Automated single sign-on configuration for service providers

An identity provider, within a directory service, provides an automatic technique for configuring the single sign-on settings of a service provider. The directory service contains pre-configured templates for each service provider supported by the directory service which include the details of the service provider's SSO configuration settings web page. A configuration sign-on script is generated to automatically fill in the configuration settings so that the principal can perform single sign-on with the service provider's preferred authentication and authorization protocol.

BACKGROUND

A network directory service system controls access to network resources by authenticating the identity of the end users requesting access to the devices, applications, and/or services (i.e., resources) controlled by the network directory service. The network directory service system may utilize an identity management system that authenticates each end user that initiates a sign-on or log-in to access a resource controlled by the network directory service system. The sign-on process may be initiated by a browser that signs-on or logs-in to a web-based resource using a set of credentials (e.g., user name, password, fingerprint scan, retina scan, voice print, etc.). Upon authentication of the user's credentials, a user session is initiated. In the case where an end user accesses multiple resources within a single security context, a single sign-on process may be used to enable the end user, within the same user session, to access multiple web-based resources using a single set of credentials. The single sign-on process authenticates the identity of an end user for all resources that the end user is authorized to access.

The single sign-on process in a multiple security context is more complicated since each security context may utilize a different authentication and authorization protocol that may not communicate with the authentication and authorization protocol of another context. In order to promote interoperability, a standard protocol for exchanging authentication and authorization data between different parties is often used. The protocol may define the syntax and semantics of a security assertion, the protocol used to request and transmit the assertion, the manner in which a request and response are mapped onto standard communication protocols, and so forth. However, the complexity of the protocol creates challenges for an administrator in configuring a single sign-on process that is outside of its security context.

SUMMARY

A directory service provides an automated mechanism for a principal to automatically configure the single sign-on settings of a service provider's authentication and authorization protocol. The directory service generates a configuration sign-on script that is customized for the authentication and authorization protocol utilized by a service provider. The configuration sign-on script is executed in a browser to fill in the requisite configuration settings needed for the identity provider to facilitate single sign-on with the service provider using the service provider's preferred authentication and authorization protocol.

DETAILED DESCRIPTION

Overview

The subject matter disclosed pertains to a mechanism for an identity provider to facilitate the automation of the configuration of the single sign-on (SSO) settings of a service provider.

A single sign-on is a session and user authentication that allows a user to access multiple web applications with one set of login credentials. In order to accomplish single sign-on, the service provider has to be configured to enable the single sign-on process. Each service provider may utilize a different protocol for its sign-on or login-in process. A standard protocol is often used to support interoperability between different security contexts, such as the security context of the identity provider and the security context of the service provider. A security context is the protocol used for the exchange of authentication and authorization information between two networked computers. Examples of such authentication and authorization protocols include Security Assertion Markup Language (SAML), OpenID Connect, Facebook Connect, OAuth, etc.

However, in order for single sign-on to operate, the service provider has to be configured with the correct configuration settings of the desired authentication and authorization protocol. This is typically provided by an administrator of the principal manually for each service provider that the directory service engages with on behalf of the principal. There are typically several service providers and each service provider may utilize a different authentication and authorization protocol. This requires the administrator to understand the technical specifications needed to configure each protocol which may not always be possible. It also requires that the administrator to manually configure the settings for each service provider which may be a burdensome task.

In order to overcome these drawbacks, the present disclosure provides a mechanism to automate the configuration process. Attention now turns to a description of a system for the automatic configuration of a single sign-on process of a service provider.

Automated Single Sign-on (SSO) Configuration System

Turning toFIG. 1A, there is shown a first exemplary system100embodying the automated SSO configuration process. The system100includes one or more client devices102communicatively coupled to a directory service104through a network, such as the Internet using the HyperText Transfer Protocol (HTTP). In one aspect, the directory service104is an identity provider106that provides access control and identity management for the applications and resources associated with an organization, entity, and/or end user. The directory service104offers identity management and single sign-on to multiple web-based Software as a Service (SaaS) applications, otherwise referred to as service providers108. Examples of a directory service104include, without limitation, Microsoft Azure Active Directory, Amazon Web Services, Google Cloud Platform, and the like.

The directory service104may include a single sign-on (SSO) configuration module110, a template storage111, a template generator112, and a template monitor113. A template contains the layout of the service provider's SSO configuration web page and/or user interface, and the requisite data and instructions needed to fill in the settings presented in a SSO configuration web page.

