Single sign-on for remote browsing web applications

Abstract

An architecture is designed to introduce a "bootstrap server" within the single sign-on flow to bootstrap the SSO context into a remote browsing session. The bootstrap server provides the client browser with a session token to establish and secure a session between the client browser and the remote browsing system. After the client browser obtains the SSO token and is redirected to the bootstrap server, the bootstrap server provides a session token for the remote browsing session. The bootstrap server also generates a response to the client browser, allowing the remote browsing system to connect the client browser and establish a remote browsing session using the session token provided by the bootstrap server. In the remote browsing session, the client browser transmits the SSO token for use by the remote browser.

Description

Technical Field

[0001] The present disclosure generally relates to the transmission of digital information (e.g., CPC class H04L), and network architectures or network communication protocols for network security (e.g., CPC subclass H04L63 / 00).

Background Art

[0002] Special Publication 800-207 of the National Institute of Standards and Technology (NIST) of the United States provides a brief history of the term "zero trust", and explains that zero trust is "a paradigm focused on resource protection, and the premise that trust is never given implicitly but must be continuously evaluated". Remote browser isolation (RBI) is a technology included in zero trust implementations. Browser isolation uses containerization or virtualization technologies to separate web browsers and browsing activities. RBI provides browser isolation remotely as a cloud-hosted or cloud-based service. Users interact with the remote browser via a secure client application or web-based interface that sends input to the remote, isolated browser. The remote browser provides a sanitized rendering of the web page (e.g., pixel reconstitution, document object model (DOM) mirroring, streaming media).

Brief Description of the Drawings

[0003] Embodiments of the present disclosure can be better understood by referring to the accompanying drawings. [Figure 1]Figure 1-2 is a conceptual system diagram for bootstrapping single sign-on for remote browsing. Figure 1 is a system diagram illustrating the conveyance of the single sign-on authentication context to a remote browsing session. [Figure 2] Figure 2 is a system diagram illustrating the processing of re-authentication events detected in the remote browser 113. [Figure 3] Figure 3 is a flowchart illustrating exemplary operations for bootstrapping single sign-on for remote browsing on a client browser. [Figure 4] Figure 4 is a flowchart illustrating exemplary operations for managing remote browsing using bootstrapped single sign-on. [Figure 5] Figure 5 shows an exemplary computer system with single sign-on to a remote browsing bootstrapper. [Modes for carrying out the invention]

[0004] The following description includes exemplary systems, methods, techniques, and program flows to aid in understanding this disclosure and does not limit the scope of the claims. Well-known instruction instances, protocols, structures, and techniques are not shown in detail for the sake of brevity.

[0005] term

[0006] This specification refers to a "bootstrap server." A bootstrap server is a communication endpoint that may be hosted on a physical or virtual server. A bootstrap server is associated with one or more domains of an organization that provides services for secure remote browsing or RBI with a seamless single sign-on experience.

[0007] In this specification, the term “token” is used to refer to data that represents the context or state of a session. In the case of “SSO token,” the term refers to data that represents the authentication context of an SSO session. In the case of “session token,” the term refers to data that represents the state of an application-layer session. Token implementations vary depending on the standard or protocol. For example, there are different standards for authentication and authorization, including OpenID Connect and Security Assertion Markup Language (SAML) 2.0. Different standards, and different implementations of standards, use different types of tokens (e.g., identity tokens, access tokens, refresh tokens) and different implementations of tokens (e.g., SAML assertions). Despite these differences, SSO tokens are consumed to verify digital identities as authenticated, and session tokens are used to establish and maintain sessions.

[0008] The use of the phrase "at least one of" preceding a list accompanied by the conjunction "and" should not be treated as an exclusive list unless otherwise specified, nor should it be interpreted as a list of categories having one item from each category. The clause "at least one of A, B, and C" may be violated by one of the listed items, multiple of the listed items, or one or more of the listed items and another unlisted item.

