Local Agent Proxy for Cross-Application Single Sign-On
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face significant time and resource expenditure due to the need to remember and enter multiple authentication sets for various service providers, and existing single-sign-on (SSO) systems do not provide a seamless experience across different applications and service providers.
Innovation Solution
A local agent on the user's device acts as a proxy identity provider, storing authentication cookies and intercepting traffic between applications and the identity provider, allowing for frictionless sign-on without modifying local applications or service providers, and enabling authentication cookies to be shared across different applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional per-application SSO is used, then authentication is simplified within a single application, but users must still authenticate separately for each different application
Solution Approach 1:
A local agent is introduced as an intermediary component installed on the user's device. This agent intercepts authentication traffic between applications and identity providers, stores authentication cookies locally, and automatically provides them to subsequent applications. The agent acts as a mediator that enables cross-application SSO without requiring modifications to the applications themselves or the identity provider infrastructure.
Solution Approach 2:
The local agent creates and stores copies of authentication cookies obtained from identity providers. These cookie copies are then reused by multiple different applications to establish authenticated sessions. Instead of each application independently obtaining authentication, the agent copies the authentication credentials and makes them available across applications, enabling seamless cross-application access.
2Reliability
If multiple authentication sets are required for different service providers, then each service can be securely accessed, but significant time and resources are expended by users
Solution Approach 1:
The system performs preliminary authentication actions by having the local agent intercept and store authentication cookies during the initial login process. Once authentication is established for a service provider, the agent proactively captures the authentication credentials and stores them locally. This preliminary action eliminates the need for users to repeat the authentication process when accessing the same service provider through different applications, significantly reducing authentication time while maintaining security.
3Adaptability or versatility
If a local agent intercepts authentication traffic, then cross-application SSO is enabled, but the system complexity increases
Solution Approach 1:
The local agent is designed as a universal component that handles multiple authentication providers and multiple applications through a single unified interface. Rather than requiring separate authentication mechanisms for each application-provider pair, the agent implements a universal cookie interception and distribution system that works across all supported applications and identity providers, simplifying the overall system architecture despite the added functionality.
Data Source
AI summary
Operations include transmitting, on behalf of a first application, a first request to a first service provider, the first request requesting first services from the first service provider, intercepting, at a local agent, a first redirect message from the first service provider to an identity provider, receiving an identity provider cookie from the identity provider based on a validation of credentials during the authentication process, storing a copy of the identity provider cookie, transmitting, on behalf of a second application, a second request to a second service provider, the second request requesting second services from the second service provider, intercepting a second redirect message from the second service provider to the identity provider, adding the identity provider cookie to the second redirect message, and receiving validation to access the second service provider from the identity provider based on the identity provider cookie stored by the local agent.