The principal114is a user, entity or organization that requests access to a resource from the service provider108through the identify provider106. The principal114is associated with a client device102having a browser116and a browser extension118. In one aspect of the disclosure, a remote or web-based authentication endpoint is registered with the client device102, browser116, or the browser extension118. The web-based authentication endpoint is a port in which the client device102connects to the directory service104. The endpoint is the uniform resource locator (URL) that the client device102or browser extension118uses to access the directory service104. The browser extension118may be an add-on module, extension, plug-in module, or the like that extends the functionality of the browser116to interact with the directory service104.

The SSO configuration module122generates a sign-on script for the browser extension116to use to sign-on to an intended application or resource120. The sign-on script may be written in a scripting language (e.g., JavaScript, HTML, ECMAScript, JSON, etc.), programming language or combination thereof. The sign-on script is used by the browser extension116to invoke the service provider108of the intended application or resource, facilitate an administrator session with the intended resource, fill in the configuration settings for SSO, respond to requests from the service provider, handle error conditions, and facilitate successful operation of the sign-on configuration process.

The template storage111stores templates and configuration data for each of the service providers. A template contains the specifications of the layout of the web page or user interface that is used by a service provider to obtain the configuration settings. The template contains the details of the HTML elements, CSS elements, layout of the elements, fields, boxes, etc. used in the web page or user interface and the navigation details of the service provider's administration module. A browser plug-in may include a website copier that copies the markup, style sheets, script, and resources from a web page. This data is then used by the template generator to generate a template for the service provider that details the layout of the service provider's configuration SSO web page.

A service provider108may include one or more servers that host one or more web applications or resources120. The service provider108stores SSO configuration settings122for the web applications and/or resource120hosted by the service provider108.

In this first exemplary system, the identity provider generates a single sign-on script customized for a service provider which is executed by the browser extension118. However, in some instances, the SSO configuration settings are configured by an administrator of the principal. This is often the case when the principal is an entity or organization that uses an administrator (i.e., Information Technology (IT) administrator, system administrator, etc.) to perform the configuration of the SSO settings. An administrator is a role designated for the person or persons who are responsible for the upkeep, management and reliability of the computer systems for an organization or entity. In this scenario, the administrator has to sign-on manually to the service provider before the configuration sign-on script is executed since the identity provider does not maintain the administrator's sign-on credentials for the service provider.

FIG. 1Billustrates a second exemplary system126of the present disclosure where the system126utilizes a trusted third party124to perform the administrator's sign-in to the service provider108before execution of the configuration sign-on script. In this manner, the configuration sign-on script may be executed without manual intervention by the administrator where the administrator is not authorized to access the service provider's administrator web site and has to utilize another administrator to perform the configuration on their behalf. The system126utilizes the same components shown above inFIG. 1Aand includes the trusted third party124. A trusted third party124is an entity which facilitates interactions between two parties who have an established trust with the trusted third party124. The principal114and the service provider108have an established trust with the trusted third party124so that the trusted third party124can sign-on to the service provider108as the administrator.

There are various techniques that may be used to establish trust between two parties and any such technique may be used. The trust may be implemented in cryptographic digital transactions as well as cryptographic protocols. A certificate authority may be used to issue a digital identity certificate to each party which is then used in the communications between each party in the trusted relationship.

AlthoughFIGS. 1A-1Bdepicts the system and process in a particular configuration, it should be noted that the subject matter disclosed herein is not constrained to the configuration shown inFIG. 1. For example, the client device102may utilize a rich client application rather than a browser to interact with the directory service. A rich client application is an application on a computing device that retrieves data from the Internet without the use of a browser.

Methods

Attention now turns to description of the various exemplary methods that utilize the system and device disclosed herein. Operations for the aspects may be further described with reference to various exemplary methods. It may be appreciated that the representative methods do not necessarily have to be executed in the order presented, or in any particular order, unless otherwise indicated. Moreover, various activities described with respect to the methods can be executed in serial or parallel fashion, or any combination of serial and parallel operations. In one or more aspects, the method illustrates operations for the systems and devices disclosed herein.