[0009] overview

[0010] Remote Browser Isolation (RBI) can reduce the attack surface and further simplify zero-trust implementations, but it can disrupt the single sign-on (SSO) experience. For SSO, a token representing digital identity authentication ("SSO token") is maintained in the client browser interacting with the identity provider. With RBI, the remote browser interacts with service provider endpoints that deliver web-based services or applications. The remote browser interacts with these service provider endpoints as directed by the client browser, without the context of the client browser (i.e., without the SSO token). The SSO experience is interrupted if re-authentication is triggered. Furthermore, authentication methods that perform multi-factor authentication (MFA) using local device hardware (e.g., a fingerprint scanner) cannot be implemented with RBI.

[0011] Architectures have been designed to introduce a "bootstrap server" into the SSO flow to bootstrap the SSO context to a remote browsing session. The bootstrap server provides a session token to the client browser to establish and secure the session between the client browser and the remote browsing system. Trusted relationships are established in advance between the bootstrap server and both the remote browsing system and the identity provider. In addition, the identity provider providing the SSO service is configured to redirect requests to the bootstrap server. After the client browser obtains an SSO token and is redirected to the bootstrap server, the bootstrap server provides a session token for the remote browsing session. The bootstrap server also generates a response to the client browser, connecting the client browser to the remote browsing system and establishing the remote browsing session using the session token provided by the bootstrap server. After session token verification, the remote browsing system, or the isolation environment provided by the remote browsing system, passes the SSO token to the remote browser instantiated within the isolation environment, which the remote browser then uses to access service endpoints affiliated with the identity provider.

[0012] Example explanation

[0013] Figure 1-2 is a conceptual system diagram for bootstrapping single sign-on for remote browsing. Figure 1 is a system diagram illustrating the propagation of the SSO authentication context for a remote browsing session. It is assumed that a trusted relationship has been established between the organization that manages or owns the bootstrap server 107 and the remote browsing system that provides remote browsing as a service. The remote browsing system has the infrastructure to instantiate or provision an isolated environment 111 (e.g., a container or virtual machine) and to instantiate a browser 113 within the isolated environment. For example, the remote browsing system could be a cloud service provider or a cloud service platform offering. The organization that owns / manages the bootstrap server 107 provides a service that facilitates the SSO experience for remote browsing, while also guaranteeing remote browsing. A trusted relationship has also been established between the bootstrap server 107 and the identity provider 103.

[0014] Figures 1 and 2 are annotated with a series of letters AK, respectively, where each stage represents one or more operations. These stages are ordered for this embodiment, but they are provided as an example to aid in understanding this disclosure and should not be used to limit the claims. The subject matter that falls within the claims may differ from that illustrated.

[0015] In stage A, the client browser 101 submits credentials to the identity provider 103. The client browser 101 may be accessing the login portal of the identity provider 103, or it may be redirected to the identity provider 103 when attempting to access a protected resource of a service provider that has a relationship with the identity provider 103.

[0016] In stage B, the identity provider 103 responds to the client browser 101 with a redirect to the bootstrap server 107. The response includes a single sign-on (SSO) token 105 that provides an authentication context for the digital identity. For example, the SSO token 105 could be a Security Assertion Markup Language (SAML) assertion. Configuration has been made in the identity provider 103 to enable the redirect. For example, the domain that maps to the bootstrap server 107 is configured as an assertion consumer service (ACS) endpoint for the organization that corresponds to the client browser 101 and / or the digital identity corresponding to the credentials submitted via the client browser.

[0017] In stage C, the client browser 101 submits a request to the bootstrap server 107 in accordance with a redirect from the identity provider 103. The redirected request includes an SSO token 105 that provides the authentication context.

[0018] In stage D, the bootstrap server 107 verifies the SSO token 105 using the identity provider 103. As mentioned earlier, a trusted relationship with the identity provider 103 has already been established.

