Enterprise authentication via third party authentication support

• US 9,531,714 B2
• Filed: 06/27/2014
• Issued: 12/27/2016
• Est. Priority Date: 06/27/2014
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Innes, Andrew, Mayers, Chris, Soni, Ajay
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Sanders, Stephen
• Application Number:
  US14/317,795
• Publication Number:
  US 20150381621A1
• Time in Patent Office: 914 Days
• Field of Search: 726/7
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

Methods and systems are disclosed for providing approaches to enterprise authentication via third party authentication support. The methods and systems may include transmitting, by a computing device to an authentication device, a request to authenticate a client device application via a forms login protocol, and transmitting, by the computing device to the client device application, a first credential form retrieved from an authentication device generated by an extension device. The methods and systems may also include receiving, by the computing device from the client device application, a first authentication credential, and transmitting, by the computing device to the authentication service via the extension device, the first authentication credential. The methods and systems may also include transmitting, by the computing device and in response to a successful validation of the first authentication credential, an approval of the request made by the client device application to authenticate via the forms login protocol.

Claims

1. A method comprising:

transmitting, by a computing device to an authentication device via a network, a request to authenticate a client device application via a forms login protocol;

retrieving, by the computing device from the authentication device via the network, an authentication challenge and a first credential form requesting a first authentication credential, wherein the first credential form is generated, by an extension device connected to the authentication device, based on information received from an authentication service associated with the client device application, the extension device being configured with one or more authentication protocols of the authentication service associated with the client device application;

transmitting, by the computing device to the client device application via the network, the first credential form and the authentication challenge;

receiving, by the computing device from the client device application via the network, the first authentication credential and a response to the authentication challenge;

transmitting, by the computing device to the authentication service via the extension device, the first authentication credential and the response to the authentication challenge; and

transmitting, by the computing device via the network and in response to a successful validation of the first authentication credential and a successful response to the authentication challenge, an approval of the request made by the client device application to authenticate via the forms login protocol.

2. The method of claim 1, wherein transmitting, by the computing device to the client device application, the first credential form further comprises transmitting, by the computing device to the client device application, an instruction to invoke a plug-in mechanism that obtains the first authentication credential, wherein the plug-in mechanism communicates with the authentication service associated with the client device application.

3. The method of claim 2, wherein the plug-in mechanism displays, on a user device, a user interface requesting the first authentication credential using information retrieved from the authentication service associated with the client device application.

4. The method of claim 1, further comprising:

retrieving, by the computing device from the authentication device, a second credential form requesting a second authentication credential;

transmitting, by the computing device to the client device application, the second credential form;

receiving, by the computing device from the client device application, the second authentication credential; and

transmitting, by the computing device to the authentication device, the second authentication credential.

5. The method of claim 4, further comprising:

retrieving, by the computing device, the first credential form associated with a first authentication service; and

retrieving, by the computing device, the second credential form associated with a second authentication service.

6. The method of claim 5, wherein transmitting the first and the second credential forms comprises:

combining the first and the second credential forms into a third credential form; and

transmitting, by the computing device to the client device application, the third credential form.

7. The method of claim 5, wherein the first credential form is associated with a first authentication process and the second credential form is associated with a second authentication process, the method further comprising implementing one or more phases of the second authentication process after beginning the first authentication process and before completing the first authentication process.

8. The method of claim 1, where the computing device comprises a gateway device, the method further comprising passing, by the gateway device to the client device application, at least one of a first session identifier associated with a gateway device authentication session and a second session identifier associated with an authentication device authentication session.

9. The method of claim 1, further comprising:

transmitting, by the computing device to the client device application and after approving the request to authenticate via the forms login protocol, session information; and

receiving, by the computing device from the client device application, a confirmation of a session.

10. The method of claim 1, further comprising:

receiving, by the computing device from the client device application, a request for an indication that the computing device supports a forms login protocol; and

transmitting, by the computing device to the client device application, a message indicating the computing device supports a forms login protocol.

11. The method of claim 1, wherein the authentication device comprises the extension device.

12. The method of claim 1, wherein the authentication device comprises the authentication service associated with the client device application and the extension device.

13. The method of claim 1, wherein communications transmitted between the computing device and the authentication service associated with the client device application comprise data encrypted according to a first encryption, and communications transmitted between the authentication device and the computing device comprise data encrypted according to a second encryption different from the first encryption.

