Native App SSO via Intermediary Web Server and VPN
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing single sign-on (SSO) solutions are inadequate for native applications on devices, as they require client program installations, which are not feasible on all platforms, especially with the rise of mobile applications that present web pages without allowing plug-ins or third-party alterations.
Innovation Solution
A system and method that enables SSO by using an authentication service to intercept and modify log-in pages, allowing users to access multiple services without explicit credential entry, through VPN connections and credential management, supporting both single and multi-credential scenarios, even for native applications that do not use web pages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If LDAP-based single sign-on is implemented, then users can access multiple systems after one login, but client program installation is required which is not feasible for native applications
Solution Approach 1:
The patent introduces a web server as an intermediary component that mediates between the native application and the LDAP authentication system. The web server hosts the login page and handles authentication requests, allowing native applications to access LDAP-based single sign-on without requiring direct client programs or plugins on the user device. This intermediary approach resolves the contradiction by enabling SSO functionality through a web-based interface that native applications can invoke.
2Reliability
If web browser plug-ins are used for SSO, then authentication across systems is enabled, but native applications cannot support plug-ins or third-party alterations
Solution Approach 1:
The web server acts as a mediator that provides authentication functionality without requiring plug-ins. Instead of embedding authentication logic directly in the native application or using browser plug-ins, the system uses a standalone web server that can be invoked by the native application to handle LDAP authentication, maintaining both reliability and native application compatibility.
Solution Approach 2:
The authentication system is segmented into separate components: the native application handles user interaction, the web server handles authentication processing, and the LDAP server handles credential verification. This segmentation allows each component to perform its specialized function without requiring the native application to support plug-ins or third-party alterations.
3Extent of automation
If LDAP databases are deployed on servers, then centralized authentication is achieved, but additional client program installation is required on user devices
Solution Approach 1:
The web server serves as an intermediary that eliminates the need for client programs on user devices. It provides a web-based interface that can be accessed through any standard web browser, thereby achieving centralized authentication management through LDAP while avoiding the complexity of installing and maintaining client programs on each user device.
Solution Approach 2:
The system enables self-service authentication by providing a web-based login interface that users can access directly without requiring pre-installed client software. The web server automatically handles authentication requests from native applications, reducing device complexity while maintaining centralized control.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In an example embodiment, a virtual private network (VPN) connection is established between a client device and an authentication service. Then a request is received from a third-party application on the client device, with the request being for a third-party service. A log-in page is requested from the third-party service, with the log-in page including one or more log-in fields usable to enter credential information. The log-in page is then modified to hide the one or more log-in fields. Credentials corresponding to a user of the client device and also corresponding to the third-party service are then obtained. The modified log-in page is sent to the client device via the VPN connection. A log-in submission is received from the third-party application. The credentials corresponding to the user and to the third-party service are sent to the third-party service to log-in the user to the third-party service.