Authentication delegation to support initiation of a secure user workflow from an unsecure device
A disclosed method allows an unsecure device to initiate a user workflow contingent upon access to a permission-controlled resource. The method includes receiving, from the unsecure device, a delegation instruction including: a first token associated with a first entity registered with a cloud service platform; a request to execute an operation on a permission-controlled resource associated with a second entity registered with the cloud service platform; and a user identifier for the second entity. The method includes transmitting a notification to a storage location identified based on the user identifier, the notification includes an instruction that a user can follow to provide an access credential associated with the permission-controlled resource. The method further provides for executing the operation on the permission-controlled resource in response to receiving a second token generated in response to verification of the access credential.
1 . A method, performed by a delegated authenticator, that allows an unsecure device to initialize a user workflow that requires access to a permission-controlled resource, the method comprising:
receiving, from the unsecure device, a delegation instruction including:
a first token associated with a first entity registered with a cloud service platform;
a request to execute an operation on the permission-controlled resource, the execution of the operation being contingent upon receipt and verification of an access credential of a second entity registered with the cloud service platform; and
a user identifier for the second entity;
in response to receipt of the delegation instruction, identify a user account associated with the user identifier and transmit a notification to a storage location associated with the user account, the notification including an instruction that a user can follow to provide the access credential associated with the permission-controlled resource; and
in response to receiving, from a secure device, a second token generated in response to verification of the access credential, executing the operation on the permission-controlled resource without providing the unsecure device with the access credential or with access to the permission-controlled resource.
2 . The method of claim 1 , wherein the permission-controlled resource is a storage account, the delegation instruction further includes a user payload, and the request to perform the operation on the permission-controlled resource includes a request to copy the user payload to the storage account.
3 . The method of claim 2 , wherein the method further includes:
in response to receiving the first token, copying the user payload to a secure temporary storage region provisioned for the first entity; and
in response to receipt of the second token, copying the user payload from the secure temporary storage region to the storage account.
4 . The method of claim 1 , wherein the notification is transmitted to a cloud-based application configured to present the notification on a user interface generated within an application session of a user associated with the user identifier, the user interface being accessible from the secure device.
5 . The method of claim 1 , wherein the notification is transmitted to a communication account associated with the user identifier and wherein the notification includes a URL that links to an access-controlled webpage, wherein access to the access-controlled webpage is contingent upon verification of the access credential in association with the user identifier.
6 . The method of claim 1 , wherein the first token is a device token generated by an authentication provider in response to verifying identity of the unsecure device and the second token is a user token generated by the authentication provider in response to verifying the access credential in association with the user identifier.
7 . The method of claim 1 , wherein the request to execute the operation on the permission-controlled resource includes a request to release a print job from a cloud storage account to a printer.
8 . A system for using an unsecure device to initialize a user workflow that requires access to a permission-controlled resource, the system comprising:
a delegated authenticator stored in memory and executable to:
receive a delegation instruction from the unsecure device, the delegation instruction including:
a first token associated with a first entity registered with a cloud service platform;
a request to execute an operation on the permission-controlled resource, the execution of the operation being contingent upon receipt and verification of an access credential of a second entity registered with the cloud service platform; and
a user identifier for the second entity registered with the cloud service platform;
in response receipt of the delegation instruction, identify a user account associated with the user identifier and transmit a notification to a storage location associated with the user account, the notification including an instruction that a user can follow to provide an access credential associated with the permission-controlled resource; and
in response to receiving, from a secure device, a second token generated by an authenticator provider based on verification of the access credential, executing the operation on the permission-controlled resource without providing the unsecure device with access to access credential or the permission-controlled resource.
9 . The system of claim 8 , wherein the permission-controlled resource is a storage account, the delegation instruction further includes a user payload, and the request to perform the operation on the permission-controlled resource includes a request to copy the user payload to the storage account.
10 . The system of claim 9 , wherein the delegated authenticator is further executable to:
copy the user payload to a secure temporary storage region provisioned for the first entity in response to receiving the first token; and
copy the user payload from the secure temporary storage region to the storage account in response to receipt of the second token.
11 . The system of claim 8 , wherein the delegated authenticator transmits the notification to a cloud-based application configured to present the notification on a user interface generated within an application session of a user associated with the user identifier, the user interface being accessible from the secure device.
12 . The system of claim 8 , wherein the delegated authenticator transmits the notification to a communication account associated with the user identifier and wherein the notification includes a URL that links to an access-controlled webpage of the delegated authenticator, and wherein access to the access-controlled webpage is contingent upon verification of the access credential in association with the user identifier.
13 . The system of claim 8 , wherein the first token is a device token generated by an authentication provider in response to verifying identity of the unsecure device and the second token is a user token generated by the authentication provider in response to verifying the access credential in association with the user identifier.
14 . The system of claim 8 , wherein the request to execute the operation on the permission-controlled resource includes a request to release a print job from a cloud storage account to a printer.
15 . A tangible computer-readable storage media encoding processor-executable instructions for executing a computer process, the computer process comprising:
receiving, from an unsecure device, a delegation instruction including:
a device token associated with a first entity registered for the unsecure device with a cloud service platform;
a request to execute an operation on a permission-controlled resource, the execution of the operation being contingent upon receipt and verification of an access credential of a second entity registered with the cloud service platform; and
a user identifier for the second entity registered with the cloud service platform;
in response receipt of the delegation instruction, identify a user account associated with the user identifier and transmit a notification to a storage location associated with the user account, the notification including an instruction that a user can follow to provide an access credential associated with the permission-controlled resource; and
in response to receiving, from a secure device, a user token generated in response to verification of the access credential, executing the operation on the permission-controlled resource without providing the unsecure device with the access credential or with access to the permission-controlled resource.
16 . The tangible computer-readable storage media of claim 15 , wherein the permission-controlled resource is a storage account, the delegation instruction further includes a user payload, and the request to perform the operation on the permission-controlled resource includes a request to copy the user payload to the storage account.
17 . The tangible computer-readable storage media of claim 16 , wherein the computer process further includes:
in response to receiving the device token, copying the user payload to a secure temporary storage region provisioned for the first entity; and
in response to receiving the user token, copying the user payload from the secure temporary storage region to the storage account.
18 . The tangible computer-readable storage media of claim 15 , wherein the notification is transmitted to a cloud-based application configured to present the notification on a user interface generated during an application session associated with the user identifier, the user interface being accessible from the secure device.
19 . The tangible computer-readable storage media of claim 15 , wherein the notification is transmitted to a communication account associated with the user identifier and wherein the notification includes a URL that links to an access-controlled webpage and wherein access to the access-controlled webpage is contingent upon verification of the access credential in association with the user identifier.
20 . The tangible computer-readable storage media of claim 15 , wherein the request to execute the operation on the permission-controlled resource includes a request to release a print job from a cloud storage account to a printer.