Hybrid authentication systems and methods
Disclosed are hybrid authentication systems and methods that enable users to seamlessly sign-on between cloud-based services and on-premises systems. A cloud-based authentication service receives login credentials from a user and delegates authentication to an on-premises authentication service proxy. The login credentials can be passed by the cloud-based authentication service to the on-premises authentication service proxy, for instance, as an access token in an authentication header. The access token can be a JavaScript Object Notation (JSON) Web Token (JWT) token that is digitally signed using JSON Web Signature. Some embodiments utilize a tunnel connection through which the cloud-based authentication service communicates with the on-premises authentication service proxy. Some embodiments leverage an on-premises identity management system for user management and authentication. In this way, there is no need for a cloud-based system to separately maintain and manage a user identity management system and/or having to sync with an on-premises identity management system.
1 . A system for hybrid authentication, the system comprising:
a hardware server machine comprising a hardware processor and a non-transitory computer-readable medium storing instructions executable by the hardware processor, the hardware server machine being configured to host a cloud-based authentication service and operating in a cloud computing environment, the cloud computing environment having a cloud-based application; and
a hardware proxy server of the cloud-based authentication service, the hardware proxy server comprising a second hardware processor and a second non-transitory computer-readable medium storing instructions executable by the second hardware processor and deployed on an enterprise network, the enterprise network having an on-premises application;
wherein the cloud-based authentication service, when executed by the hardware processor, is configured for:
in connection with a request to access the on-premises application, receiving credentials of a user from a browser application on a user device;
invoking the hardware proxy server to authenticate the credentials, wherein the hardware proxy server provides a profile of the user once the credentials are authenticated;
generating an authentication code using the profile provided by the hardware proxy server;
providing the authentication code to the browser application;
directing the browser application to the cloud-based application, wherein the browser application provides the authentication code to the cloud-based application for obtaining an access token for accessing the on-premises application; and
providing the access token to the cloud-based application responsive to a message from the cloud-based application containing the authentication code, wherein the cloud-based application sends the access token to the hardware proxy server and wherein the hardware proxy server verifies the access token and processes the request by calling the on-premises application using an impersonated session.
2 . The system of claim 1 , wherein the access token comprises a JavaScript object notation (JSON) Web Token (JWT) token, wherein the JWT token comprises a HyperText Transfer Protocol (HTTP) authentication header, wherein the HTTP authentication header contains a user context, and wherein the impersonated session is established using the user context from the HTTP authentication header.
3 . The system of claim 1 , wherein the enterprise network further comprises a repository and wherein the on-premises application comprises a hardware content server configured for managing content stored in the repository.
4 . The system of claim 3 , wherein the cloud-based authentication service is further configured for determining whether hybrid authentication is enabled for the cloud-based application to connect to the repository.
5 . The system of claim 1 , wherein the enterprise network further comprises an active directory or a key distribution center (KDC) server.
6 . The system of claim 5 , wherein the proxy authenticates the credentials by checking the active directory or obtaining a ticket granting ticket from the KDC server.
7 . The system of claim 1 , wherein the user belongs to multiple groups authorized to access the cloud-based application and wherein the credentials are shared among the multiple groups.
8 . A method for hybrid authentication, the method comprising:
in connection with a request to access an on-premises application in an enterprise network, receiving, by a cloud-based authentication service, credentials of a user from a browser application on a user device, the cloud-based authentication service provided by a server machine operating in a cloud computing environment, the cloud computing environment having a cloud-based application;
invoking, by the cloud-based authentication service, a proxy of the cloud-based authentication service to authenticate the credentials, wherein the proxy of the cloud-based authentication service is deployed on the enterprise network and wherein the proxy provides a profile of the user once the credentials are authenticated;
generating, by the cloud-based authentication service, an authentication code using the profile provided by the proxy;
providing, by the cloud-based authentication service, the authentication code to the browser application;
directing, by the cloud-based authentication service, the browser application to the cloud-based application, wherein the browser application provides the authentication code to the cloud-based application for obtaining an access token for accessing the on-premises application; and
providing, by the cloud-based authentication service, the access token to the cloud-based application responsive to a message from the cloud-based application containing the authentication code, wherein the cloud-based application sends the access token to the proxy and wherein the proxy verifies the access token and processes the request by calling the on-premises application using an impersonated session.
9 . The method according to claim 8 , wherein the access token comprises a JavaScript object notation (JSON) Web Token (JWT) token, wherein the JWT token comprises a HyperText Transfer Protocol (HTTP) authentication header, wherein the HTTP authentication header contains a user context, and wherein the impersonated session is established using the user context from the HTTP authentication header.
10 . The method according to claim 8 , wherein the enterprise network further comprises a repository and wherein the on-premises application comprises a content server configured for managing content stored in the repository.
11 . The method according to claim 10 , wherein the cloud-based authentication service is further configured for determining whether hybrid authentication is enabled for the cloud- based application to connect to the repository.
12 . The method according to claim 8 , wherein the enterprise network further comprises an active directory or a key distribution center (KDC) server.
13 . The method according to claim 12 , wherein the proxy authenticates the credentials by checking the active directory or obtaining a ticket granting ticket from the KDC server.
14 . The method according to claim 8 , wherein the user belongs to multiple groups authorized to access the cloud-based application and wherein the credentials are shared among the multiple groups.
15 . A computer program product for hybrid authentication, the computer program product comprising a non-transitory computer readable medium storing instructions translatable by a processor to provide a cloud-based authentication service in a cloud computing environment, the cloud computing environment having a cloud-based application, wherein the cloud-based authentication service is adapted for:
in connection with a request to access an on-premises application in an enterprise network, receiving credentials of a user from a browser application on a user device, the cloud-based authentication service provided by a server machine operating in a cloud computing environment, the cloud computing environment having a cloud-based application;
invoking a proxy of the cloud-based authentication service to authenticate the credentials, wherein the proxy of the cloud-based authentication service is deployed on the enterprise network and wherein the proxy provides a profile of the user once the credentials are authenticated;
generating an authentication code using the profile provided by the proxy;
providing the authentication code to the browser application;
directing the browser application to the cloud-based application, wherein the browser application provides the authentication code to the cloud-based application for obtaining an access token for accessing the on-premises application; and
providing the access token to the cloud-based application responsive to a message from the cloud-based application containing the authentication code, wherein the cloud-based application sends the access token to the proxy and wherein the proxy verifies the access token and processes the request by calling the on-premises application using an impersonated session.
16 . The computer program product of claim 15 , wherein the access token comprises a JavaScript object notation (JSON) Web Token (JWT) token, wherein the JWT token comprises a HyperText Transfer Protocol (HTTP) authentication header, wherein the HTTP authentication header contains a user context, and wherein the impersonated session is established using the user context from the HTTP authentication header.
17 . The computer program product of claim 15 , wherein the enterprise network further comprises a repository and wherein the on-premises application comprises a content server configured for managing content stored in the repository.
18 . The computer program product of claim 15 , wherein the cloud-based authentication service is further configured for determining whether hybrid authentication is enabled for the cloud-based application to connect to the repository.
19 . The computer program product of claim 15 , wherein the enterprise network further comprises an active directory or a key distribution center (KDC) server.
20 . The computer program product of claim 19 , wherein the proxy authenticates the credentials by checking the active directory or obtaining a ticket granting ticket from the KDC server.