Methods and apparatus for delegated authentication token retrieval

• US 9,407,622 B2
• Filed: 01/09/2015
• Issued: 08/02/2016
• Est. Priority Date: 07/09/2012
• Status: Active Grant

• Current Assignee: Ping Identity Corporation
• Original Assignee: Ping Identity Corporation
• Inventors: Field-Eliot, Bryan, Narahari, Sateesh, Madsen, Paul
• Primary Examiner(s): Rashid, Harunur
• Application Number:
  US14/593,457
• Publication Number:
  US 20150341330A1
• Time in Patent Office: 571 Days
• Field of Search: 713/172, 713/182, 726/6, 726/4
• US Class Current: 1/1
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

In some embodiments, a non-transitory processor-readable medium includes code to cause a processor to send, from an authorization client on a device to a client authorization module, an indication of multiple applications installed on the device, and receive, at the authorization client and in response to the indication, multiple application tokens from the client authorization module. Each individual application token from the multiple application tokens received by the authorization client is uniquely associated with an application from the multiple applications installed on the device. The authorization client provides each application its associated application token such that each application from the multiple applications can use that application token in order to be authenticated to an application server associated with the application.

Claims

1. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

intercept at an authorization client a request to access a first application such that the first application is at least temporarily prevented from receiving the request;

send from the authorization client to a client authorization module, an indication of the first application and an indication of a second application;

receive, at the authorization client, in response to the indication of the first application and the indication of the second application, and from the client authorization module, a first application token and a second application token, respectively, the first application token being uniquely associated with the first application and the second application token being uniquely associated with the second application;

associate, using the authorization client, the first application with the first application token such that communication between the first application and an application device associated with the first application is authenticated when the first application token is exchanged between the application device associated with the first application and the first application; and

associate, using the authorization client, the second application with the second application token such that communication between the second application and an application device associated with the second application is authenticated when the second application token is exchanged between the application device associated with the second application and the second application.

2. The non-transitory processor-readable medium of claim 1, wherein the code to cause the processor to send includes code to cause the processor to:

send, from the authorization client to the client authorization module, an identifier associated with an access level of a user, the second application being associated with the access level.

3. The non-transitory processor-readable medium of claim 1, further comprising code to cause the processor to:

determine, prior to sending the indication, an identifier associated with the first application and the second application.

4. The non-transitory processor-readable medium of claim 1, wherein the first application is an enterprise application and the second application is a Software as a Service (SaaS) application.

5. The non-transitory processor-readable medium of claim 1, wherein the indication is of the first application, the second application and a third application, the code further comprising code to cause the processor to:

receive at the authorization client an indication that a user is unauthorized to use the third application.

6. The non-transitory processor-readable medium of claim 1, wherein the authorization client is collocated with the first application and the second application.

7. An apparatus, comprising:

a memory; and

a processor configured to implement an authorization client, the authorization client configured to send, at a first time, to a client authorization module, an application token request associated with a plurality of applications, subsequent to intercepting a request to launch an application from the plurality of applications such that the application is at least temporarily prevented from receiving the request to launch the application, the authorization client configured to receive, at a second time after the first time, in response to the application token request, (1) a set of application tokens associated with a first set of applications from the plurality of applications, and (2) an indication that the user is unauthorized to use each application from a second set of applications from the plurality of applications and mutually exclusive of the first set of applications, each application token from the set of application tokens being uniquely associated with an application from the first set of applications,

the authorization client configured to provide each application from the first set of applications with its associated application token from the set of application tokens such that each application from the first set of applications is authenticated to an application server associated with that application when its associated application token is received at the application server.

8. The apparatus of claim 7, wherein the authorization client is configured to send an identifier associated with the user to the client authorization module, the authorization client configured to receive, in response to the identifier, a user authorization token, the authorization client configured to provide the user authorization token to the client authorization module with the client token request.

9. The apparatus of claim 7, wherein the application server associated with an application from the plurality of applications is at least one of a Software as a Service (SaaS) host or an enterprise host.

10. The apparatus of claim 7, wherein the authorization client is configured to retrieve, prior to sending the application token request, a plurality of identifiers, each identifier from the plurality of identifiers being uniquely associated with an application from the plurality of applications, the application token request being based at least in part on the plurality of identifiers.

11. The apparatus of claim 7, wherein each token from the set of application tokens is an OAuth access token.

12. The apparatus of claim 7, wherein the authorization client is collocated with the plurality of applications.

13. An apparatus, comprising:

a memory; and

a processor configured to implement a client authorization module, the client authorization module configured to receive, at a first time, from an authorization client, and subsequent to the authorization client receiving a request to access at least one application from a plurality of applications such that the at least one application is at least temporarily prevented from receiving the indication, an application token request associated with the plurality of applications,

the client authorization module configured to send, at a second time after the first time, in response to the application token request, a plurality of tokens to the authorization client such that the authorization client associates each application from the plurality of applications with a uniquely associated token from the plurality of tokens,

the client authorization module configured to receive an authentication request from an application module associated with an application from the plurality of applications, the authentication request including a token from the plurality of tokens and uniquely associated with that application, the client authorization module configured to send an authentication signal to the application module in response to the client authorization module verifying the token as a valid token for the application.

14. The apparatus of claim 13, wherein the client authorization module is configured to receive an identifier associated with a user, the client authorization module configured to send, in response to the identifier, a user authorization token associated with an access right of the user.

15. The apparatus of claim 13, wherein the client authorization module and the application module are included in an enterprise server.

16. The apparatus of claim 13, wherein the client authorization module is hosted at a first host device, the application module is hosted at a second host device different from the first host device.

17. The apparatus of claim 13, wherein the authorization client is collocated with the plurality of applications.

18. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

receive, at an authorization client and at a first time, a request to access a first application such that the first application is at least temporarily prevented from receiving the request to access the first application;

send, at a second time after the first time from the authorization client to a client authorization module and in response to the request to access the first application, a request for an application token for the first application;

receive, at the authorization client and from the client authorization module, (1) the application token for the first application in response to the request for the application token for the first application, and (2) an application token for a second application from;

associate, using the authorization client, the application token for the first application with the first application such that communication between the first application and an application device associated with the first application is authenticated when the application token for the first application is exchanged between the application device associated with the first application and the first application;

associate, using the authorization client, the application token for the second application with the second application such that communication between the second application and an application device associated with the second application is authenticated when the application token for the second application is exchanged between the application device associated with the second application and the second application; and

send, using the authorization client and, after associating the application token for the first application with the first application, the request to access the first application to the first application such that the first application communicates with the application device associated with the first application.

19. The non-transitory processor-readable medium of claim 18, wherein the code to cause the processor to send the request includes code to cause the processor to:

send, from the authorization client to the client authorization module, an identifier associated with an access level of a user, the first application being approved for the access level.

20. The non-transitory processor-readable medium of claim 18, wherein the code to cause the processor to associate the application token for the first application includes code to cause the processor to associate the application token for the first application with the first application to enable authentication to at least one of a Software as a Service (SaaS) host associated with the first application or an enterprise host associated with the first application based on the application token for the first application.

21. The non-transitory processor-readable medium of claim 18, wherein the indication is a first indication, the code to cause the processor to associate the application token for the first application includes code to cause the processor to associate the application token for the first application at a third time, the code further comprising code to cause the processor to:

retrieve, at the authorization client and at a fourth time after the third time, a second indication that the user has requested to access the first application;

determine that the application token for the first application is associated with the first application; and

send the second indication to the first application.

22. The non-transitory processor-readable medium of claim 18, wherein the authorization client is collocated with the first application.