FACILITATING NETWORK AUTHENTICATION

• US 20160021097A1
• Filed: 07/18/2014
• Published: 01/21/2016
• Est. Priority Date: 07/18/2014
• Status: Abandoned Application

• Current Assignee: Avaya Incorporated
• Original Assignee: Avaya Incorporated
• Inventors: SHROTRI, Madhavi
• Application Number:
  US14/335,614
• Publication Number:
  US 20160021097A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

Embodiments provide single sign on to enterprise applications through a captive portal. Example embodiments include receiving from a captive portal sign-on user interface, a request for network access from a user, the request including authentication credentials, redirecting the user to an identity server when the user has been authenticated for network access using the authentication credentials. Redirecting may include providing the identity server with the authentication credentials, and generating a single sign on (SSO) token using the authentication credentials, the SSO token allowing the user to access enterprise applications.

Claims

1. A method, comprising:

receiving from a captive portal sign-on user interface, a request for network access from a user, the request comprising authentication credentials;

redirecting the user to an identity server when the user has been authenticated for network access using the authentication credentials, wherein the redirecting comprises automatically providing the identity server with the authentication credentials;

generating a single sign (SSO) token by the identity server, the SSO token allowing the user to access enterprise applications; and

providing the SSO token to the user.

2. The method of claim 1, wherein the user signs on to the enterprise applications using the SSO token without entering authentication credentials when requesting the SSO token or accessing the enterprise applications.

3. The method of claim 1, wherein providing the identity server with the authentication credentials comprises automatically filling the authentication credentials into an identity provider login page that is generated by the identity server using a script.

4. The method of claim 1, further comprising receiving a request for network access from the user;

and causing the captive portal sign-on user interface to be displayed to the user.

5. The method of claim 1, further comprising applying one or more user policies that determine which enterprise applications are appropriate for the user when the user requests access to one of the enterprise applications using the SSO token.

6. A system, comprising:

a captive portal configured to;

receive from a captive portal sign-on user interface, a request for network access from a user, the request comprising authentication credentials;

authenticate the user for network access;

redirect the user to an identity server to obtain a single sign on (SSO) token for the user, wherein the redirect includes submitting to the identity server a request for the SSO token, the request comprising the authentication credentials; and

the identity server being configured to;

authenticate the user using the authentication credentials;

generate an SSO token for the user, wherein the SSO token allows the user to access enterprise applications; and

provide the SSO token to the user.

7. The system of claim 6, wherein the captive portal causes to be displayed a captive portal sign-on user interface to the user for display.

8. The system of claim 6, further comprising an enterprise server that allows the user to sign on to the enterprise applications without entering authentication credentials when requesting the SSO token or accessing the enterprise applications.

9. The system of claim 8, wherein the captive portal submits the request for the SSO token by generating a script that includes a request for an identity provider login page and the authentication credentials, the script being configured to automatically submit the authentication credentials into the identity provider login page.

10. The system of claim 6, wherein the captive portal receives a request for network access from a user;

and returns the captive portal sign-on user interface to the user.

11. The system of claim 6, wherein the identity server applies one or more user policies to specify how the user can access the one or more enterprise applications.

12. A method, comprising:

in response to authenticating a user for network access through a captive portal interface, generating a single sign on (SSO) login object that allows the user to access one or more enterprise applications; and

providing the SSO login object to the user.

13. The method of claim 12, wherein the SSO login object is an SSO token that is provided to a web browser of a client of the user, the SSO token being a cookie.

14. The method of claim 12, wherein the user signs on to the enterprise applications using the SSO login object without entering authentication credentials when requesting the SSO login object or accessing the enterprise applications.

15. The method of claim 12, further comprising receiving a request for network access from a user;

and returning a captive portal sign-on user interface to the user.

16. The method of claim 12, wherein the SSO login object comprises any of an SSO token or a secure certificate.

17. The method of claim 12, wherein generating the SSO login object comprises:

receiving authentication credentials during network authentication; and

providing the authentication credentials to an identity provider login page without requiring the user to re-enter the authentication credentials into the identity provider login page.

18. The method of claim 17, wherein providing the authentication credentials includes generating a script that requests the identity provider login page and automatically submits the authentication credentials to the identity provider login page.

19. The method of claim 12, further comprising locating user policies for each of the one or more enterprise applications;

and applying the user policies when the SSO token is provided to a service provider of the one or more enterprise applications, wherein the user policies specify how the user can access or utilize the one or more enterprise applications.

20. The method of claim 19, wherein the service provider redirects a request for the one or more enterprise applications to an identity server that locates and applies the user policies.