FIGS. 2 and 3illustrate an exemplary method200of a first aspect of the automated configuration single sign-on process. Initially, the administrator of the principal signs on to the directory service (block302) and the identity provider106authenticates the administrator and acknowledges the successful sign-on (block304). At some point thereafter, the administrator, through the browser extension118, requests that the identity provider106configure the SSO settings of a service provider108(block306). The identity provider provides the administrator, through the browser extension118, a web page202to initiate the configuration.

As shown inFIG. 2, the web page202obtains the single sign-on mode204, the entity identifier of the service provider206, and a reply URL208from the administrator. The single sign-on mode204indicates the SSO protocol used by the service provider, the entity identifier206designates the globally unique name of the service provider, and the reply URL208specifies where to redirect after the sign-on configuration is completed. Once the administrator fills in these fields204,206,208, the administrator clicks the One-Click SSO button210to initiate the automatic sign-on configuration process.

In response to the initiation of the One-Click SSO button210, the entity provider206and the reply URL208are then transmitted to the identity provider106which generates a configuration sign-on script for the service provider identified by the entity provider (block308). The configuration sign-on script is generated from a template associated with the service provider108and contains the layout of the service provider's SSO configuration web page and the fields that need to be filled in to configure the SSO settings (block308). The configuration sign-on script is transmitted to the browser extension118(block310).

In order for the browser extension118to execute the configuration sign-on script, the administrator has to sign-in to the service provider108using the administrator's credentials. The browser extension118facilitates the request for the administrator's login at the service provider108(block312). The administrator logins with the service provider (block314) and the service provider returns an acknowledgement back to the browser extension along with the configuration SSO web page (block314).

In some scenarios, the administrator's credentials are not shared with the identity provider for security concerns. As shown inFIG. 2, the browser extension receives the administrator login web page210for the administrator to fill in the administrator's credentials such as the administrator's login username212and the administrator's login password214. The service provider authenticates the administrator and acknowledges the administrator's successful login by returning a session cookie or a session token back to the browser extension or the browser extension looks for elements to be filled regardless of whether they appear or not.

Upon the browser extension receiving acknowledgment of the administrator's login, the browser extension executes the configuration SSO script to obtain the web page that contains the configuration settings for SSO (block316). The configuration SSO script fills in automatically the required settings for the particular protocol of choice (block318).

The configuration SSO settings are then saved at the service provider (block322) and a status message is returned back to the browser extension (block324). The browser extension receives the successful completion message and updates the browser web page with a successful completion status update (block326) and provides the identity provider with the success status (block328).

Referring toFIG. 2, there is shown the one-click SSO web page220with the successful completion status message222. At this point, the automatic configuration SSO is completed for this service provider. The steps shown inFIGS. 2 and 3may be repeated for other service providers.

FIG. 4illustrates an exemplary method400of a second aspect of the automated configuration single sign-on process. In this method400, a trusted third party is used to perform the administrator's login to the service provider thereby eliminating the administrator's intervention for that task. As shown inFIG. 4, the identity provider provides a web page402that obtains the input needed to configure the SSO settings at the service provider. The input includes the single sign-on mode404, the identifier406, and the reply URL408as described above.

When the One-click SSO button410is activated, the input is sent to the identity provider which in turn generates a configuration sign-on script that is transmitted to the trusted third party412. The trusted third party signs-in the administrator in the service provider through the service provider's administrator login414using the administrator's login credentials,416,418. The trusted third party412executes the configuration SSO script which fills in the configuration SSO settings420seamlessly. Once the SAVE button442is activated, a notification424is sent to the browser extension indicating successful completion.

FIG. 5illustrates the process shown inFIG. 4in more detail. Initially, the administrator of the principal requests sign-on to the directory service (block502) and the identity provider106authenticates the administrator and acknowledges the successful sign-on (block504). At some point thereafter, the administrator, through the browser extension118, requests that the identity provider106configure the SSO settings of a service provider and provides the entity id and reply URL to the identity provider106(block506).

The identity provider106receives the request and obtains the stored sign-on configuration data and template for the service provider and generates a configuration SSO script (block508). The configuration sign-on script is forwarded to the trusted third party124(block510) and the identity provider106initiates the trusted third party124to perform the administrator login (block512). The trusted third party124uses the administrator's credentials to sign into the administrator's account at the service provider108(block514). The service provider108authenticates the trusted third party124acting as the administrator (block516).

Once authenticated, the trusted third party124executes the configuration SSO script (block518) which executes the requisite commands to fill in the SSO settings at the service provider108(block520). The SSO configuration settings are saved (block522), and a status is returned to the identify provider (block524) which is recorded (block526).

