Mobile SSO via Pre-Authenticated User Agent Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current single sign-on (SSO) solutions like OpenID Connect (OIDC) and Security Assertion Markup Language (SAML) rely on authentication providers to determine the authentication process, which can interfere with users and disrupt the seamless access to resources, especially in mobile applications where pre-authentication is desired.
Innovation Solution
A method is introduced for mobile devices to host native applications with pre-authenticated user agents, receiving redirection requests for authentication tokens, authenticating these tokens, and generating cookies to grant access to resources on relying party servers without user intervention, enabling seamless OIDC and SAML flows.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional OIDC or SAML authentication flows are used, then authentication security is maintained, but user experience deteriorates due to additional authentication steps and user interference
Solution Approach 1:
The system performs pre-authentication by storing authentication tokens in the mobile application before the user actually needs to access resources. When the user later accesses a resource on the relying party server, the pre-stored token is automatically used for authentication, eliminating the need for additional authentication steps and improving user experience.
2Adaptability or versatility
If authentication providers determine the authentication process, then authentication flexibility is improved, but seamless access deteriorates due to provider-specific methods interfering with the flow
Solution Approach 1:
The mobile application acts as an intermediary between the authentication provider and the relying party server. It stores authentication tokens locally and automatically manages the authentication flow, shielding the user from provider-specific authentication methods while maintaining support for multiple protocols like OIDC and SAML.
3Speed
If pre-authentication is implemented, then access speed is improved, but security risk increases due to storing authentication tokens on mobile devices
Solution Approach 1:
The authentication token is stored locally in the mobile application with restricted access permissions. The token is only accessible to the specific application that obtained it, and the system implements secure storage mechanisms and automatic validation to mitigate security risks while enabling fast access.
Data Source
Figure 1
Figure 2
Figure 3A~3B
AI summary
A method, a non-transitory computer readable medium, and a mobile device are disclosed for accessing a resource hosted on a relying party server from a mobile device. The method includes: hosting a native application on the mobile device, the native mobile device having a user agent for pre-authenticated users; receiving a redirection request from an authentication server for an authentication token for a pre-authenticated user in response to a request for the resource hosted on the relying party server; sending the authentication token for the pre-authenticated user from the user agent of the mobile device to the authentication server in response to the redirection request form the authentication server; and authenticating the authentication token from the user agent on the authentication server and generating an authentication cookie for the authenticated user to access the resource on the relying party server.