[0019] In stage E, the bootstrap server 107 generates a session token 109 and communicates it to the client browser 101. The session token 109 enables the client browser 101 to establish a secure remote browsing session with the remote browsing system, which validates the session token 109. Due to a previously established trusted relationship, the remote browsing system can be validated using a previously provided key, for example, by the bootstrap server 107 or another element of the organization managing the bootstrap server 107. The bootstrap server 107 also instructs the client browser 101 to transmit the SSO token 105 to the remote browsing system.

[0020] In stage F, the client browser 101 connects to the remote browsing system using the session token 109 and transmits the SSO token 105 as a payload. A call to a web application programming interface (API) function or access to a web page can communicate a request to connect to the remote browsing system. In an embodiment where a connection is requested using a hypertext transfer protocol (HTTP) message 110, the session token 109 is encoded in the header of the message 110, and the SSO token 105 is transmitted in the body of the message 110.

[0021] In stage G, after verifying the session token 109, the isolation environment 111 of the remote browsing system establishes a remote browsing session with the client browser 101. If the session token 109 is not valid, the request to connect is rejected. Also, after verifying the session token 109, the isolation environment 111 determines that the message 110 contains the SSO token 105 and stores the SSO token 105 in the cache of the browser 113.

[0022] In stage H, the client browser 101 communicates input to the isolation environment 111. This stage is one example related to the general transmission of input from the client browser to the isolation environment. For this example, the input includes input for navigating to the service provider endpoint for the web application 115 having the identifier Web_App1.

[0023] In stage I, the remote browser 113 attempts to access Web_App1. As part of the exchange to authenticate with Web_App1, the remote browser 113 communicates the SSO token 105.

[0024] In stage J, Web_App1 verifies the SSO token 105 using the identity provider 103. Of course, this assumes that the service provider of Web_App1 has a trusted relationship with the identity provider 103 and has delegated the authentication responsibility to the identity provider.

[0025] In stage K, after verifying the SSO token 105, Web_App1 provides cookies and content. The cookies are provided to maintain the state of the application session between the remote browser 113 and Web_App1.

[0026] Figure 2 is a system diagram illustrating the processing of a re-authentication event detected in the remote browser 113. A re-authentication event can be triggered by a visit to a service provider endpoint. For example, a security policy may be changed or an application session may expire. A re-authentication event can also be triggered by navigation to a different service provider endpoint. Figure 2 shows a re-authentication event triggered by navigation to a web application 211 identified as Web_App2. In stage A, Web_App2 communicates the re-authentication event to the remote browser 113. This communication may be a redirect to identity provider 103.

[0027] In stage B, the isolation environment 111 traps the re-authentication event and communicates the re-authentication event to the client browser 101. Since the remote browser 113 is isolated within the isolation environment 111, the isolation environment 111 can monitor communication to the remote browser 113 and detect and trap the re-authentication event. Trapping the re-authentication event prevents the remote browser 113 from acting on the re-authentication event. Assuming the re-authentication event is communicated with a redirected HTTP request, the isolation environment 111 can forward the re-authentication event to the client browser 101. The communication of the re-authentication event includes the uniform resource locator (URL) of the service provider endpoint that generated the re-authentication event. The isolation environment 111 may send a redirect request message from the service provider endpoint to the client browser 101.

[0028] In Figure 2, the subsequent step CK is the same as steps AG and IJ in Figure 1.

[0029] In stage C, the client browser 101 submits credentials to the identity provider 103. The re-authentication event may indicate a multi-factor authentication (MFA) requirement. If the MFA requirement includes a biometric factor, the remote browser 113 cannot satisfy the MFA requirement. Since the authentication event with the MFA requirement was communicated to the client browser 101, which was trapped and rendered on a device presumed to be close to the user, the biometric factor can be provided to the identity provider 103.

[0030] In stage D, the identity provider 103 responds to the client browser 101 by redirecting to the bootstrap server 107. The response includes an SSO token 205, which may be an updated version of the SSO token 105 depending on the validity of the SSO token 105 for re-authentication.

