Single sign on for applications

• US 9,825,933 B2
• Filed: 09/12/2014
• Issued: 11/21/2017
• Est. Priority Date: 09/12/2013
• Status: Active Grant

• Current Assignee: Data Accelerator Ltd.
• Original Assignee: Data Accelerator Ltd.
• Inventors: Clothier, Matthew P., Corbett, Sean P.
• Primary Examiner(s): Okeke, Izunna
• Assistant Examiner(s): TAYLOR, SAKINAH W
• Application Number:
  US14/485,665
• Publication Number:
  US 20150074783A1
• Time in Patent Office: 1,166 Days
• Field of Search: 726 8
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

Systems and method for providing single sign on access to an application executing at a client device. An API request is intercepted at the client device for signing on a user of the client device for accessing the application. The API request is sent to a remote system where user credentials are determined based on the intercepted API request. The user credentials are returned to the client device where they are used to agnostically sign on the user for accessing the application.

Claims

1. A method comprising:

intercepting, at a client device, an Application Programming Interface (API) request made by an application executing at the client device, the API request used for signing on a user of the client device to access the application, wherein the API request is intercepted at a layer between the application layer and the operating system layer of the client device;

instructing an operating system of the client device to hide or not display a login window form associated with the API request;

sending, from the client device via a network interface of the client device, the intercepted API request to a remote system from the client device;

receiving, at the client device via the network interface of the client device, user credentials for signing on the user to access the application from the remote system, the user credentials determined using the intercepted API request; and

without prompting the user for input and at the client device, signing on the user to access the application executing at the client device using the received user credentials by populating at least one field in the hidden or not displayed login window form with the user credentials and then activating a submit button of the login window form;

further comprising, at the client device;

inspecting a plurality of API requests of a plurality of applications executing at the client device;

intercepting API requests of the plurality of API requests used for signing on the user to access the plurality of applications;

receiving, from the remote system, a plurality of user credentials for accessing the plurality of applications based on the API requests;

agnostically signing on the user to access the plurality of applications using the plurality of user credentials.

2. The method of claim 1, further comprising determining, at the remote system, application specific credentials needed to sign on the user to access the application.

3. The method of claim 2, wherein the application specific credentials are determined from the API request.

4. The method of claim 2, further comprising determining the user credentials based on the determined application specific credentials.

5. The method of claim 1, further comprising:

receiving, at the client device, an application configuration of the application;

manipulating the application at the client device according to the application configuration.

6. The method of claim 5, wherein the application configuration is specific to either or both the client device and the user.

7. The method of claim 1, further comprising:

identifying an object to activate to cause the user credentials to be submitted for signing on the user to access the application at the client device;

agnostically activating the object to cause the user credentials to be submitted.

8. The method of claim 1, wherein the API request is intercepted by a hypervisor layer of the client device.

9. A system comprising:

a client device having one or more processors and memory, the client device including;

an API request interception engine configured to intercept an Application Programming Interface (API) request made by an application executing at the client device and configured to instruct an operating system of the client device to hide or not display a login window form associated with the API request, wherein the API request is intercepted at a layer between an application layer and an operating system layer of the client device;

an on-device communication engine configured to;

send the intercepted API request to a remote system from the client device;

receive user credentials for signing on the user to access the application from the remote system, the user credentials determined using the intercepted API request;

a sign on engine configured to, without prompting the user for input, sign on the user to access the application executing at the client device using the received user credentials by populating at least one field in the hidden or not displayed login window form with the user credentials and then activating a submit button of the login window form;

the API request interception engine is further configured to;

inspect a plurality of API requests of a plurality of applications executing at the client device;

intercept API requests of the plurality of API requests used for signing on the user to access the plurality of applications;

the on-device communication engine further configured to receive, from the remote system, a plurality of user credentials for accessing the plurality of applications based on the API requests;

the sign on engine further configured to agnostically sign on the user to access the plurality of applications using the plurality of user credentials.

10. The system of claim 9, wherein the remote system comprises one or more processors and memory and an application specific credential determination engine configured to determine application specific credentials needed to sign on the user to access the application.

11. The system of claim 10, wherein the application specific credential determination engine is configured to determine the application specific credentials from the API request.

12. The system of claim 10, wherein the remote system further comprises an application specific user credential determination engine configured to determine the user credentials based on the determined application specific credentials.

13. The system of claim 9, wherein the on-device communication engine is further configured to receive an application configuration of the application, the client device further comprising an application manipulation engine configured to manipulate the application at the client device according to the application configuration.

14. The system of claim 13, wherein the application configuration is specific to either or both the client device and the user.

15. The system of claim 9, wherein the sign on engine is further configured to:

identify an object to activate to cause the user credentials to be submitted for signing on the user to access the application at the client device;

agnostically activate the object to cause the user credentials to be submitted.

16. The system of claim 9, wherein the API request interception engine is implemented as part of a hypervisor layer of the client device.

17. A system comprising:

means, at a client device, for intercepting, at a layer between an application layer and an operating system layer of the client device, an Application Programming Interface (API) request made by the application executing at the client device, the API request used for signing on a user of the client device to access the application, and for instructing an operating system of the client device to hide or not display a login window form associated with the API request;

a network interface, at the client device, for sending the intercepted API request to a remote system from the client device and means for receiving user credentials for signing on the user to access the application from the remote system, the user credentials determined using the intercepted API request; and

means, at the client device, for signing on the user to access the application at the client device using the user credentials without prompting the user for input by populating at least one field in the hidden or not displayed login window form with the user credentials and then activating a submit button of the login window form;

further comprising, at the client device, means for;

inspecting a plurality of API requests of a plurality of applications executing at the client device;

intercepting API requests of the plurality of API requests used for signing on the user to access the plurality of applications;

receiving, from the remote system, a plurality of user credentials for accessing the plurality of applications based on the API requests;

agnostically signing on the user to access the plurality of applications using the plurality of user credentials.

18. The system of claim 17, wherein the means for intercepting an API request is implemented as part of a hypervisor layer of the client device.