Automatic sign-in upon account signup
The present embodiments relate to systems and methods for automatic sign in upon account signup. Particularly, the present embodiments can utilize a federated login approach for automatic sign in upon account signup for a cloud infrastructure. Specifically, the signup and sign in service (also known as SOUP) and an identity provider portal can be configured such that the nodes are aware of each other as Security Assertion Markup Language (SAML) partners. After new account registration, the signup service can redirect the user browser to a cloud infrastructure console to start with a federated login flow, where a sign in service can issue a SAML authentication request, and redirects it to signup service. Responsive to validating the browser using a SAML authentication process, the browser can be automatically signed into the new account and allowed access the account relating to the cloud infrastructure service.
1. A method, comprising:
obtaining, by a client computer, a sign-up request, the sign-up request for requesting to sign up a new account to a cloud infrastructure console;
receiving, from a sign on portal, an authentication request message;
forwarding, by the client computer, the authentication request message to authenticate the new account using data included in the sign-up request;
receiving, by the client computer, an authentication response message indicating the authentication of the new account;
forwarding, by the client computer, the authentication response message to the sign on portal;
receiving, from the sign on portal, a security token and an identity token;
providing, by the client computer, the security token and the identity token to the cloud infrastructure console;
receiving, by the client computer, a Secure Password Authentication (SPA) message from the cloud infrastructure console; and
accessing, by the client computer, a secure page at the cloud infrastructure console based at least in part on the SPA message.
2. The method of claim 1 , further comprising:
receiving, from the cloud infrastructure console, a redirect message identifying a sign on portal, wherein redirect message is received responsive to determining that the new account is not authenticated; and
forwarding the redirect message to the sign on portal, wherein the authentication response message is received from the sign on portal responsive to a time duration between the obtaining of the sign-up request and the forwarding of the redirect message to the sign on portal being within a threshold time duration.
3. The method of claim 2 , further comprising:
receiving, from the cloud identity provider portal computer, a first redirect message identifying the cloud infrastructure console; and
forwarding the first redirect message to the cloud infrastructure console, wherein the first redirect message identifying the cloud infrastructure console includes a query string specifying a tenant and a provider for access to cloud identity provider portal computer, and wherein the query string is passed in the redirect message identifying the sign on portal, and wherein the sign on portal generates the authentication request message using the query string.
4. The method of claim 1 , wherein a client web browser is configured to obtain a cookie from the cloud identity provider portal computer with a server side session ID to maintain a server side session with the cloud identity provider portal computer during authentication of the new account.
5. The method of claim 4 , wherein the client web browser is configured to send the cookie to the cloud identity provider portal computer when the authentication request message is forwarded to the cloud identity provider portal computer, wherein the cloud identity provider portal computer is configured to identify a sign up session with the client web browser using the cookie identifying a session ID specifying the sign up session.
6. The method of claim 1 , wherein the authentication request message and the authentication response message are formatted in a Security Assertion Markup Language (SAML).
7. The method of claim 1 , further comprising:
receiving, by the client computer, a first redirect message identifying the cloud infrastructure console;
forwarding the first redirect message to the cloud infrastructure console;
responsive to receiving the first redirect message from the cloud infrastructure console, storing a key pair included in the first redirect message at an indexed database; and
responsive to receiving the security token and the identity token from the sign on portal, storing the security token and the identity token at the indexed database.
8. The method of claim 7 , wherein the authentication request message includes a digital signature of the sign on portal, and the authentication response message includes a digital signature from the cloud identity provider portal computer, and wherein the authentication request message and authentication response message are encrypted using a public key included in the key pair.
9. A client computer comprising:
a processor; and
a computer-readable medium including instructions that, when executed by the processor, cause the processor to:
obtain a sign-up request, the sign-up request for requesting to sign up a new account to a cloud infrastructure console;
receive, from a sign on portal, an authentication request message;
forward the authentication request message to authenticate the new account using data included in the sign-up request;
receive an authentication response message indicating the authentication of the new account;
forward the authentication response message to the sign on portal;
receive, from the sign on portal, a security token and an identity token;
provide the security token and the identity token to the cloud infrastructure console;
receive a Secure Password Authentication (SPA) message from the cloud infrastructure console; and
access a secure page at the cloud infrastructure console based at least in part on the SPA message.