[0031] In stage E, the client browser 101 submits a request in accordance with a redirect from the identity provider 103. The redirected request includes an SSO token 205 that provides the authentication context.

[0032] In stage F, the bootstrap server 107 verifies the SSO token 205 using the identity provider 103. When the client browser 101 submits a request to the identity provider 103, the client browser 101 is likely to contain a cookie previously provided to it. If the cookie is still valid (i.e., the session between the client browser 101 and the bootstrap server 107 is still valid), the bootstrap server 107 may skip verifying the SSO token 205.

[0033] In stage G, the bootstrap server 107 renews the session token 109 and communicates the renewed session token 109 to the client browser 101. The bootstrap server 107 is likely to interact with multiple client browsers and remote browsing sessions. The bootstrap server 107 maintains information on the generated session token to determine whether the session token remains valid and enables the renewal of the session token. The bootstrap server 107 also instructs the client browser 101 to transmit the SSO token 205 to the remote browsing system.

[0034] In stage H, the client browser 101 connects to the remote browsing system using the updated session token 109 and transmits the SSO token 205 as a payload. The client browser 101 sends a request message 210 containing the updated session token 109 and the SSO token 205. The underlying connection to the remote browsing system may be maintained or terminated after communicating the re-authentication event in stage B. If the connection is terminated, the client browser 101 executes code to reopen the connection.

[0035] In stage I, the isolation environment 111 of the remote browsing system establishes a remote browsing session with the client browser 101 after verifying the updated session token 109. The previously established remote browsing session expires. Therefore, the request is for a new remote browsing session using the updated session token 109. The request for the remote browsing session includes the URL of the service provider endpoint that generated the re-authentication event. This may be included in a field of the redirected message sent by the identity provider 103 in stage D. For example, the service provider URL may be in the meta-refresh field. By persisting the URL through the bootstrapped re-authentication path, browsing can be seamlessly continued even if the original remote browser 113 and isolation environment 111 are released. However, the embodiment may maintain the isolation environment 111 for a sufficient period of time for the client browser 101 to respond with the new SSO token 109. In that case, the isolation environment 111 can extract the SSO token 205 from the message 210, and after providing the SSO token 205 to the remote browser 113, release the trapped re-authentication event to the remote browser 113 or a new instance of the remote browser 113.

[0036] In stage J, the remote browser 113 responds to the re-authentication event using the new SSO token 205.

[0037] In stage K, Web_App2 verifies the SSO token 205 using identity provider 103.

[0038] The diagrams in Figures 1 and 2 provide exemplary context to aid in understanding the disclosed technology, but the claims are not limited to those shown. Figures 3 and 4 are flowcharts with exemplary operation that reinforce the exemplary deployment in Figures 1 and 2, and should not limit the claims. Figures 3 and 4 also provide more details relating to operation to aid in understanding the technology. For consistency with the previous figures, Figure 3 refers to a bootstrap server as performing exemplary operation, and Figure 4 refers to an isolated environment of a remote browsing system as performing exemplary operation. The names chosen for program code do not limit the claims. The structure and organization of a program may vary depending on the platform, programmer / architect preference, programming language, etc. In addition, the names of code units (programs, modules, methods, functions, etc.) may vary for the same reasons and may be arbitrary.

[0039] Figure 3 is a flowchart illustrating exemplary operations for bootstrapping a client browser with single sign-on for remote browsing. The bootstrapping program code runs on a server of the organization providing the service for remote browsing using SSO.

[0040] In block 301, the bootstrap server receives a redirected request from a client browser that contains an SSO token. The user may be logged into the identity provider's portal or attempting to visit an endpoint redirected to the identity provider, which is then redirected to the bootstrap server. In other embodiments, security equipment (e.g., a firewall) is configured to route SSO responses (e.g., SAML assertions) from the identity provider to the bootstrap server. For example, a rule can be configured on the firewall specifying the identity provider's network address or range of network addresses to intercept and analyze in order to determine whether the traffic is an SSO response. If the traffic matches the rule, the firewall routes the SSO response to the bootstrap server.

