Native single sign-on (SSO) for mobile applications
Systems and methods for enhanced SSO, which can avoid faults in known protocols and standards for access delegation. For example, the enhanced SSO can use a shared security mechanism, such as a keychain or keystore, for sharing vendor identity over mobile applications without some of the pitfalls of using cookies. And, a connector code can bind the mobile applications to each other so that only the enhanced SSO is required for a user to log in to the mobile applications and remain logged in to the applications on one or more mobile devices.
1. A method for enhanced single sign-on for mobile applications, the method comprising:
transmitting, by a first mobile application, a request for an access token for the first mobile application to a remote server;
receiving, by the first mobile application from the remote server, the access token for the first mobile application, a connector code and at least one other token from the remote server in response to the first mobile application's access token request;
storing, by the first mobile application, in a shared security mechanism, the at least one other token and the connector code in a shared security mechanism;
searching, by a second mobile application other than the first mobile application, in the shared security mechanism for the at least one other token and the connector code; and
obtaining, by the second mobile application from the remote server, an access token for the second mobile application using a profile based at least in part on the at least one other token and the connector code received in connection with the first mobile application's authentication.
2. The method of claim 1 wherein the first mobile application's access token request is made by the first mobile application to the remote server which is an authorization server.
3. The method of claim 1 wherein the remote server is a second server.
4. The method of claim 1 wherein the first mobile application and second mobile application are issued by a same vendor.
5. The method of claim 1 wherein the shared security mechanism comprises a keychain.
6. The method of claim 1 wherein the shared security mechanism comprises a keystore.
7. The method of claim 1 wherein the connector code is unique to a specific mobile device.
8. The method of claim 1 wherein the at least one other token identifies a user who is logged in to the first mobile application.
9. The method of claim 8 , further comprising querying, by the second mobile application, the user to determine whether the user accepts use of the at least one other token with the second mobile application, and not using a profile to obtain an access token for the second mobile application without acceptance of use of the at least one other token with the second mobile application by the user.
10. The method of claim 2 , wherein the profile is a profile of a token exchange between the second mobile application and the authorization server.
11. The method of claim 10 , wherein the first mobile application and second mobile application are issued by a same vendor and wherein the method further comprises providing to the authorization server, by the profile, the at least one other token, the connector code, and a client code associated with the same vendor of the first mobile application and the second mobile application.
12. A non-transitory computer-readable storage medium tangibly encoded with computer-executable instructions, that when executed by a processor associated with a computing device, performs a method for enhanced single sign-on for mobile applications, the method comprising:
receiving, by an authorization server and from a first mobile application, a request for an access token for the first mobile application;
returning, by the authorization server, the access token for the first mobile application, a connector code and at least one other token to the first mobile application in response to the first mobile application's access token request, wherein the at least one other token and the connector code are stored in a shared security mechanism accessible by a second mobile application other than the first mobile application;
receiving, by the authorization server and from the second mobile application, a request for an access token for the second mobile application, the request comprising a profile that is based at least in part on the at least one other token and the connector code; and
using, by the authorization server, the profile that is based at least in part on the at least one other token and the connector code to generate an access token for the second mobile application.
13. The non-transitory computer-readable storage medium of claim 12 further comprising sending to the second mobile application, by the authorization server, the access token for the second mobile application, wherein the access token for the second mobile application is stored in the shared security mechanism by the second mobile application.
14. The non-transitory computer-readable storage medium of claim 12 wherein the request for an access token for the first mobile application comprises an authorization code, and the request for an access token for the first mobile application comprises a request to exchange the authorization code for the first mobile application's access token, the connector code and the at least one other token.
15. The non-transitory computer-readable storage medium of claim 12 wherein the connector code is unique to a specific mobile device.
16. A computing device comprising:
a processor; and
a non-transitory computer-readable storage medium for tangibly storing thereon program logic for execution by the processor, the program logic comprising:
executable logic for receiving a request from a first mobile application for an access token for the first mobile application;
executable logic for returning the access token for the first mobile application, a connector code and at least one other token to the first mobile application in response to the first mobile application's access token request, wherein the at least one other token and the connector code are stored in a shared security mechanism accessible by a second mobile application other than the first mobile application;
executable logic for receiving, from the second mobile application, a request for an access token for the second mobile application, the request comprising a profile that is based at least in part on the at least one other token and the connector code; and
executable logic for using the profile that is based at least in part on the at least one other token and the connector code to generate an access token for the second mobile application.
17. The computing device of claim 16 wherein the program logic further comprises executable logic for sending, to the second mobile application, the access token for the second mobile application, wherein the access token for the second mobile application is stored in the shared security mechanism by the second mobile application.
18. The computing device of claim 16 wherein the request for an access token for the first mobile application comprises an authorization code, and the request for access token for the first mobile application comprises a request to exchange the authorization code for the first mobile application's access token, the connector code and the at least one other token.