FIGS. 6 and 7illustrate the configuration of a template used to generate the configuration SSO script. Each service provider associated with the directory service may utilize a different web page or user interface to input the SSO settings. The identity provider utilizes a template for each service provider that describes the layout, fields, input, buttons, and other elements of the web page or user interface that is used to input the SSO settings for a particular service provider. The use of the templates is scalable allowing the identity provider to accommodate a large number of service providers in an efficient manner.

Referring toFIG. 7, there is shown an exemplary method700where in one aspect of the present disclosure, the identity provider through a browser accesses the configuration SSO web page of a service provider (block702). The browser contains a plug-in or add-on module, such as a website copier or other web page inspection component, that has the capability of capturing the HTML and CSS elements in the web page that pertains to the layout, fields, and data used by the service provider. When the settings are manually configured in the configuration SSO web page, the browser is able to capture these settings as well (block704). The data extracted from the SSO configuration web page is formatted into a template (block706) and stored in the template storage111(block708).

As shown inFIG. 6, a browser in the identity provider captures the SSO configuration data from a SSO configuration web page602when the SSO configuration web page is manually configured with a particular set of settings604. The template generator113stores this data in a template606in the template storage111.

Referring toFIG. 8, there is shown an exemplary method800in one aspect of the disclosure of the template monitor113. The template monitor113monitors for changes made to the service provider's configuration SSO web page (block802). The template monitor113may capture the layout of the web page and compare it with the existing stored template. When a change is detected (block804—yes), the template monitor113notifies the template generator112of the change so that the template generator112can modify the template to reflect the changes (block806).

Exemplary Operating Environment

Attention now turns toFIG. 9and a discussion of an exemplary operating environment900. It should be noted that the operating environment900is exemplary and is not intended to suggest any limitation as to the functionality of the embodiments. The embodiments may be applied to an operating environment900having one or more client devices902coupled to one or more server devices904through network906. The server devices904form a cloud service that is available on demand through the Internet.

The client devices902and the server devices904may be any type of electronic device, such as, without limitation, a mobile device, a personal digital assistant, a mobile computing device, a smart phone, a cellular telephone, a handheld computer, a server, a server array or server farm, a web server, a network server, a blade server, an Internet server, a work station, a mini-computer, a mainframe computer, a supercomputer, a network appliance, a web appliance, a distributed computing system, multiprocessor systems, or combination thereof. The operating environment900may be configured in a network environment, a distributed environment, a multi-processor environment, or a stand-alone computing device having access to remote or local storage devices.

A client device902may include one or more processors908, a communication interface910, one or more storage devices912, a memory914, and one or more input/output (I/O) devices916. A processor908may be any commercially available processor and may include dual microprocessors and multi-processor architectures. The communication interface910facilitates wired or wireless communications between the client device902and other devices. The storage devices912may be computer-readable medium that do not contain propagating signals, such as modulated data signals transmitted through a carrier wave. Examples of the storage devices912include without limitation RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD), or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage, all of which do not contain propagating signals, such as modulated data signals transmitted through a carrier wave. The input/output (I/O) devices916may include a keyboard, mouse, pen, voice input device, touch input device, a display, speakers, printers, etc., and any combination thereof.

The memory914may be any non-transitory computer-readable storage media that may store executable procedures, applications, and data. The computer-readable storage media does not pertain to propagated signals, such as modulated data signals transmitted through a carrier wave. It may be any type of non-transitory memory device (e.g., random access memory, read-only memory, etc.), magnetic storage, volatile storage, non-volatile storage, optical storage, DVD, CD, floppy disk drive, etc. that does not pertain to propagated signals, such as modulated data signals transmitted through a carrier wave. The memory914may also include one or more external storage devices or remotely located storage devices that do not pertain to propagated signals, such as modulated data signals transmitted through a carrier wave.

The memory914may contain instructions, components, modules, and data. A component is a software program that perform a specific function and is otherwise known as a module, application, and the like. The memory914may include an operating system918, a browser920, a browser extension922, a configuration SSO script924, and various other applications, components, and data926.

A server device904also include one or more processors930, a communication interface932, one or more storage devices934, I/O devices936, and a memory938as described above. The memory938may include an operating system940, a SSO configuration module942, service provider configuration data and template storage944, template generator946, a template monitor948, a browser950and other applications and data952.