[0041] In block 303, the bootstrap server determines whether the SSO token is valid. If a session (proven by the cookie in the redirected request) does not exist between the client browser that sent the request and the bootstrap server, the bootstrap server verifies the SSO token using the identity provider. If a valid session exists between the bootstrap server and the client browser, the bootstrap server treats the SSO token as valid unless programmed or security policy instructs otherwise, and in this case, the bootstrap server verifies it using the identity provider. If the SSO token is valid, the operation flow proceeds to block 307. If the SSO token is not valid, the operation flow proceeds to block 305.

[0042] In block 305, the bootstrap server responds to the client browser with a webpage indicating that the SSO token is invalid. The bootstrap server may return a code indicating that the resource is unavailable or inaccessible. The operation flow in Figure 3 terminates after block 305.

[0043] In block 307, the bootstrap server determines whether a valid session token for remote browsing exists for the client browser. The bootstrap server maintains session information for existing remote browsing sessions for which the bootstrap server provided a session token, for example, in a local database or table. The session information may include an expiration date and a unique identifier for the previously provided session token. The session information associates the session identifier in a cookie, which was previously provided to the client browser. The cookie, which indicates the session state between the bootstrap server and the client browser, contains data that associates it with the session token of the remote browsing session. The bootstrap server looks up the session identifier shown in the cookie from the client browser. If nothing is found, there is no existing valid remote browsing session. If a valid remote browsing session exists for the client browser, the operation flow proceeds to block 311. If no valid remote browsing session exists for the client browser, the operation flow proceeds to block 309.

[0044] In block 309, the bootstrap server generates a remote browsing session token for the client browser, which is signed by the bootstrap server. For example, the bootstrap server can generate an object with a unique identifier and then digitally sign the object to generate the session token. The operation flow proceeds to block 313A.

[0045] If the bootstrap server determines that the client has a valid remote browsing session (307), the bootstrap server updates the valid remote browsing session token in block 311. The bootstrap server locates a unique identifier for the remote browsing session in the remote browsing session table or database maintained by the bootstrap server. The entry for the unique identifier contains an expiration time, which is extended by the bootstrap server to update the session token. The bootstrap server then provides the same session token but updates the issuance time in the session table / database.

[0046] In block 313A, the bootstrap server responds to the client browser using a web page component to instruct the client browser to connect to the remote browsing system using a session token and to communicate an SSO token to the remote browsing system. The web page component may contain program code (e.g., a script) executed by the client browser, or reference program code executed by the client browser, which causes the client browser to open a connection with the remote browsing system. For example, a script may be executed to create a socket and establish a connection with the remote browsing system specified in the script. The socket-based connection carries input from the client browser to the output of the isolated environment of the remote browsing system. After the connection is established, the script causes the client browser to communicate an HTTP request containing the remote browsing session token provided by the bootstrap server. The script also causes the client browser to embed the SSO token in the body of the HTTP message.

[0047] In some cases, the view server is used to mitigate the responsibilities of the bootstrap server. Block 313B is a replacement for 313A. In block 313B, the bootstrap server communicates the session token and SSO token to the view server. The communication includes instructions for generating the aforementioned web page components.

[0048] Figure 4 is a flowchart illustrating exemplary operation for managing remote browsing using bootstrapped single sign-on. An isolation environment that isolates the remote browser is programmed to validate the remote browsing session, extract the SSO token transmitted as a payload to the isolation environment, and trap a re-authentication event targeting the remote browser for transmission back to the client browser.

[0049] In block 401, the isolation environment receives remote browsing requests from the client browser. The isolation environment can process messages that are typically received by the browser. In addition, the isolation environment translates input from the client browser into input for the remote browser. For example, the isolation environment can map pixel-based input to document objects (e.g., buttons or links) and create events (e.g., clicks or selections). The translation of client browser input depends on how the content is sanitized for the client browser. However, some input from the client browser (e.g., HTTP GET requests specifying URLs) can be transmitted without translation, such as requests to navigate to a URL.

