SSO Connector Intercepts Authentication Requests
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face frustration when trying to access enterprise data through messages with embedded URLs or links, as they often need to manually enter authentication credentials, especially when outside the enterprise network or using a different device.
Innovation Solution
The implementation of a Single Sign-On (SSO) connector that interacts with a device service endpoint for authentication, allowing the client application to intercept and redirect authentication requests to an identity provider service, eliminating the need for manual credential entry by using an authentication token.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If users access enterprise data through embedded URLs or links in messages from devices other than the authenticated device, then users can receive and view messages on multiple devices, but users must manually enter authentication credentials which causes frustration and delays access
Solution Approach 1:
The patent introduces an identity provider service as an intermediary between the user's client application and the third-party service. When a user clicks an embedded URL, the identity provider intercepts the authentication request, verifies the user's identity token, and automatically provides authentication credentials to the third-party service. This mediator eliminates the need for users to manually enter credentials while enabling access from multiple devices.
2Reliability
If users are required to enter authentication credentials manually for each service, then service security is maintained, but user productivity decreases due to repeated authentication steps
Solution Approach 1:
The system performs preliminary authentication by having users authenticate once with the identity provider service, which then caches their identity verification. When users subsequently access third-party services through embedded URLs, the identity provider uses the pre-verified identity token to automatically obtain authentication credentials, eliminating repeated manual authentication while maintaining security through the pre-established identity verification.
3Reliability
If embedded URLs open applications that require authentication, then service access control is enforced, but users experience delays when outside the enterprise network or using unauthenticated devices
Solution Approach 1:
The identity provider service implements a feedback mechanism where it monitors authentication requests from third-party services and automatically responds with verified credentials when the user's identity token is valid. This real-time feedback loop allows the system to maintain strict access control enforcement while eliminating authentication delays, as the identity provider instantly verifies and provides credentials without requiring users to manually authenticate again.
Data Source
AI summary
Disclosed are various approaches for facilitating single sign-on (SSO) for third-party services that are accessible through messages (e.g., email) received by a user. A user can receive a message that includes an embedded URL or link that opens in a third-party service that requires authentication. Instead of requiring the user to enter authentication credentials for accessing the third-party service, a tunnel service can be used to intercept requests for authentication and redirect the requests to an identity manager that can issue a SSO token following an authentication of the user and device. Upon supplying the third-party service with the SSO token, the user can access the content associated with the third-party service without entering authentication credentials.