Techniques for environment single sign on

• US 8,782,765 B2
• Filed: 09/14/2012
• Issued: 07/15/2014
• Est. Priority Date: 08/03/2009
• Status: Active Grant

• Current Assignee: Micro Focus Software, Inc. (Open Text Corporation)
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Kranendonk, Nathaniel, Carter, Stephen R
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): WYSZYNSKI, AUBREY H
• Application Number:
  US13/616,079
• Publication Number:
  US 20130014244A1
• Time in Patent Office: 669 Days
• Field of Search: 726/8
• US Class Current: 726/8
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

Techniques for environment single sign on are provided. Multiple identifiers for devices are associated as a single environment. A principal can be authenticated via any of the devices once to access protected resources and once authenticated the principal can access the protected resources from the other devices without re-authenticating.

Claims

1. A method residing in non-transitory a computer-readable storage medium as executable instructions that are executed by a processor to perform the method, comprising:

authenticating, via the processor, a principal for access to a protected resource;

establishing, via the processor, a first session for the first device and a second session for a second device that is also accessible to the principal; and

allowing, via the processor, the principal to access the protected resource and one or more other protected resources, without re-authenticating to the second device.

2. The method of claim 1, wherein authenticating further includes authenticating the principal after intercepting a request made by the principal for the protected resource.

3. The method of claim 1, wherein establishing further includes creating a processing environment for the first and second devices.

4. The method of claim 3, wherein creating further includes recognizing the first and second devices as virtual machines.

5. The method of claim 1, wherein allowing further includes using the first device as a proxy to the second device.

6. The method of claim 5, wherein using further includes recognizing the proxy as a forward proxy to the second device.

7. The method of claim 1, wherein allowing further includes providing the principal a first session identifier for accessing the first authenticated session and access to the first protected resource.

8. The method of claim 7, wherein providing further includes keeping a second session identifier for access the second authenticated session with the first device on behalf of the principal.

9. A method residing in non-transitory a computer-readable storage medium as executable instructions that are executed by a processor to perform the method, comprising:

associating, by the processor, a processing environment comprising a first device and a second device; and

allowing, by the processor, allowing single sign-on within the processing environment, the processing environment including protected resources associated with the first device and the second device.

10. The method of claim 9, wherein receiving further includes recognizing the processing environment as a virtual processing environment.

11. The method of claim 10, wherein recognizing further includes identifying the first device as a first virtual machine and the second device as a second virtual machine.

12. The method of claim 11, wherein identifying further includes packaging the first virtual machine and the second virtual machine as a set to form the virtual processing environment.

13. The method of claim 9 further comprising, using, via the processor, the first device as a proxy for access to the second device.

14. The method of claim 9, wherein allowing further includes establishing a first session when a user authenticates to the first device and automatically creating a second session for the user to access the second device.

15. A multiprocessor-implemented system, comprising:

a device having memory and a processor; and

a service implemented in a non-transitory computer-readable storage medium and to execute on the device;

wherein the service is configured to form a single environment from multiple other devices and to permit single sign-on to multiple resources of the single environment to occur once.

16. The system of claim 15, wherein authentication for the single sign-on can occur on the device or any of the other devices.

17. The system of claim 15, wherein the device and the other devices are each an independent virtual machine.

18. The system of claim 15, wherein the service is configured to establish sessions between the device and the other devices for an authenticated principal using the single sign-on.

19. The system of claim 15, wherein the device is configured as a forward proxy to the other devices for the single sign-on.

20. The system of claim 15, wherein the service is configured to outsource initial authentication for the single sign-on to a third-party authentication service.