[0050] In block 403, the isolation environment determines whether the request contains a valid session token. The isolation environment has access to a key or secret previously shared, for example, through certificate distribution. Using this, the isolation environment can verify the signature on the session token. If the session token is valid, the operation flow proceeds to block 407. Otherwise, the request is rejected (block 405), and the operation flow terminates.

[0051] In block 407, the isolation environment determines whether the request contains an SSO token. The isolation environment is programmed or configured to look for the body of the request for an SSO token. If the request does not contain an SSO token, remote browsing may continue to an endpoint or domain that does not require authentication (i.e., until the flow proceeds to block 413). If the request contains an SSO token, the operational flow proceeds to block 409.

[0052] In block 409, the isolation environment instantiates the browser and stores the SSO token in the browser cache. In some cases, the browser may already be instantiated within the isolation environment.

[0053] In block 411, the browser in the isolated environment requests access to the service provider endpoint indicated in the input from the client browser. During the authentication exchange with the service provider endpoint, the browser provides an SSO token.

[0054] Since a synchronous flow is not required, blocks 407 and 411 through 413 are shown with dashed lines. The input may be a non-navigation input that interacts with a web page, and the navigation input does not need to access a protected resource that requires authentication for authorization to access. In block 413, the isolation environment detects and traps a reauthentication event. Reauthentication events may be communicated by a service endpoint for reasons such as a change in authentication requirements, SSO token revocation, or navigation to a different service provider endpoint. When the isolation environment detects a reauthentication event, it traps the reauthentication event to prevent delivery to the containing browser. The isolation environment may cache the reauthentication event until the client browser responds with a new SSO token, and then deliver the reauthentication event to the browser.

[0055] In block 415, the isolation environment communicates the re-authentication event to the client browser. If the re-authentication event is communicated as an HTTP message from the service provider endpoint, the isolation environment may forward the message to the client browser, which may redirect the client browser to the identity provider.

[0056] The flowchart is provided to aid in understanding the explanation and should not be used to limit the scope of the claims. The flowchart illustrates exemplary behavior that may vary within the scope of the claims. Additional actions may be performed; that is, fewer actions may be performed, actions may be performed in parallel, and actions may be performed in a different order. It will be understood that each block in the flowchart explanation and / or block diagram, as well as combinations of blocks in the flowchart diagram and / or block diagram, may be implemented by program code. The program code may be provided for a processor of a general-purpose computer, a dedicated computer, or other programmable machine or device.

[0057] As can be understood, aspects of this disclosure may be embodied as systems, methods, or program code / instructions stored in one or more machine-readable media. Accordingly, aspects may take the form of hardware, software (including firmware, resident software, microcode, etc.), or combinations of software and hardware aspects, all of which may be commonly referred to herein as “circuit”, “module”, or “system”.

[0058] Any combination of one or more machine-readable media may be used. A machine-readable media may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable storage medium may be a system, apparatus, or device that employs one or a combination of electronic, magnetic, optical, electromagnetic, infrared, or semiconductor technologies to store program code, for example, but is not limited to these. More specific examples (non-exclusive list) of machine-readable storage media include: portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing. In the context of this specification, a machine-readable storage medium may be any tangible medium that contains or can store programs for use by or in connection with an instruction execution system, apparatus, or device. A machine-readable storage medium is not a machine-readable signal medium.

[0059] A machine-readable signaling medium may include, for example, a propagating data signal in which machine-readable program code is embodied, either within the baseband or as part of a carrier wave. Such propagating signals may take any of the various forms, including, but not limited to, electromagnetic, optical, or any suitable combination thereof. A machine-readable signaling medium may be any machine-readable medium that is not a machine-readable storage medium and that can communicate, propagate, or transfer a program for use by or in connection with an instruction execution system, apparatus, or device.

