SINGLE SIGN ON FOR NATIVE AND WRAPPED WEB RESOURCES ON MOBILE DEVICES

• US 20160119323A1
• Filed: 10/22/2014
• Published: 04/28/2016
• Est. Priority Date: 10/22/2014
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: Krishna, Vikas
• Granted Patent: US 9,819,668 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A method includes performing operations as follows on a processor: associating a single sign on module with a native application residing on a mobile device, detecting, using the single sign on module, user invocation of the native application, the native application to request access to a resource from a service provider server, determining, using the single sign on module, whether the mobile device has a token stored thereon that indicates the user has been previously authenticated with an identity provider server, sending, using the single sign on module, the token to the identity provider server when the token is determined to be stored on the mobile device, receiving, at the single sign on module, an identity assertion for the user from the identity provider server responsive to sending the token to the identity provider server, and providing, using the single sign on module, the identity assertion to the native application. The service provider server is independent of the identity provider server.

Claims

1. A method, comprising:

performing operations as follows on a processor;

associating a single sign on module with a native application residing on a mobile device;

detecting, using the single sign on module, user invocation of the native application, the native application to request access to a resource from a service provider server;

determining, using the single sign on module, whether the mobile device has a token stored thereon that indicates the user has been previously authenticated with an identity provider server;

sending, using the single sign on module, the token to the identity provider server when the token is determined to be stored on the mobile device;

receiving, at the single sign on module, an identity assertion for the user from the identity provider server responsive to sending the token to the identity provider server; and

providing, using the single sign on module, the identity assertion to the native application;

wherein the service provider server is independent of the identity provider server.

2. The method of claim 1, further comprising:

sending, using the native application, a request to access the resource to the service provider, the request to access the resource comprising the identity assertion.

3. The method of claim 2, further comprising:

wherein the identity assertion comprises a Security Association Markup Language (SAML) identity assertion.

4. The method of claim 1, further comprising:

requesting, using the single sign on module, identity credentials from the user when the token is determined not to be stored on the mobile device;

receiving, at the single sign on module, the identity credentials from the user; and

sending, using the single sign on module, the identity credentials to the identity provider server.

5. The method of claim 4, further comprising:

receiving, at the single sign on module, the token from the identity provider server.

6. The method of claim 4, wherein the identity credentials comprise a user name and a user password.

7. The method of claim 4, wherein the identity credentials comprise multi-factor authentication credentials comprising answers to multiple questions.

8. The method of claim 1, wherein the token has an expiration date associated therewith, the token being invalid after the expiration date.

10. The method of claim 1, further comprising:

sending, using the browser, a request to access the Web resource to a service provider, the request to access the resource comprising the identity assertion.

11. The method of claim 10, further comprising:

wherein the identity assertion comprises a Security Association Markup Language (SAML) identity assertion.

9. A method, comprising:

performing operations as follows on a processor;

associating a single sign on module with a browser residing on a mobile device;

detecting, using the single sign on module, user invocation of a Web resource via the browser;

sending, using the single sign on module, a token to an identity provider server, the token indicating that the user has been previously authenticated with the identity provider server;

receiving, at the single sign on module, an identity assertion for the user from the identity provider server responsive to sending the token to the identity provider server; and

providing, using the single sign on module, the identity assertion to the browser;

wherein the service provider server is independent of the identity provider server.

12. The method of claim 9, further comprising:

determining, using the single sign on module, whether the mobile device has the token stored thereon responsive to user invocation of the browser;

requesting, using the single sign on module, identity credentials from the user when the token is determined not to be stored on the mobile device;

receiving, at the single sign on module, the identity credentials from the user; and

sending, using the single sign on module, the identity credentials to the identity provider server.

13. The method of claim 12, further comprising:

receiving, at the single sign on module, the token from the identity provider server.

14. The method of claim 12, wherein the identity credentials comprise a user name and a user password.

15. The method of claim 12, wherein the identity credentials comprise multi-factor authentication credentials comprising answers to multiple questions.

16. The method of claim 9, wherein the token has an expiration date associated therewith, the token being invalid after the expiration date.

17. A computer program product, comprising:

a tangible computer readable storage medium comprising computer readable program code embodied in the medium that when executed by a processor causes the processor to perform operations comprising;

associating a single sign on module with a native application residing on a mobile device;

detecting, using the single sign on module, user invocation of the native application, the native application to request access to a resource from a service provider server;

determining, using the single sign on module, whether the mobile device has a token stored thereon that indicates the user has been previously authenticated with an identity provider server;

sending, using the single sign on module, the token to the identity provider server when the token is determined to be stored on the mobile device;

receiving, at the single sign on module, an identity assertion for the user from the identity provider server responsive to sending the token to the identity provider server; and

providing, using the single sign on module, the identity assertion to the native application;

wherein the service provider server is independent of the identity provider server.

18. The method of claim 17, further comprising:

sending, using the native application, a request to access the resource to the service provider, the request to access the resource comprising the identity assertion.

19. The method of claim 17, further comprising:

requesting, using the single sign on module, identity credentials from the user when the token is determined not to be stored on the mobile device;

receiving, at the single sign on module, the identity credentials from the user; and

sending, using the single sign on module, the identity credentials to the identity provider server.

20. The method of claim 19, further comprising:

receiving, at the single sign on module, the token from the identity provider server.