Native App IdP Authentication via System Browser Redirects
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Native applications interfacing with web services through web views face security issues during user authentication, as they can access authentication data not intended for the web service provider, and existing systems lack a protocol-agnostic solution to address these limitations.
Innovation Solution
A native application intercepts redirect requests from the main gateway, forwarding them to a system browser for secure authentication via an identity provider (IdP), using an embedded authentication server to handle communication with a broker gateway, and partitions large authentication responses into smaller chunks to avoid browser prompts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If native application uses web view to interface with web service provider, then application developer can save time and resources by reusing existing functionality, but native application can access authentication data that would normally not be accessible to web service provider
Solution Approach 1:
The patent introduces a system web browser as an intermediary component between the native application and the web service provider. The native application communicates authentication requests through the system web browser, which acts as a mediator to handle the authentication process securely. This intermediary prevents the native application from directly accessing authentication data while still enabling the reusability benefit.
2Reliability
If IdP prevents authentication via web views to address security issues, then security is improved, but existing systems do not provide a solution to overcome these limitations
Solution Approach 1:
The system web browser serves as an intermediary that enables authentication through IdPs without using the native application's web view. This intermediary approach allows the authentication process to bypass the security restrictions that prevent direct web view authentication, maintaining both security and authentication capability.
Solution Approach 2:
The authentication process is segmented into separate components: the native application initiates the authentication request, the system web browser handles the actual authentication communication with the IdP, and the authentication response is processed separately. This segmentation allows each component to perform its function securely without compromising the other.
3Reliability
If native application intercepts redirect request and forwards to system web browser, then secure authentication is enabled, but additional system components are required
Solution Approach 1:
The system web browser is designed to perform multiple functions: it handles authentication requests from the native application, communicates with the IdP, processes authentication responses, and manages redirect requests. This multi-functionality reduces the need for separate dedicated components, thereby limiting the increase in system complexity while achieving secure authentication.
Data Source
AI summary
A native application on a client computing device enables secure user authentication via an identity provider (IdP) for accessing services of a web service provider. The native application forwards a redirect request generated by a main gateway of the service provider and including an IdP uniform resource locator (URL) to a system browser of the client computing device. The redirect request directs the system browser to a broker gateway of the service provider that registers an authentication response handler and redirects the system browser to the IdP URL to enable a user of the native client computing device to authenticate. After the broker gateway receives an IdP authentication response from the IdP following authentication by the user, the broker gateway provides the IdP authentication response to the native application for providing back to the main gateway. The main gateway finally processes the authentication response to complete the authentication request.