Coordinating access authorization across multiple systems at different mutual trust levels
Embodiments presented herein provide a partner authentication (PA) system that coordinates a network-based authorization process for an application. The PA system exchanges a series of messages with the application seeking an access token for a protected resource, an authorization server associated with the resource, and an agent executing on a device accessed by a user who wants the application to access the resource. The PA system and the agent communicate with the authorization server on behalf of the application throughout the authorization process. At the completion of the authorization process, the PA system receives an access token and a refresh token from the server on behalf of the application and sends a partner authorization (PA) token to the application. When the application seeks access to the resource that is available to authorized parties via the resource server, the application sends the PA token to the PA system and receives the access token in return.
1. A method for authenticating with a remote service in a computing system, comprising:
transmitting, from an agent service operating on a user device to an application remote from the user device, an initiation message requesting authorization to access data hosted at a resource server;
receiving, at the agent service from a partner authentication service remote from the user device through the application, a request token used to verify that the application is in communication with the agent service;
validating, by the agent service with the partner authentication service, that the application is in communication with the agent service based on the request token;
transmitting, from the agent service to an authorization server associated with the resource server, a request for an authorization code on behalf of the application;
receiving, at the agent service from the authorization server associated with the resource server, the authorization code; and
transmitting, from the agent service to the partner authentication service, a code-transferal message including the received authorization code to instruct the partner authentication service to retrieve an authentication token for the resource server from the authorization server associated with the resource server.
2. The method of claim 1 , wherein:
the request token is received in a verification request message from the partner authentication service;
the verification request message further includes a uniform resource indicator (URI) associated with the partner authentication service; and
validating, by the agent service with the partner authentication service, that the application is in communication with the agent service comprises transmitting a verification confirmation message including the request token to the partner authentication service at the URI included in the verification request message.
3. The method of claim 1 , further comprising: in response to validating, with the partner authentication service, that the application is in communication with the agent service, receiving, at the agent service from the partner authentication service, a redirection message instructing the agent service to request the authorization code, the redirection message including a uniform resource indicator (URI) associated with the authorization server.
4. The method of claim 1 , wherein the request for the authorization code includes an indication that specified access privileges to the data hosted at the resource server are being requested for the application.
5. The method of claim 1 , wherein receiving the authorization code from the authorization server comprises receiving, at the agent service from the authorization server, an authorization confirmation message including the authorization code and instructions to redirect the agent service to the partner authentication service to transfer the authorization code to the partner authentication service.
6. The method of claim 1 , further comprising:
receiving, at the agent service from the partner authentication service, a response token in response to the code-transferal message; and
transmitting, from the agent service to the application, the response token to allow the application to interact with the remote service through the partner authentication service.
7. The method of claim 1 , further comprising:
transmitting, by the agent service to the application, a request to interact with data hosted at the resource server;
receiving, from the partner authentication service, a request to verify that a valid session exists for a user of the application in response to the request to interact with the data hosted at the resource server; and
verifying, with the partner authentication service, that a valid session exists for a user of an application.
8. A system, comprising:
a processor; and
a memory having instructions stored thereon which, when executed by the processor, performs an operation for authenticating with a remote service in a computing system, the operation comprising:
transmitting, from an agent service operating on a user device to an application remote from the user device, an initiation message requesting authorization to access data hosted at a resource server;
receiving, at the agent service from a partner authentication service remote from the user device through the application, a request token used to verify that the application is in communication with the agent service;
validating, by the agent service with the partner authentication service, that the application is in communication with the agent service based on the request token;
transmitting, from the agent service to an authorization server associated with the resource server, a request for an authorization code on behalf of the application;
receiving, at the agent service from the authorization server associated with the resource server, the authorization code; and
transmitting, from the agent service to the partner authentication service, a code-transferal message including the received authorization code to instruct the partner authentication service to retrieve an authentication token for the resource server from the authorization server associated with the resource server.
9. The system of claim 8 , wherein:
the request token is received in a verification request message from the partner authentication service;
the verification request message further includes a uniform resource indicator (URI) associated with the partner authentication service; and
validating, by the agent service with the partner authentication service, that the application is in communication with the agent service comprises transmitting a verification confirmation message including the request token to the partner authentication service at the URI included in the verification request message.
10. The system of claim 8 , wherein the operation further comprises: in response to validating, with the partner authentication service, that the application is in communication with the agent service, receiving, at the agent service from the partner authentication service, a redirection message instructing the agent service to request the authorization code, the redirection message including a uniform resource indicator (URI) associated with the authorization server.
11. The system of claim 8 , wherein the request for the authorization code includes an indication that specified access privileges to the data hosted at the resource server are being requested for the application.
12. The system of claim 8 , wherein receiving the authorization code from the authorization server comprises receiving, at the agent service from the authorization server, an authorization confirmation message including the authorization code and instructions to redirect the agent service to the partner authentication service to transfer the authorization code to the partner authentication service.
13. The system of claim 8 , wherein the operation further comprises:
receiving, at the agent service from the partner authentication service, a response token in response to the code-transferal message; and
transmitting, from the agent service to the application, the response token to allow the application to interact with the remote service through the partner authentication service.
14. The system of claim 8 , wherein the operation further comprises:
transmitting, by the agent service to the application, a request to interact with data hosted at the resource server;
receiving, from the partner authentication service, a request to verify that a valid session exists for a user of the application in response to the request to interact with the data hosted at the resource server; and
verifying, with the partner authentication service, that a valid session exists for a user of an application.
15. A system, comprising:
a partner authentication service; and
an agent service configured to:
transmit, to an application, an initiation message requesting authorization to access data hosted at a resource server;
receive, from the partner authentication service, a request token used to verify that the application is in communication with the agent service;
validate, with the partner authentication service, that the application is in communication with the agent service based on the request token;
transmit, to an authorization server associated with the resource server, a request for an authorization code on behalf of the application;
receive, from the authorization server associated with the resource server, the authorization code; and
transmit, to the partner authentication service, a code-transferal message including the received authorization code to instruct the partner authentication service to retrieve an authentication token for the resource server from the authorization server associated with the resource server.
16. The system of claim 15 , wherein:
the request token is received in a verification request message from the partner authentication service;
the verification request message further includes a uniform resource indicator (URI) associated with the partner authentication service; and
the agent service is configured to validate that the application is in communication with the agent service by transmitting a verification confirmation message including the request token to the partner authentication service at the URI included in the verification request message.
17. The system of claim 15 , wherein the agent service is further configured to receive, in response to validating that the application is in communication with the agent service, a redirection message instructing the agent service to request the authorization code, the redirection message including a uniform resource indicator (URI) associated with the authorization server.
18. The system of claim 15 , wherein the agent service is configured to receive the authorization code from the authorization server by receiving, at the agent service from the authorization server, an authorization confirmation message including the authorization code and instructions to redirect the agent service to the partner authentication service to transfer the authorization code to the partner authentication service.
19. The system of claim 15 , wherein the agent service is further configured to:
receive, from the partner authentication service, a response token in response to the code-transferal message; and
transmit, to the application, the response token to allow the application to interact with the remote service through the partner authentication service.
20. The system of claim 15 , wherein the agent service is further configured to:
transmit, to the application, a request to interact with data hosted at the resource server;
receive, from the partner authentication service, a request to verify that a valid session exists for a user of the application in response to the request to interact with the data hosted at the resource server; and
verify, with the partner authentication service, that a valid session exists for a user of an application.