21. The method of claim 1, further comprising:

performing, by the computing device, prior to the computing device transmitting to the authentication device the request to authenticate the client device application via the forms login protocol, a pre-authentication scan of a client device running the client device application,

wherein, based on results of the pre-authentication scan of the client device, authentication of the client device application is either aborted or allowed to continue.

14. A system, comprising:

at least one processor; and

at least one memory storing instructions that, when executed by the at least one processor, cause the system to perform;

transmitting, by a computing device to an authentication device via a network, a request to authenticate a client device application via a forms login protocol;

retrieving, by the computing device from the authentication device via the network, an authentication challenge and a first credential form requesting a first authentication credential, wherein the first credential form is generated, by an extension device connected to the authentication device, based on information received from an authentication service associated with the client device application, the extension device being configured with one or more authentication protocols of the authentication service associated with the client device application;

transmitting, by the computing device to the client device application via the network, the first credential form and the authentication challenge;

receiving, by the computing device from the client device application, the first authentication credential and a response to the authentication challenge;

transmitting, by the computing device to the authentication service via the extension device, the first authentication credential and the response to the authentication challenge; and

transmitting, by the computing device via the network and in response to a successful validation of the first authentication credential and a successful response to the authentication challenge, an approval of the request made by the client device application to authenticate via the forms login protocol.

15. The system of claim 14, wherein transmitting, by the computing device to the client device application, the first credential form further comprises transmitting, by the computing device to the client device application, an instruction to invoke a plug-in mechanism that obtains the first authentication credential, wherein the plug-in mechanism communicates with the authentication service associated with the client device application.

16. The system of claim 14, the instructions further cause the system to perform:

retrieving, by the computing device from the authentication device, a second credential form requesting a second authentication credential;

transmitting, by the computing device to the client device application, the second credential form;

receiving, by the computing device from the client device application, the second authentication credential; and

transmitting, by the computing device to the authentication device, the second authentication credential.

17. The system of claim 14, wherein the authentication device comprises the authentication service associated with the client device application and the extension device.

22. The system of claim 14, the instructions further cause the system to perform:

performing, by the computing device, prior to the computing device transmitting to the authentication device the request to authenticate the client device application via the forms login protocol, a pre-authentication scan of a client device running the client device application,

wherein, based on results of the pre-authentication scan of the client device, authentication of the client device application is either aborted or allowed to continue.

18. One or more non-transitory computer-readable storage media having instructions stored thereon, that when executed by one or more processors, cause the one or more processors to perform:

transmitting, by a computing device to an authentication device via a network, a request to authenticate a client device application on a user device via a forms login protocol;

retrieving, by the computing device from the authentication device via the network, an authentication challenge and a first credential form requesting a first authentication credential, wherein the first credential form is generated, by an extension device connected to the authentication device, based on information received from an authentication service associated with the client device application, the extension device being configured with one or more authentication protocols of the authentication service associated with the client device application;

transmitting, by the computing device to the client device application via the network, the first credential form and the authentication challenge and;

receiving, by the computing device from the client device application via the network, the first authentication credential and a response to the authentication challenge;

transmitting, by the computing device to the authentication service via the extension device, the first authentication credential and the response to the authentication challenge; and

transmitting, by the computing device and in response to a successful validation of the first authentication credential and a successful response to the authentication challenge, an approval of the request made by the client device application to authenticate via the forms login protocol.

19. The one or more non-transitory computer-readable storage media of claim 18, wherein transmitting, by the computing device to the client device application, the first credential form further comprises transmitting, by the computing device to the client device application, an instruction to invoke a plug-in mechanism that obtains the first authentication credential, wherein the plug-in mechanism communicates with the authentication service associated with the client device application.

20. The one or more non-transitory computer-readable storage media of claim 18, the instructions further cause the one or more processors to perform:

retrieving, by the computing device from the authentication device, a second credential form requesting a second authentication credential;

transmitting, by the computing device to the client device application, the second credential form;

receiving, by the computing device from the client device application, the second authentication credential; and

transmitting, by the computing device to the authentication device, the second authentication credential.

23. The one or more non-transitory computer-readable storage media of claim 18, the instructions further cause the one or more processors to perform:

performing, by the computing device, prior to the computing device transmitting to the authentication device the request to authenticate the client device application via the forms login protocol, a pre-authentication scan of a client device running the client device application,

wherein, based on results of the pre-authentication scan of the client device, authentication of the client device application is either aborted or allowed to continue.