[0060] Program code embodied on a machine-readable medium may be transmitted using any suitable medium, including, but not limited to, wireless, wired, fiber optic cable, RF, etc., or any suitable combination thereof.

[0061] Program code / instructions may also be stored in machine-readable media that can instruct a machine to function in a specific way. As a result, instructions stored in machine-readable media generate a product that includes instructions to implement a function / operation specified in one or more blocks of a flowchart and / or block diagram.

[0062] Figure 5 shows an exemplary computer system having single sign-on to a remote browsing bootstrapper. The computer system includes a processor 501 (possibly including multiple processors, multiple cores, multiple nodes, and / or implementing multithreading, etc.). The computer system includes memory 507, which may be system memory or one or more of the possible embodiments of machine-readable media already described above. The computer system also includes a bus 503 and a network interface 505. The system also includes SSO to a remote browsing bootstrapper 511 ("the bootstrapper"). The bootstrapper 511 transmits an SSO token (e.g., a SAML assertion) to the remote browser through the remote browsing session to enable remote browsing with a seamless SSO experience. The bootstrapper 511 transmits the SSO token based on overlapping trusted relationships. Specifically, these are 1) trust established between the bootstrapper 511 and the remote browsing system, and 2) trust established between the bootstrapper 511 and the identity provider. The bootstrapper 511 relates these different spheres of trust by instructing the client browser to establish a remote browsing session using a session token provided by the bootstrapper 511, and by using the remote browsing session to transmit an SSO token to the remote browser. Any one of the aforementioned functions may be partially (or completely) implemented in hardware and / or on the processor 501. For example, the functionality may be implemented using an application-specific integrated circuit within the logic implemented on the processor 501, within a coprocessor on a peripheral device or card, etc.Furthermore, the implementation may include fewer or additional components not shown in Figure 5 (e.g., a video card, an audio card, additional network interfaces, peripheral devices, etc.). The processor 501 and the network interface 505 are coupled to the bus 503. Although shown as coupled to the bus 503, the memory 507 may also be coupled to the processor 501.

Claims

1. It is a method, The steps include: determining whether the redirected request contains a valid single sign-on (SSO) token based on the receipt of the redirected request from the client browser; Based on the determination that the redirected request contains a valid SSO token, the steps include determining whether the redirected request contains a valid cookie for the client browser, Based on the determination that the redirected request does not contain a valid cookie, the steps include generating a session token for the remote browsing session, The steps include updating the session token based on the determination that the redirected request contains a valid cookie for the client browser, The steps include generating and sending a communication that causes the client browser to request a remote browsing session using the session token and includes the SSO token in the request, Based on the determination that the SSO token is invalid, the client browser is redirected to the identity provider. The steps include establishing a remote browsing session between the client browser and a remote browser based on the verification of the session token by the remote browsing system, and providing the SSO token to be used by the remote browser to access the service provider endpoint. Methods that include...

2. The redirected request was redirected by the identity provider that generated the SSO token, or by a security device that intercepted the redirected request from the identity provider and routed it to a server or service. The steps of generating and sending a communication that causes the client browser to request a remote browsing session using the session token and includes the SSO token in the request are performed by the server or service. The method according to claim 1.

3. The step of generating the communication that causes the client browser to request the remote browsing session includes generating a web page component with program code, Using the session token, the client browser is connected to the remote browsing system, and In the aforementioned remote browsing session request, the payload includes the SSO token, and optionally, the payload is located within the body of the remote browsing session request. The step of transmitting the communication includes responding with the redirected request using the web page component, the session token, and the SSO token. The aforementioned communication is optionally sent to the view server. The method according to claim 1.

