Single sign-on from desktop to network
Methods, systems, computer-readable media, and apparatuses method for performing single sign on for a user device to the Internet. User sign-in credentials including an identity token of the user are received by a hosted desktop from the user device, including an indication that the user is attempting to access a website. The website is authorized as a trusted website by a network authorization node, and the website is issued a one-time-use token. A web browser of the hosted desktop receives an application provided by the website to cause the web browser to call the hosted desktop to initiate single sign on. Authenticity of the one-time-use token is requested by a daemon process, and the website's public key is obtained. Upon verifying authenticity of the web site, the identity token of the user is passed to the website, to enable the website to establish single sign on with the user.
1. A method for performing Single Sign On (SSO) for a user, comprising:
receiving, by a hosted desktop via a network connection with a user device, user sign-in credentials including an identity token of the user;
monitoring for activity on one or more ports on a local host interface;
receiving, by the hosted desktop, an indication that a web browser on the hosted desktop is being operated by the user to access a website;
receiving, by the web browser on the hosted desktop from the website, a one-time-use token and computer code executable by the hosted desktop, wherein the computer code is configured to cause the web browser to make a call to the local host interface to initiate a single sign on from the hosted desktop into the website;
detecting, via the monitoring of the one or more ports of the local host interface, the call;
in response to the detecting of the call on the one or more ports of the local host interface, determining authenticity of the one-time-use token with a network authentication node, and retrieving a public key of the website from the network authentication node when the one-time-use token is determined to be authentic;
providing, to the web browser, the identity token of the user in response to determining that the one-time-use token is authentic; and
providing, by the web browser to the website, the identity token of the user to establish a single-sign on by the user with the website.
2. The method of claim 1 , further comprising, after the receiving the indication by the hosted desktop, and prior to the receiving by the web browser of the one-time-use token:
receiving, by the website from the network authentication node, an indication that the website is a trusted website, and
receiving, by the website from the network authentication node, the one-time-use token.
3. The method of claim 1 , wherein the providing the identity token of the user further comprises:
encrypting the identity token of the user with a public key of the website.
4. The method of claim 3 , wherein the providing further comprises:
storing the identity token of the user in a secure store of the hosted desktop in response to the hosted desktop receiving the user sign-in credentials from the user device; and
obtaining the identity token of the user from the secure store accessible by the hosted desktop.
5. The method of claim 3 , further comprising:
decrypting, by the website, the identity token of the user using a private key of the website.
6. The method of claim 1 , wherein the network connection between the user device with the hosted desktop is a virtualization connection using the Internet.
7. The method of claim 1 , wherein the computer code executable by the hosted desktop comprises a JavaScript program executable by the web browser.
8. The method of claim 1 , wherein the call comprises an asynchronous JavaScript and XML (AJAX) call.
9. The method of claim 1 , wherein the monitoring for activity on one or more ports of the hosted desktop comprises monitoring localhost network ports.
10. The method of claim 1 , further comprising:
initiating a monitoring process on the hosted desktop in response to receiving the user sign-in credentials.
11. The method of claim 10 , further comprising:
in response to the providing the identity token of the user, stopping the monitoring process on the hosted desktop.
12. One or more non-transitory computer-readable media storing instructions for performing single sign-on for a user, the instructions, when executed by a system that includes at least one processor and a memory, cause the system to:
receive, by a hosted desktop via a network connection with a user device, user sign-in credentials including an identity token of the user;
monitor for activity on one or more ports on a local host interface;
receive, by the hosted desktop, an indication that a web browser on the hosted desktop is being operated by the user to access a website;
receive, by the web browser on the hosted desktop from the website, a one-time-use token and computer code executable by the hosted desktop, wherein the computer code is configured to cause the web browser to make a call to the local host interface to initiate a single sign on from the hosted desktop into the website;
detect, via the monitoring of the one or more ports of the local host interface, the call;
in response to the detect of the call on the one or more ports of the local host interface, determine authenticity of the one-time-use token with a network authentication node, and retrieve a public key of the website from the network authentication node when the one-time-use token is determined to be authentic;
provide, to the web browser, the identity token of the user in response to determining that the one-time-use token is authentic; and
provide, by the web browser to the website, the identity token of the user to establish a single-sign on by the user with the website.
13. The computer readable media of claim 12 , the instructions further cause the system to, after the receive of the indication by the hosted desktop, and prior to the receive by the web browser of the one-time-use token:
receive, by the website from the network authentication node, an indication that the website is a trusted website, and
receive, by the website from the network authentication node, the one-time-use token.
14. The computer readable media of claim 13 , wherein provide of the identity token of the user further comprises:
store the identity token of the user in a secure store of the hosted desktop in response to the hosted desktop receiving the user sign-in credentials from the user device; and
obtain the identity token of the user from the secure store accessible by the hosted desktop.
15. The computer readable media of claim 12 , the instructions further cause the system to:
decrypt, by the website, the identity token of the user using a private key of the website.
16. The computer readable media of claim 12 , wherein the network connection between the user device with the hosted desktop is a virtualization connection using the Internet.
17. The computer readable media of claim 12 , wherein the computer code executable by the hosted desktop comprises a JavaScript program to be executed by the web browser.
18. The computer readable media of claim 12 , wherein the call comprises an asynchronous JavaScript and XML (AJAX) call.
19. The computer readable media of claim 12 , wherein the monitoring performed to listen for activity on one or more ports of the hosted desktop comprises monitoring localhost network ports.
20. The computer readable media of claim 12 , wherein the instructions further cause the system to store the user sign-in credentials in a secure data store.