with a stronger authentication process than the first token;
replacing the first token by overwriting the first token in secure storage with the second token; and
invalidating the first token by transmitting a revocation instruction to the authorization service to disable server-side use of the first token and securely erasing the first token from the secure storage.
9 . The method of claim 8 , comprising:
determining whether the first token is available in the secure storage; and
requesting user credentials if the token is unavailable.
10 . The method of claim 8 , wherein the first token is a proxy granting ticket and the second token is a proxy ticket.
11 . The method of claim 8 , comprising entering a user name and password to obtain the token.
12 . The method of claim 8 , wherein the secure storage is a keychain on an operating system of the computing device.
13 . The method of claim 8 , wherein the secure storage is shared between two or more applications on the computing device.
14 . The method of claim 8 , wherein authorizing a communication with the second application comprises establishing a session for a period of time.
15 . A non-transitory computer-readable storage medium comprising instructions stored thereon that, when executed by a computing device, cause the computing device to at least:
obtain a first token, associated with a user identity for accessing a first application, from a key store configured exclusively for storing cryptographic keys, the key store being hardware-backed and inaccessible for arbitrary identity tokens or application data;
store the first token in a secure storage;
send, to an authorization service, the first token and an identifier of a second application, wherein the identifier of the second application is passed as a parameter to a dynamically constructed authentication URL to enable access for the second application;
receive, from the authorization service, a second token authorizing communication with the second application, wherein the second token is associated with a stronger authentication process than the first token;
replace the first token by overwriting the first token in secure storage with the second token; and
invalidate the first token by transmitting a revocation instruction to the authorization service to disable server-side use of the first token and securely erasing the first token from the secure storage.
16 . The non-transitory computer-readable storage medium of claim 15 , comprising instructions to:
receive user credentials for a log in to the first application;
send the user credentials to the authorization service; and
verify the user credentials at the authorization service.
17 . The non-transitory computer-readable storage medium of claim 15 , wherein the secure storage is a keychain on an operating system of the computing device.
18 . The non-transitory computer-readable storage medium of claim 15 , wherein the secure storage is shared between two or more applications on the computing device.
19 . The non-transitory computer-readable storage medium of claim 15 , wherein at least one of the tokens are valid for a predetermined period of time.
20 . The non-transitory computer-readable storage medium of claim 15 , wherein the first token is a proxy granting ticket and the second token is a proxy ticket.