4. The above method further includes the remote browsing system, This step involves trapping the re-authentication event received by the remote browser. The aforementioned re-authentication event optionally includes steps that demonstrate multi-factor authentication, The steps include communicating the aforementioned re-authentication event to the client browser, The steps include the following: After the client browser obtains a second SSO token from the identity provider, the client browser generates a new session token or updates the session token, depending on whether or not it presents a valid cookie. Optionally, the client browser obtains the second SSO token based on interacting with the identity provider to satisfy the indicated multi-factor authentication, The method according to any one of claims 1 to 3, including

5. A non-temporary machine-readable storage medium that stores program code, The aforementioned program code includes instructions, and when the instructions are executed, Based on the receipt of a redirected request from the client browser, it is determined whether the redirected request contains a valid single sign-on (SSO) token. Based on the determination that the redirected request contains a valid SSO token, it is determined whether the redirected request contains a valid cookie for the client browser. Based on the determination that the redirected request does not contain a valid cookie, a session token is generated for the remote browsing session. Based on the determination that the redirected request contains a valid cookie for the client browser, the session token is updated, and The second program code generates a web page component to connect the client browser to the remote browsing system using the session token, and includes the SSO token as a payload within the remote browsing session request or within the body of the remote browsing session request. A non-temporary, machine-readable memory medium that allows for such operation.

6. It stores the third program code, including instructions. When the aforementioned command is executed, the remote browsing system will be accessed. After the remote browsing system verifies the session token, it causes the remote browser to provide the SSO token to be used to access the service provider endpoint. The non-temporary machine-readable storage medium according to claim 5.

7. The third program code further includes instructions, When the aforementioned instruction is executed, The remote browser traps the re-authentication event received, and, The re-authentication event is communicated to the client browser. A non-temporary machine-readable storage medium according to claim 6, which causes such a function to be used.

8. The third program code further includes instructions, When the aforementioned instruction is executed, Based on the determination that the SSO token is invalid, the client browser is redirected to the identity provider. A machine-readable storage medium according to claim 6 or 7, which causes such a thing to happen.

9. It is a system, This is the first server programmed using the first program code, Based on the receipt of a redirected request from the client browser, it is determined whether the redirected request contains a valid single sign-on (SSO) token. Based on the determination that the redirected request contains a valid SSO token, it is determined whether the redirected request contains a valid cookie for the client browser. Based on the determination that the redirected request does not contain a valid cookie, a session token is generated for the remote browsing session. Based on the determination that the redirected request contains a valid cookie for the client browser, the session token is updated. The system generates and transmits a communication that causes the client browser to request a remote browsing session using the session token, and includes the SSO token in the request. The first server is programmed to do so, This is a second server programmed using the second program code, Based on the verification of the session token, after the establishment of the remote browsing session, the SSO token is provided to be used by the remote browser to access the service provider endpoint. The second server is programmed to do so, A system that includes this.

10. The first server includes a first processor and a first memory that stores the first program code executable by the first processor. The second server includes a second processor and a second memory storing the second program code. The system according to claim 9.

11. The instruction in the first program code for generating the communication that causes the client browser to request the remote browsing session is: The first server includes an executable instruction that causes it to generate a web page component containing a third program code to be executed by the client browser, The client browser is connected to the remote browsing system using the session token, and The SSO token is included as a payload in the remote browsing session request. The instructions of the first program code for transmitting the aforementioned communication include executable instructions, The first server is instructed to respond to the redirected request using the web page component, the session token, and the SSO token. The system according to claim 9.

12. When the third program code is executed by the client browser, it instructs the client browser to include the SSO token in the body of the remote browsing session request. The system according to claim 11.

13. The instruction in the first program code for generating the communication that causes the client browser to request the remote browsing session is: The first server includes an executable instruction that causes the view server to communicate instructions for generating a web page component with the third program code, and when executed by the client browser, The client browser is connected to the remote browsing system using the session token, and The aforementioned SSO token is included as a payload within the remote browsing session request. The system according to claim 11.

14. The second program code further includes instructions that can be executed by the second server, The remote browser traps the re-authentication event received, and, The re-authentication event is communicated to the client browser. The system according to claim 9.

15. The first program code further includes executable instructions, Based on the determination that the SSO token is invalid, the first server is instructed to redirect the client browser to the identity provider. The system according to any one of claims 9 to 14.

Images