Hybrid authentication systems and methods
Disclosed are hybrid authentication systems and methods that enable users to seamlessly sign-on between cloud-based services and on-premises systems. A cloud-based authentication service receives login credentials from a user and delegates authentication to an on-premises authentication service proxy. The login credentials can be passed by the cloud-based authentication service to the on-premises authentication service proxy, for instance, as an access token in an authentication header. The access token can be a JavaScript Object Notation (JSON) Web Token (JWT) token that is digitally signed using JSON Web Signature. Some embodiments utilize a tunnel connection through which the cloud-based authentication service communicates with the on-premises authentication service proxy. Some embodiments leverage an on-premises identity management system for user management and authentication. In this way, there is no need for a cloud-based system to separately maintain and manage a user identity management system and/or having to sync with an on-premises identity management system.
1. A method for hybrid authentication, the method comprising:
receiving, by a cloud-based authentication service from a user device, login credentials of a user associated with a tenant of a cloud computing environment, the cloud-based authentication service running on a first computer operating in the cloud computing environment;
responsive to receipt of the login credentials of the user, invoking, by the cloud-based authentication service through a tunnel connection between a tunnel server operating in the cloud computing environment and a tunnel agent operating in an enterprise computing environment, an on-premises authentication service on a second computer operating in the enterprise computing environment, wherein the invoking including sending an authentication request to the on-premises authentication service through the tunnel connection, the authentication request containing the login credentials of the user, wherein the login credentials of the user is used by the on-premises authentication service to obtain a user profile for the user;
receiving, by the cloud-based authentication service from the on-premises authentication service through the tunnel connection, the user profile for the user;
generating, by the cloud-based authentication service, an authentication code using the user profile;
communicating, by the cloud-based authentication service, the authentication code to a cloud-based application running on the user device, wherein the cloud-based application obtains an access token from the cloud-based authentication service using the authentication code; and
responsive to a request from the cloud-based application, passing, by the cloud-based authentication service to the on-premises authentication service through the tunnel connection, the access token contained in the request from the cloud-based application, wherein the on-premises authentication service verifies the access token, impersonates the user, and processes the request via an on-premises application.
2. The method according to claim 1 , wherein the cloud-based authentication service receives the login credentials of the user through the cloud-based application.
3. The method according to claim 1 , wherein the cloud-based application runs in a browser application on the user device.
4. The method according to claim 1 , wherein passing the access token to the on-premises authentication service comprises making an on-premises application programming interface call to the on-premises authentication service.
5. The method according to claim 1 , wherein the cloud-based authentication service is adapted for:
determining whether the tenant is configured for hybrid authentication which involves both the cloud-based authentication service and the on-premises authentication service; and
responsive to the tenant being configured for hybrid authentication, presenting a login page in a browser on the user device.
6. The method according to claim 1 , wherein the login credentials of the user is used by the on-premises authentication service to obtain the user profile for the user from an on-premises repository operating in the enterprise computing environment.
7. The method according to claim 1 , wherein the login credentials of the user is used by the on-premises authentication service to obtain the user profile for the user from an identity management system operating in the enterprise computing environment.
8. A system for hybrid authentication, the system comprising:
a processor;
a non-transitory computer readable medium; and
stored instructions translatable by the processor to provide a cloud-based authentication service in a cloud computing environment, wherein the cloud-based authentication service is adapted for:
receiving, from a user device, login credentials of a user associated with a tenant of the cloud computing environment;
responsive to receipt of the login credentials of the user, invoking, through a tunnel connection between a tunnel server operating in the cloud computing environment and a tunnel agent operating in an enterprise computing environment, an on-premises authentication service on a second computer operating in the enterprise computing environment, wherein the invoking including sending an authentication request to the on-premises authentication service through the tunnel connection, the authentication request containing the login credentials of the user, wherein the login credentials of the user is used by the on-premises authentication service to obtain a user profile for the user;
receiving, from the on-premises authentication service through the tunnel connection, the user profile for the user;
generating an authentication code using the user profile;
communicating the authentication code to a cloud-based application running on the user device, wherein the cloud-based application obtains an access token from the cloud-based authentication service using the authentication code; and
responsive to a request from the cloud-based application, passing, to the on-premises authentication service through the tunnel connection, the access token contained in the request from the cloud-based application, wherein the on-premises authentication service verifies the access token, impersonates the user, and processes the request via an on-premises application.
9. The system of claim 8 , wherein the cloud-based authentication service receives the login credentials of the user through the cloud-based application.
10. The system of claim 8 , wherein the cloud-based application runs in a browser application on the user device.
11. The system of claim 8 , wherein passing the access token to the on-premises authentication service comprises making an on-premises application programming interface call to the on-premises authentication service.
12. The system of claim 8 , wherein the cloud-based authentication service is further adapted for:
determining whether the tenant is configured for hybrid authentication which involves both the cloud-based authentication service and the on-premises authentication service; and
responsive to the tenant being configured for hybrid authentication, presenting a login page in a browser on the user device.
13. The system of claim 8 , wherein the login credentials of the user is used by the on-premises authentication service to obtain the user profile for the user from an on-premises repository operating in the enterprise computing environment.
14. The system of claim 8 , wherein the login credentials of the user is used by the on-premises authentication service to obtain the user profile for the user from an identity management system operating in the enterprise computing environment.
15. A computer program product for hybrid authentication, the computer program product comprising a non-transitory computer-readable medium storing instructions translatable by a processor to provide a cloud-based authentication service in a cloud computing environment, wherein the cloud-based authentication service is adapted for:
receiving, from a user device, login credentials of a user associated with a tenant of the cloud computing environment;
responsive to receipt of the login credentials of the user, invoking, through a tunnel connection between a tunnel server operating in the cloud computing environment and a tunnel agent operating in an enterprise computing environment, an on-premises authentication service on a second computer operating in the enterprise computing environment, wherein the invoking including sending an authentication request to the on-premises authentication service through the tunnel connection, the authentication request containing the login credentials of the user, wherein the login credentials of the user is used by the on-premises authentication service to obtain a user profile for the user;
receiving, from the on-premises authentication service through the tunnel connection, the user profile for the user;
generating an authentication code using the user profile;
communicating the authentication code to a cloud-based application running on the user device, wherein the cloud-based application obtains an access token from the cloud-based authentication service using the authentication code; and
responsive to a request from the cloud-based application, passing, to the on-premises authentication service through the tunnel connection, the access token contained in the request from the cloud-based application, wherein the on-premises authentication service verifies the access token, impersonates the user, and processes the request via an on-premises application.
16. The computer program product of claim 15 , wherein the cloud-based authentication service receives the login credentials of the user through the cloud-based application.
17. The computer program product of claim 15 , wherein the cloud-based application runs in a browser application on the user device.
18. The computer program product of claim 15 , wherein passing the access token to the on-premises authentication service comprises making an on-premises application programming interface call to the on-premises authentication service.
19. The computer program product of claim 15 , wherein the cloud-based authentication service is further adapted for:
determining whether the tenant is configured for hybrid authentication which involves both the cloud-based authentication service and the on-premises authentication service; and
responsive to the tenant being configured for hybrid authentication, presenting a login page in a browser on the user device.
20. The computer program product of claim 15 , wherein the login credentials of the user is used by the on-premises authentication service to obtain the user profile for the user from an identity management system or an on-premises repository operating in the enterprise computing environment.