SINGLE SIGN-ON FOR MANAGED MOBILE DEVICES USING KERBEROS

• US 20170155640A1
• Filed: 02/09/2017
• Published: 06/01/2017
• Est. Priority Date: 06/15/2015
• Status: Active Grant

• Current Assignee: AirWatch LLC (Broadcom, Inc.)
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: Barday, Kabir, Brannon, Jonathan Blake, Rykowski, Adam
• Granted Patent: US 10,944,738 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

Disclosed are various examples for single-sign on by way of managed mobile devices using Kerberos. For example, a certificate is received from a client device. In response, a Kerberos ticket-granting ticket is generated and sent to the client device. A request for a service ticket is later received from the client device. The request for the service ticket can include the ticket-granting ticket. The service ticket is then generated and sent to the client device. Subsequently, the service ticket is received from the client device and a security assertion markup language (SAML) response is sent to the client device in reply. The SAML response can provide authentication credentials for a service provider associated with the service ticket.

Claims

1. A non-transitory computer-readable medium embodying a program executable by a processor of a computing device to cause the computing device to at least:

receive a certificate from a client device;

generate a ticket-granting ticket;

send the ticket-granting ticket to the client device;

receive a request for a service ticket from the client device, wherein the request for the service ticket includes the ticket-granting ticket;

generate the service ticket;

send the service ticket to the client device;

receive the service ticket from the client device; and

send a security assertion markup language (SAML) response to the client device, wherein the SAML response provides authentication credentials for a service provider associated with the service ticket.

2. The non-transitory computer-readable medium of claim 1, wherein the program further causes the computing device to at least receive a SAML authentication request from the client device.

3. The non-transitory computer-readable medium of claim 2, wherein the program further causes the computing device to at least send a Kerberos challenge to the client device in response to receipt of the SAML authentication request.

4. The non-transitory computer-readable medium of claim 3, wherein:

the Kerberos challenge is sent as a component of a hypertext transport protocol (HTTP) response that comprises a 401 unauthorized status code; and

the certificate is received from the client device in response to the Kerberos challenge.

5. The non-transitory computer-readable medium of claim 1, wherein the program further causes the computing device to at least validate the certificate with an online certificate status protocol (OCSP) service.

6. The non-transitory computer-readable medium of claim 5, wherein the ticket-granting ticket is generated in response to a validation of the certificate by the OCSP service.

7. A system, comprising:

a computing device comprising a processor and a memory; and

machine readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least;

receive a certificate from a client device;

generate a ticket-granting ticket;

send the ticket-granting ticket to the client device;

receive a request for a service ticket from the client device, wherein the request for the service ticket includes the ticket-granting ticket;

generate the service ticket;

send the service ticket to the client device;

receive the service ticket from the client device; and

send a security assertion markup language (SAML) response to the client device, wherein the SAML response provides authentication credentials for a service provider associated with the service ticket.

8. The system of claim 7, wherein the machine readable instructions, when executed by the processor, further cause the computing device to at least receive a SAML authentication request from the client device.

9. The system of claim 8, wherein the machine readable instructions, when executed by the processor, further cause the computing device to at least send a Kerberos challenge to the client device in response to receipt of the SAML authentication request.

10. The system of claim 9, wherein the Kerberos challenge is sent as a component of a hypertext transport protocol (HTTP) response that comprises a 401 unauthorized status code.

11. The system of claim 9, wherein the certificate is received from the client device in response to the Kerberos challenge.

12. The system of claim 7, wherein the machine readable instructions, when executed by the processor, further cause the computing device to at least validate the certificate with an online certificate status protocol (OCSP) service.

13. The system of claim 12, wherein the ticket-granting ticket is generated in response to a validation of the certificate by the OCSP service.

14. A method, comprising:

receiving a certificate from a client device;

generating a ticket-granting ticket;

sending the ticket-granting ticket to the client device;

receiving a request for a service ticket from the client device, wherein the request for the service ticket includes the ticket-granting ticket;

generating the service ticket;

sending the service ticket to the client device;

receiving the service ticket from the client device; and

sending a security assertion markup language (SAML) response to the client device, wherein the SAML response provides authentication credentials for a service provider associated with the service ticket.

15. The method of claim 14, further comprising receiving a SAML authentication request from the client device.

16. The method of claim 14, further comprising sending a Kerberos challenge to the client device in response to receipt of the SAML authentication request

17. The method of claim 16, wherein the Kerberos challenge is sent as a component of a hypertext transport protocol (HTTP) response that comprises a 401 unauthorized status code.

18. The method of claim 16, wherein receiving the certificate from the client devcie occurs in response to sending the Kerberos challenge to the client device.

19. The method of claim 14, further comprising validating the certificate with an online certificate status protocol (OCSP) service.

20. The method of claim 19, wherein generating the ticket-granting ticket occurs in response to validating the certificate with the OCSP service.