The network906may employ a variety of wired and/or wireless communication protocols and/or technologies. Various generations of different communication protocols and/or technologies that may be employed by a network may include, without limitation, Global System for Mobile Communication (GSM), General Packet Radio Services (GPRS), Enhanced Data GSM Environment (EDGE), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (W-CDMA), Code Division Multiple Access 2000, (CDMA-2000), High Speed Downlink Packet Access (HSDPA), Long Term Evolution (LTE), Universal Mobile Telecommunications System (UMTS), Evolution-Data Optimized (Ev-DO), Worldwide Interoperability for Microwave Access (WiMax), Time Division Multiple Access (TDMA), Orthogonal Frequency Division Multiplexing (OFDM), Ultra Wide Band (UWB), Wireless Application Protocol (WAP), User Datagram Protocol (UDP), Transmission Control Protocol/Internet Protocol (TCP/IP), any portion of the Open Systems Interconnection (OSI) model protocols, Session Initiated Protocol/Real-Time Transport Protocol (SIP/RTP), Short Message Service (SMS), Multimedia Messaging Service (MMS), or any other communication protocols and/or technologies.

CONCLUSION

A system is disclosed having at least one processor and a memory coupled to the at least one processor. The at least one processor is configured to: generate, by an identity provider, a configuration single sign-on (SSO) script to automatically configure the single sign-on settings of a service provider in a user interface, wherein the single sign-on settings are tailored for an authentication and authorization protocol utilized by the service provider, wherein the configuration SSO script is based on a template associated with the service provider, the template containing a layout of the user interface used to configure the single sign-on settings; and facilitate execution of the configuration SSO script to automatically configure the SSO settings in the service provider.

The authentication and authorization protocol uses the Security Assertion Markup Language (SAML) protocol. A browser extension executes the configuration SSO script in one aspect and in a second aspect, a trusted third party executes the configuration SSO script. The system is further configured to capture manual actions of a user inputting the single sign-on settings, and use the captured single sign-on settings in the template. In addition, the system can capture the layout of the user interface from a browser; and use the captured layout in the template. Upon successful completion of the configuration of the single sign-on settings in the service provider, the system provides notification of the successful completion. The system is able to monitor for a change made to the layout of the user interface; and upon detection of the change, update the template to reflect the change.

A device is disclosed having one or more processors communicatively connected to a memory. The memory includes instructions that when executed on the one or more processors perform actions that: store a plurality of templates, a template associated with a service provider, the template including information on a design of a web page, the web page including configuration settings of an authentication and authorization protocol used with the service provider; generate a configuration single sign-on (SSO) script for a select service provider based on a template associated with the select service provider, the configuration SSO script including instructions to automatically fill in the configuration settings on the rendered web page; and initiate execution of the configuration SSO script to a third party.

In one aspect, the third party is an administrator of a principal associated with the service provider and in another aspect, the third party is a trusted third party that executes the configuration SSO script on behalf to an administrator of a principal associated with the service provider. The authentication and authorization protocol is the SAML protocol. The memory includes further instructions that update a template upon detection of a change made to the design of the web page.

A method is disclosed that utilizes the device and system presented herein. The method comprises detecting, at an identity provider including at least one processor and a memory, a layout of a configuration single sign-on (SSO) web page of a service provider, the layout including at least one HTML element and at least one CSS element, the configuration SSO web page of the service provider including settings for an authentication and authorization protocol between the identity provider and the service provider; generating a template including the layout; creating a configuration SSO script using the template, the configuration SSO script including instructions that automatically fill in settings rendered in the configuration SSO web page; monitoring for at least one change to the template; and upon detection of the at least one change, updating the template.

The method further comprises transmitting the configuration SSO script to a principal of the identity provider for execution, prior to executing the configuration SSO script, enabling administrator access to the service provider, and transmitting the configuration SSO script to a trusted third party to execute the configuration SSO script. The trusted third party acts on behalf of an administrator of a principal who is associated with the identity provider. The settings are associated with the SAML protocol. The settings require configuration from an administrator.

Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims. It should be noted that although the disclosure has been described with respect to SAML, the present disclosure is not constrained to this particular protocol and that the techniques described herein may be applied to other standard authentication and authorization protocols, such as OAuth, OpenID Connect, Facebook Connect, Auth0 and the like.