Single sign-on from desktop to network
Methods, systems, computer-readable media, and apparatuses method for performing single sign on for a user device to the Internet. User sign-in credentials including an identity token of the user are received by a hosted desktop from the user device, including an indication that the user is attempting to access a website. The website is authorized as a trusted website by a network authorization node, and the website is issued a one-time-use token. A web browser of the hosted desktop receives an application provided by the website to cause the web browser to call the hosted desktop to initiate single sign on. Authenticity of the one-time-use token is requested by a daemon process, and the website's public key is obtained. Upon verifying authenticity of the web site, the identity token of the user is passed to the website, to enable the website to establish single sign on with the user.
1. A method for performing Single Sign On (SSO), comprising:
authenticating, by a computing device, a website to be a trusted website, wherein the website is being accessed through a hosted desktop;
generating a one-time-use token that authorizes the trusted website to obtain an identity token corresponding to a user, wherein the identity token corresponding to the user is associated with establishment of a single-sign-on on behalf of the user with the trusted website;
sending the one-time-use token to the trusted website; and
upon receiving, from the hosted desktop, a request for verifying whether the one-time-use token is authentic and not already used, verifying whether the one-time-use token is authentic and not already used.
2. The method of claim 1 , wherein the computing device comprises a cloud service server.
3. The method of claim 1 , further comprising:
generating a public key associated with the trusted website; and
sending the public key to the hosted desktop.
4. The method of claim 1 , wherein the authenticating comprises
accessing network authentication information of a network, and
obtaining a valid certificate of the website based on the network authentication information.
5. The method of claim 1 , wherein the generating comprises
after the website is authenticated to be the trusted website, generating the one-time-use token.
6. The method of claim 1 , wherein the computing device comprises a ticketing service server, and the one-time-use token is issued from the ticketing service server.
7. The method of claim 1 , further comprising:
determining that the one-time-use token has been used after verifying whether the one-time-use token is authentic.
8. An apparatus comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the apparatus to:
authenticate a website to be a trusted website, wherein the website is being accessed through a hosted desktop;
generate a one-time-use token that authorizes the trusted website to obtain an identity token corresponding to a user, wherein the identity token corresponding to the user is associated with establishment of a single-sign-on on behalf of the user with the trusted website;
send the one-time-use token to the trusted website; and
upon receiving, from the hosted desktop, a request for verifying whether the one-time-use token is authentic and not already used, verify whether the one-time-use token is authentic and not already used.
9. The apparatus of claim 8 , wherein the apparatus comprises a cloud service server.
10. The apparatus of claim 8 , wherein the instructions, when executed by the one or more processors, cause the apparatus to:
generate a public key associated with the trusted website; and
send the public key to the hosted desktop.
11. The apparatus of claim 8 , wherein the instructions, when executed by the one or more processors, cause the apparatus to authenticate the website by:
accessing network authentication information of a network, and
obtaining a valid certificate of the website based on the network authentication information.
12. The apparatus of claim 8 , wherein the instructions, when executed by the one or more processors, cause the apparatus to generate the one-time-use token by generating the one-time-use token after the website is authenticated to be the trusted website.
13. The apparatus of claim 8 , wherein the apparatus comprises a ticketing service server, and the one-time-use token is issued from the ticketing service server.
14. The apparatus of claim 8 , wherein the instructions, when executed by the one or more processors, cause the apparatus to determine that the one-time-use token has been used after verifying whether the one-time-use token is authentic.
15. A non-transitory computer-readable medium storing instructions that, when executed, cause:
authenticating a website to be a trusted website, wherein the website is being accessed through a hosted desktop;
generating a one-time-use token that authorizes the trusted website to obtain an identity token corresponding to a user, wherein the identity token corresponding to the user is associated with establishment of a single-sign-on on behalf of the user with the trusted website;
sending the one-time-use token to the trusted website; and
upon receiving, from the hosted desktop, a request for verifying whether the one-time-use token is authentic and not already used, verifying whether the one-time-use token is authentic and not already used.
16. The non-transitory computer-readable medium of claim 15 , wherein the instructions, when executed, further cause:
generating a public key associated with the trusted website; and
sending the public key to the hosted desktop.
17. The non-transitory computer-readable medium of claim 15 , wherein the instructions, when executed, further cause the authenticating by:
accessing network authentication information of a network, and
obtaining a valid certificate of the website based on the network authentication information.
18. The non-transitory computer-readable medium of claim 15 , wherein the instructions, when executed, further cause the generating by generating the one-time-use token after the website is authenticated to be the trusted website.
19. The non-transitory computer-readable medium of claim 15 , wherein the instructions, when executed, further cause:
determining that the one-time-use token has been used after verifying whether the one-time-use token is authentic.
20. The non-transitory computer-readable medium of claim 15 , wherein the instructions, when executed, further cause a cloud service server to perform the authenticating, the generating, the sending, and the verifying.