Hybrid authentication systems and methods
Disclosed are hybrid authentication systems and methods that enable users to seamlessly sign-on between cloud-based services and on-premises systems. A cloud-based authentication service receives login credentials from a user and delegates authentication to an on-premises authentication service proxy. The login credentials can be passed by the cloud-based authentication service to the on-premises authentication service proxy, for instance, as an access token in an authentication header. The access token can be a JavaScript Object Notation (JSON) Web Token (JWT) token that is digitally signed using JSON Web Signature. Some embodiments utilize a tunnel connection through which the cloud-based authentication service communicates with the on-premises authentication service proxy. Some embodiments leverage an on-premises identity management system for user management and authentication. In this way, there is no need for a cloud-based system to separately maintain and manage a user identity management system and/or having to sync with an on-premises identity management system.
1. A method for hybrid authentication, the method comprising:
responsive to receipt of credentials of a user from a browser application running on a user device, invoking, by a cloud-based authentication service residing in a cloud computing environment, an on-premises authentication service residing in an enterprise computing environment, wherein the on-premises authentication service authenticates the credentials of the user using an authentication scheme configured for an on-premises repository for which access is requested by the user;
once the credentials of the user are authenticated by the on-premises authentication service residing in the enterprise computing environment, receiving, from the on-premises authentication service by the cloud-based authentication service residing in the cloud computing environment, a user profile for the user;
generating, by the cloud-based authentication service, an authentication code using the user profile for the user;
providing, by the cloud-based authentication service, the authentication code to the browser application running on the user device; and
directing, by the cloud-based authentication service, the browser application running on the user device to a cloud-based application residing in the cloud computing environment, wherein the browser application forwards the authentication code to the cloud-based application and invokes a Representational State Transfer (REST) application programming interface (API) for an on-premises application that manages the on-premises repository, wherein the cloud-based application obtains an access token from the cloud-based authentication service using the authentication code, invokes an on-premises REST API, and passes the access token to the on-premises authentication service residing in the enterprise computing environment, and wherein the on-premises authentication service verifies the access token and impersonates the user in accessing the on-premises repository through the on-premises application.
2. The method according to claim 1 , wherein the browser application is directed to the cloud-based authentication service by the cloud-based application.
3. The method according to claim 1 , wherein the cloud-based authentication service is operable to check with a multitenancy service residing in the cloud computing environment for:
determining whether a tenant associated with the user is configured for hybrid authentication; and
responsive to the tenant being configured for hybrid authentication, directing the browser application to a login page for obtaining the credentials of the user.
4. The method according to claim 1 , wherein the authentication scheme comprises an application programming interface based authentication.
5. The method according to claim 1 , wherein the authentication scheme comprises obtaining a super ticket from a key distribution center.
6. The method according to claim 1 , wherein the on-premises authentication service obtains the user profile for the user using the credentials of the user.
7. The method according to claim 1 , wherein the on-premises authentication service obtains, using the credentials of the user, the user profile for the user from an identity management system operating in the enterprise computing environment.
8. A system for hybrid authentication, the system comprising:
a processor;
a non-transitory computer readable medium; and
instructions stored on the non-transitory computer readable medium and translatable by the processor to provide a cloud-based authentication service in a cloud computing environment, wherein the cloud-based authentication service is adapted for:
responsive to receipt of credentials of a user from a browser application running on a user device, invoking an on-premises authentication service residing in an enterprise computing environment, wherein the on-premises authentication service authenticates the credentials of the user using an authentication scheme configured for an on-premises repository for which access is requested by the user;
once the credentials of the user are authenticated by the on-premises authentication service residing in the enterprise computing environment, receiving, from the on-premises authentication service, a user profile for the user;
generating an authentication code using the user profile for the user;
providing the authentication code to the browser application running on the user device; and
directing the browser application running on the user device to a cloud-based application residing in the cloud computing environment, wherein the browser application forwards the authentication code to the cloud-based application and invokes a Representational State Transfer (REST) application programming interface (API) for an on-premises application that manages the on-premises repository, wherein the cloud-based application obtains an access token from the cloud-based authentication service using the authentication code, invokes an on-premises REST API, and passes the access token to the on-premises authentication service residing in the enterprise computing environment, and wherein the on-premises authentication service verifies the access token and impersonates the user in accessing the on-premises repository through the on-premises application.
9. The system of claim 8 , wherein the browser application is directed to the cloud-based authentication service by the cloud-based application.
10. The system of claim 8 , wherein the cloud-based authentication service is operable to check with a multitenancy service residing in the cloud computing environment for:
determining whether a tenant associated with the user is configured for hybrid authentication; and
responsive to the tenant being configured for hybrid authentication, directing the browser application to a login page for obtaining the credentials of the user.
11. The system of claim 8 , wherein the authentication scheme comprises an application programming interface based authentication.
12. The system of claim 8 , wherein the authentication scheme comprises obtaining a super ticket from a key distribution center.
13. The system of claim 8 , wherein the on-premises authentication service obtains the user profile for the user using the credentials of the user.
14. The system of claim 8 , wherein the on-premises authentication service obtains, using the credentials of the user, the user profile for the user from an identity management system operating in the enterprise computing environment.
15. A computer program product for hybrid authentication, the computer program product comprising a non-transitory computer readable medium storing instructions translatable by a processor to provide a cloud-based authentication service in a cloud computing environment, wherein the cloud-based authentication service is adapted for:
responsive to receipt of credentials of a user from a browser application running on a user device, invoking an on-premises authentication service residing in an enterprise computing environment, wherein the on-premises authentication service authenticates the credentials of the user using an authentication scheme configured for an on-premises repository for which access is requested by the user;
once the credentials of the user are authenticated by the on-premises authentication service residing in the enterprise computing environment, receiving, from the on-premises authentication service, a user profile for the user;
generating an authentication code using the user profile for the user;
providing the authentication code to the browser application running on the user device; and
directing the browser application running on the user device to a cloud-based application residing in the cloud computing environment, wherein the browser application forwards the authentication code to the cloud-based application and invokes a Representational State Transfer (REST) application programming interface (API) for an on-premises application that manages the on-premises repository, wherein the cloud-based application obtains an access token from the cloud-based authentication service using the authentication code, invokes an on-premises REST API, and passes the access token to the on-premises authentication service residing in the enterprise computing environment, and wherein the on-premises authentication service verifies the access token and impersonates the user in accessing the on-premises repository through the on-premises application.
16. The computer program product of claim 15 , wherein the browser application is directed to the cloud-based authentication service by the cloud-based application.
17. The computer program product of claim 15 , wherein the cloud-based authentication service is operable to check with a multitenancy service residing in the cloud computing environment for:
determining whether a tenant associated with the user is configured for hybrid authentication; and
responsive to the tenant being configured for hybrid authentication, directing the browser application to a login page for obtaining the credentials of the user.
18. The computer program product of claim 15 , wherein the authentication scheme comprises an application programming interface based authentication.
19. The computer program product of claim 15 , wherein the authentication scheme comprises obtaining a super ticket from a key distribution center.
20. The computer program product of claim 15 , wherein the on-premises authentication service obtains the user profile for the user using the credentials of the user.