Single sign-on identity management between local and remote systems

1. A computer-implemented method for providing single sign-on to remote or cloud-based computing resources, comprising:

registering a cloud-based authentication endpoint of a cloud-based directory services system with a local directory services system as an intranet addressed system for allowing access to the cloud-based authentication endpoint from a local network computer requesting access to a cloud-based resource;

requesting, via the local network computer, access to the cloud-based resource;

passing a request from the local network computer to the local directory services system for a service ticket corresponding to an identity for a user on the local directory services system, the service ticket being utilized by the cloud-based directory services system to grant access to the cloud-based resource;

passing the service ticket corresponding to the identity for the user on the local directory services system from the local network computer to the cloud-based authentication endpoint to validate the user associated with the local network computer;

receiving, from the cloud-based directory services system, an indication that the service ticket has been validated by the cloud-based authentication endpoint, wherein the validation of the service ticket is based on user identity information extracted from the service ticket; and

in response to receiving the indication that the service ticket has been validated by the cloud-based authentication endpoint, receiving at the requesting local network computer, authorization to access the requested cloud-based resource.

2. The computer-implemented method of claim 1 , wherein receiving an indication that the service ticket has been validated further comprises receiving identification information and authorization information for the user for receiving authorization to access the requested cloud-based resource.

3. The computer-implemented method of claim 1 , prior to passing the request from the local network computer to the local directory services system for the service ticket associated with the cloud-based directory services system, receiving an authentication error from the cloud-based directory services system.

4. The computer-implemented method of claim 1 , prior to requesting, via a local network computer, access to the cloud-based resource, receiving a sign-on at the local network computer.

5. The computer-implemented method of claim 1 , wherein registering the cloud-based authentication endpoint with the local directory services causes the cloud-based authentication endpoint to be designated as a local device, service or resource accessible by the requesting local network computer via the local network.

6. The computer-implemented method of claim 1 , wherein requesting access to the cloud-based resource comprises passing the request to the cloud-based directory services system.

7. The computer-implemented method of claim 1 , wherein passing the service ticket to the cloud-based authentication endpoint comprises sending an HTTP header including the service ticket.

8. The computer-implemented method of claim 1 , wherein registering the cloud-based authentication endpoint comprises creating a computer identification object for the cloud-based authentication endpoint in the local directory services system.

9. The computer-implemented method of claim 8 , wherein creating the computer identification object for the cloud-based authentication endpoint in the local directory services system includes:

creating the computer identification object in the local directory services system wherein the computer identification object represents the cloud-based authentication endpoint;

linking the computer identification object to the cloud-based authentication endpoint via a password or other secret data item; and

utilizing the linking for creating the service ticket that is passed to the cloud-based authentication endpoint for validation of the service ticket by the cloud-based endpoint for authenticating access by the user via the local network computer to the requested cloud-based resource in response to a single sign-on attempt to the requested cloud-based resource.

10. The computer-implemented method of claim 1 , wherein registering the cloud-based authentication endpoint enables the service ticket to be passed to the cloud-based authentication endpoint as a local endpoint.

11. The computer-implemented method of claim 10 , further comprising creating a unique identifier for the cloud-based authentication endpoint, the unique identifier linking the local directory services system and an associated local device, service or resource with the cloud-based authentication endpoint.

12. The computer-implemented method of claim 11 , wherein creating a unique identifier for associating the cloud-based authentication endpoint with the local directory services system includes creating a service principal name (SPN) for the cloud-based authentication endpoint.

13. The computer-implemented method of claim 10 , wherein registering the cloud-based authentication endpoint with the local directory services system as a local device, service or resource includes registering the cloud-based authentication endpoint with a plurality of local directory services systems as a local device, service or resource in each of the plurality of local directory services systems for allowing a service ticket to be passed from each of the plurality of local directory services systems to the cloud-based authentication endpoint for authenticating a local network computer associated with each of a plurality of local directory network services systems against the cloud-based authentication endpoint.

14. The computer-implemented method of claim 13 , wherein each of the plurality of local directory services systems is associated with a different computing tenant.

15. The computer-implemented method of claim 1 , further comprising:

receiving at the cloud-based authentication endpoint an initial request from the local network computer for access to the cloud-based resource;

returning an authentication error code indicating the initial request cannot be authenticated;

in response to the authentication error code, receiving at the cloud-based authentication endpoint the service ticket from the local directory services system corresponding to the identity for the user on the local directory services system utilizing the local network computer; and

at the cloud-based authentication endpoint, validating the received service ticket and authenticating the user associated with the requesting local network computer for access to the cloud-based resource.

16. A computer-implemented method for providing single sign-on to remote or cloud-based computing resources, comprising:

registering a cloud-based authentication endpoint of a cloud-based directory services system with a local directory services system as an intranet addressed system for allowing access to the cloud-based authentication endpoint from a local network computer requesting access to a cloud-based resource;

in response to a request from the local network computer at the local directory services system for a service ticket corresponding to an identity for a user on the local directory services system, receiving, from the local network computer, at the cloud-based authentication endpoint, the service ticket corresponding to the identity for the user on the local directory services system to validate the user associated with the requesting local network computer;

validating, using the cloud-based authentication endpoint, the user associated with the requesting local network computer, wherein the validating is based on user identity information associated with the service ticket;

providing by the cloud-based directory services system, an indication that the service ticket has been validated; and

in response to receiving the indication that the service ticket has been validated, providing to the requesting local network computer, authorization to access the requested cloud-based resource.

17. The computer-implemented method of claim 16 , wherein validating the user includes generating authorization information for the user for providing authorization to access the requested cloud-based resource.

18. The computer-implemented method of claim 16 , wherein registering the cloud-based authentication endpoint includes linking the cloud-based authentication endpoint with the local directory services system for allowing the cloud-based authentication endpoint to receive the service ticket from the local directory services system associated with the intranet device.

19. The computer-implemented method of claim 16 , wherein registering the cloud-based authentication endpoint comprises registering the cloud-based authentication endpoint with a plurality of local directory services systems as a local device, service or resource for allowing one or more service tickets to be passed from each of the plurality of local directory services systems to the cloud-based authentication endpoint for authenticating a local network computer associated with each of a plurality of local directory network services systems against the cloud-based authentication endpoint.

20. A system comprising:

at least one processor; and

memory coupled to the at least one processor, the memory comprising computer executable instructions that, when executed by the at least one processor, performs a method comprising:

registering a cloud-based authentication endpoint of a cloud-based directory services system with a local directory services system as an intranet addressed system for allowing access to the cloud-based authentication endpoint from a local network computer requesting access to the cloud-based resource;

requesting, via the local network computer, access to the cloud-based resource;

passing a request from the local network computer to the local directory services system for a service ticket corresponding to an identity for a user on the local directory services system, the service ticket being utilized by the cloud-based directory services system to grant access to the cloud-based resource;

passing the service ticket corresponding to the identity for the user on the local directory services system from the local network computer to the cloud-based authentication endpoint for validating the user associated with the local network computer;

receiving, from the cloud-based authentication endpoint, an indication that the service ticket has been validated by the cloud-based directory services system, wherein the validation of the service ticket is based on user identity information extracted from the service ticket; and

in response to receiving the indication that the service ticket has been validated by the cloud-based authentication endpoint, receiving at the requesting local network computer, authorization to access the requested cloud-based resource.