SYSTEM AND METHOD FOR PROXYING FEDERATED AUTHENTICATION PROTOCOLS

• US 20140245389A1
• Filed: 02/24/2014
• Published: 08/28/2014
• Est. Priority Date: 02/22/2013
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Duo Security Incorporated (Cisco Systems, Inc.)
• Inventors: Oberheide, Jon, Song, Douglas
• Granted Patent: US 8,893,230 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity

Abstract

A system and method that include receiving a service provider identity request through a federated authentication protocol; transmitting a proxy identity request to a configured identity provider; receiving an identity assertion; facilitating execution of a second layer of authentication; determining a proxy identity assertion based on the identity assertion and the second layer of authentication; and transmitting the proxy identity assertion to the service provider.

Claims

1. A method comprising:

receiving a service provider identity request through a federated authentication protocol;

transmitting a proxy identity request to a configured identity provider;

receiving an identity assertion;

facilitating execution of a second layer of authentication;

determining a proxy identity assertion based on the identity assertion and the second layer of authentication; and

transmitting the proxy identity assertion to the service provider.

2. The method of claim 1, wherein receiving the service provider identity request through a federated authentication protocol comprises emulating an identity provider in a first instance of a federated authentication protocol;

and wherein transmitting a proxy identity request to the configured identity provider and receiving an identity assertion comprises emulating a service provider in a second instance of a federated authentication protocol when transmitting to and receiving from the identity provider.

3. The method of claim 2, further comprising, in association with a managing account instance, configuring the first instance of a federated authentication protocol and the second instance of a federated authentication protocol;

and prior to transmitting the proxy identity request, selecting the second instance according to an identifier of the managing account from the first instance.

4. The method of claim 2, wherein the federated authentication protocol of the first instance and the second instance is a security assertion markup language protocol (SAML).

5. The method of claim 2, wherein the federated authentication protocol of the first and second instance is an OpenID Connect protocol.

6. The method of claim 2, wherein the first instance of a federated authentication protocol is a first type of protocol;

wherein the second instance of a federated authentication protocol is a second type of protocol; and

wherein the first and second type of protocol are not the same.

7. The method of claim 6, further comprising translating attributes between the first type of protocol and the second type of protocol.

8. The method of claim 7, wherein the second type of protocol is a lightweight directory access protocol (LDAP).

9. The method of claim 7, wherein translating attributes between the first type of protocol and the second type of protocol comprises translating from attributes of a security assertion markup authentication protocol (SAML) and scopes of an OpenID Connect protocol.

10. The method of claim 1, wherein receiving a service provider identity request through a federated authentication protocol, transmitting a proxy identity request to a configured identity provider, receiving an identity assertion, and facilitating execution of a second layer of authentication are performed at a proxy server installed within an internal network.

11. The method of claim 1, wherein receiving a service provider identity request through a federated authentication protocol, transmitting a proxy identity request to a configured identity provider, receiving an identity assertion, and facilitating execution of a second layer of authentication are performed at a proxy server of a of a multi-tenant service of second layer authentication service.

12. The method of claim 11, wherein facilitating execution of a second layer of authentication comprises authenticating the identity request with a secondary device associated with an identity of the identity request.

13. The method of claim 1, wherein transmitting the proxy identity request comprises transmitting a proxy identity request to the configured identity provider if the second layer of authentication is determined to be successful;

and if the second layer of authentication is determined to be unsuccessful, transmitting a failed proxy identity assertion to the service provider.

14. A method for single sign-on comprising:

receiving an identity assertion of an identity provider through a federated identity protocol;

facilitating execution of a second layer of authentication; and

transmitting a proxy identity assertion to a service provider through a second instance of a federated authentication protocol comprising emulating an identity provider in the second instance of a federated authentication protocol.

15. The method of claim 14, further comprising, in association with a managing account instance, configuring the first instance of a federated authentication protocol and the second instance of a federated authentication protocol;

and prior to transmitting the proxy identity assertion, selecting the second instance according to an identifier of the managing account from the first instance.

16. The method of claim 15, wherein the first instance and second instance are different types of federated authentication protocols, and further comprising translating attributes between the first type of protocol and the second type of protocol.

17. The method of claim 15, further comprising if the second layer of authentication is unsuccessful returning an error message to the identity provider.

18. The method of claim 14, wherein the first instance of a federated authentication protocol is a protocol of claim-based access control authorization of an active directory federation service.

19. A system comprising:

a federated authentication proxy server that comprises;

an identity provider interface,

a service provider emulator,

a second layer authentication engine, and

an account system with stored configuration of at least one managing account that includes configuration of a first instance of a federated authentication protocol with the identity provider interface, a second instance of a federated authentication protocol with the service provider emulator; and

second layer of authentication settings of at least one identity associated with the managing account.

20. The method of claim 19 further comprising a translation module that communicatively translates identity requests and identity assertions processed within the identity provider interface and the service provider emulator.

21. The method of claim 20, wherein the translation module includes translation rules to translate between a security assertion markup language protocol and an Open ID Connect protocol.

22. The method of claim 19, further comprising a two-factor authentication web service integrated with the second layer authentication engine of the federated authentication proxy server;

and wherein the federated authentication proxy server is hosted in the two-factor authentication web service.

23. The method of claim 19, wherein the federated authentication proxy server is hosted in an internal network with an identity provider.