Asserting a mobile identity to users and devices in an enterprise authentication system
In an embodiment, a system for asserting a mobile identity to users and devices in an enterprise authentication system includes a communication interface and a processor coupled to the interface. The processor is configured to receive, via the communication interface and from a first device, a request to authenticate a user to a service using a unique identity associated with a second device. The processor is configured to determine, based at least in part on the unique identity, an identity certificate associated with the request, generate an identity assertion based at least in part on the identity certificate, and provide the identity assertion via the communication interface to a requesting node with which the request to authenticate is associated.
1. A system comprising:
a communication interface;
a processor coupled to the communication interface and configured to:
present an interaction page on an unmanaged device, wherein:
the interaction page is configured to receive a unique identity associated with a managed device;
the unmanaged device is not managed by an enterprise mobile management (EMM) server, and
the managed device is managed by the EMM server and established the unique identity;
receive, via the interaction page and from the unmanaged device, a request to authenticate a user to a cloud service using the unique identity;
send, to the managed device, a verification code or a verification code generation message that is configured to trigger generation of a verification code at the managed device;
receive, from the unmanaged device, a corresponding verification code;
responsive to the corresponding verification code matching the verification code sent to the managed device or the verification code generated at the managed device, map the unique identity received from the unmanaged device to the managed device;
send a push notification of an authentication request;
responsive to an approval received based on the push notification, match an identity certificate to the unique identity;
generate an identity assertion based at least in part on the identity certificate; and
provide the identity assertion via the communication interface to the unmanaged device.
2. The system of claim 1 , wherein the processor is further configured to apply an additional security measure to verify the unmanaged device.
3. The system of claim 1 , wherein the unique identity is unaccompanied by a credential.
4. The system of claim 1 , wherein the processor is further configured to perform a one-time authentication.
5. The system of claim 1 , wherein the processor is further configured to authenticate the unique identity using a biometric identifier, and the identity certificate is determined in response to authenticating the unique identity.
6. The system of claim 1 , wherein the processor is further configured to create the unique identity.
7. A method comprising:
presenting an interaction page on an unmanaged device, wherein:
the interaction page is configured to receive a unique identity associated with a managed device;
the unmanaged device is not managed by an enterprise mobile management (EMM) server, and
the managed device is managed by the EMM server and established the unique identity;
receiving, from the unmanaged device, a request to authenticate a user to a cloud service using the unique identity;
sending, to the managed device, a verification code or a verification code generation message that is configured to trigger generation of a verification code at the managed device;
receiving, from the unmanaged device, a corresponding verification code;
responsive to the corresponding verification code matching the verification code sent to the managed device or the verification code generated at the managed device, mapping the unique identity received from the unmanaged device to the managed device;
sending a push notification of an authentication request;
responsive to an approval received based on the push notification, matching an identity certificate to the unique identity;
generating an identity assertion based at least in part on the identity certificate; and
providing the identity assertion to the unmanaged device.
8. The method of claim 7 , wherein further comprising applying an additional security measure to verify the unmanaged device.
9. The method of claim 7 , wherein the unique identity is unaccompanied by a credential.
10. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
presenting an interaction page on an unmanaged device, wherein:
the interaction page is configured to receive a unique identity associated with a managed device;
the unmanaged device is not managed by an enterprise mobile management (EMM) server, and
the managed device is managed by the EMM server and established the unique identity;
receiving, from the unmanaged device, a request to authenticate a user to a cloud service using the unique identity;
sending, to the managed device, a verification code or a verification code generation message that is configured to trigger generation of a verification code at the managed device;
receiving, from the unmanaged device, a corresponding verification code;
responsive to the corresponding verification code matching the verification code sent to the managed device or the verification code generated at the managed device, mapping the unique identity received from the unmanaged device to the managed device;
sending a push notification of an authentication request;
responsive to an approval received based on the push notification, matching an identity certificate to the unique identity;
generating an identity assertion based at least in part on the identity certificate; and
providing the identity assertion to the unmanaged device.
11. The computer program product of claim 10 , wherein the computer instructions further include applying an additional security measure to verify the unmanaged device.