10. The client computer of claim 9 , wherein the processor is further caused to:
receive, from the cloud infrastructure console, a redirect message identifying a sign on portal, wherein redirect message is received responsive to determining that the new account is not authenticated; and
forward the redirect message to the sign on portal, wherein the authentication response message is received from the sign on portal responsive to a time duration between the obtaining of the sign-up request and the forwarding of the redirect message to the sign on portal being within a threshold time duration.
11. The client computer of claim 10 , wherein the processor is further caused to:
receive, from the cloud identity provider portal computer, a first redirect message identifying the cloud infrastructure console; and
forward the first redirect message to the cloud infrastructure console, wherein the first redirect message identifying the cloud infrastructure console includes a query string specifying a tenant and a provider for access to cloud identity provider portal computer, and wherein the query string is passed in the redirect message identifying the sign on portal, and wherein the sign on portal generates the authentication request message using the query string.
12. The client computer of claim 9 , wherein a client web browser is configured to obtain a cookie from the cloud identity provider portal computer with a server side session ID to maintain a server side session with the cloud identity provider portal computer during authentication of the new account.
13. The client computer of claim 12 , wherein the client web browser is configured to send the cookie to the cloud identity provider portal computer when the authentication request message is forwarded to the cloud identity provider portal computer, wherein the cloud identity provider portal computer is configured to identify a sign up session with the client web browser using the cookie identifying a session ID specifying the sign up session.
14. The client computer of claim 9 , wherein the authentication request message and the authentication response message are formatted in a Security Assertion Markup Language (SAML).
15. The client computer of claim 9 , wherein the processor is further caused to:
receiving, by the client computer, a first redirect message identifying the cloud infrastructure console;
forwarding the first redirect message to the cloud infrastructure console;
responsive to receiving the first redirect message from the cloud infrastructure console, storing a key pair included in the first redirect message at an indexed database; and
responsive to receiving the security token and the identity token from the sign on portal, storing the security token and the identity token at the indexed database.
16. A non-transitory computer-readable medium including stored thereon a sequence of instructions that, when executed by one or more processors of a client computer causes the one or more processors to execute the sequence of instructions to perform operations comprising:
obtaining, by a client computer, a sign-up request, the sign-up request for requesting to sign up a new account to a cloud infrastructure console;
receiving, from a sign on portal, an authentication request message;
forwarding, by the client computer, the authentication request message to authenticate the new account using data included in the sign-up request;
receiving, by the client computer, an authentication response message indicating the authentication of the new account;
forwarding, by the client computer, the authentication response message to the sign on portal;
receiving, from the sign on portal, a security token and an identity token;
providing, by the client computer, the security token and the identity token to the cloud infrastructure console;
receiving, by the client computer, a Secure Password Authentication (SPA) message from the cloud infrastructure console; and
accessing, by the client computer, a secure page at the cloud infrastructure console based at least in part on the SPA message.
17. The non-transitory computer-readable medium of claim 16 , wherein a client web browser is configured to obtain a cookie from the cloud identity provider portal computer with a server side session ID to maintain a server side session with the cloud identity provider portal computer during authentication of the new account.
18. The non-transitory computer-readable medium of claim 17 , wherein the client web browser is configured to send the cookie to the cloud identity provider portal computer when the authentication request message is forwarded to the cloud identity provider portal computer, wherein the cloud identity provider portal computer is configured to identify a sign up session with the client web browser using the cookie identifying a session ID specifying the sign up session.
19. The non-transitory computer-readable medium of claim 16 , wherein the authentication request message and the authentication response message are formatted in a Security Assertion Markup Language (SAML).
20. The non-transitory computer-readable medium of claim 16 , wherein the process further includes:
receiving, from a cloud identity provider portal computer, a first redirect message identifying the cloud infrastructure console;
forwarding the first redirect message to the cloud infrastructure console;
responsive to receiving the first redirect message from the cloud infrastructure console, storing a key pair included in the first redirect message at an indexed database; and
responsive to receiving the security token and the identity token from the sign on portal, storing the security token and the identity token at the indexed database.