# US 10,320,771 B2 · Single sign-on framework for browser-based applications and native applications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,771 B2 - Document ID: US10320771B2 - Status: Granted - Kind: B2 - Application number: 15/365,524 - Filed: 2016-11-30 - Published: 2018-05-31 - Granted: 2019-06-11 - Earliest claimed: 2016-11-30 - Assignees: AirWatch LLC - Applicants: VMware, Inc. - Inventors: Yogesh Govind Hande; Shravan Shantharam; Kalyan Regula; Varun Murthy; Bhuvanesh Shanmuga Sundaram; Jonathon Deriso - Web page: https://patentgrep.com/patent/US10320771B2 ## CPC - H04L 63/0815: {providing single-sign-on or federations} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Disclosed are various approaches for providing single sign-on capabilities for a user on a client device. A user's credentials can be authenticated by an identity provider application. The identity provider application can facilitate single sign-on capabilities for browser-based applications and native applications on the client device. ## Claims ### Claim 1 A system for providing a single sign-on capability to a browser-based application accessed by a browser: a client device comprising a processor and a memory, the client device executing the browser and configured to at least: store an authentication key on the client device in response to a previous authentication of credentials associated with a user account; transmit a request to authenticate access to the browser-based application from the client device to an identity provider server in response to the browser-based application accessing a link that requires federated user authentication; receive an authentication challenge embedded in a tbauth request from the identity provider server in response to the request to authenticate access, the tbauth request including a uniform resource identifier (URI) for which an identity provider application on the client device is registered as a local identity provider; retrieve the authentication key; transmit the authentication key and the authentication challenge to the identity provider server; and obtain an indication that the user account is authenticated by the identity provider server. ### Claim 2 (depends on 1) The system of claim 1, wherein the client device is further configured to at least: obtain a request to perform the previous authentication of the user account; transmit at least one of a username and a password of the user account to the identity provider server; obtain the authentication key from the identity provider server; and store the authentication key on the client device. ### Claim 3 (depends on 1) The system of claim 1, wherein the client device is further configured to at least redirect to a website that has federated authentication to the identity provider server in response to obtaining the indication that the user account is authenticated. ### Claim 4 (depends on 1) The system of claim 1, wherein the indication that the user account is authenticated comprises an authentication token or a cookie. ### Claim 5 (depends on 4) The system of claim 4, wherein the client device is further configured to store the authentication token or the cookie in a token store using an application programming interface (API) associated with an operating system executed by the client device. ### Claim 6 (depends on 1) The system of claim 1, wherein the authentication key is retrieved from a token store by the identity provider application, wherein the identity provider application registers as a local identity provider using an application programming interface (API) associated with an operating system of the client device, wherein the identity provider application specifies a particular identity provider server address for the identity provider server for which the identity provider application is the local identity provider. ### Claim 7 A method for providing a single sign-on capability to a browser-based application accessed by a browser on a client device, comprising: storing an authentication key on the client device in response to a previous authentication of credentials associated with a user account; transmitting a request to authenticate access to the browser-based application from the client device to an identity provider server in response to the browser-based application accessing a link that requires federated user authentication; receiving an authentication challenge embedded in a tbauth request from the identity provider server in response to the request to authenticate access, the tbauth request including a uniform resource identifier (URI) for which an identity provider application on the client device is registered as a local identity provider; retrieving the authentication key; transmitting the authentication key and the authentication challenge to the identity provider server; and obtaining an indication that the user account is authenticated by the identity provider server. ### Claim 8 (depends on 7) The method of claim 7, further comprising: obtaining a request to perform the previous authentication of the user account; transmitting at least one of a username and a password of the user account to the identity provider server; obtaining the authentication key from the identity provider server; and storing the authentication key on the client device. ### Claim 9 (depends on 7) The method of claim 7, further comprising redirecting to a website that has federated authentication to the identity provider server in response to obtaining the indication that the user account is authenticated. ### Claim 10 (depends on 7) The method of claim 7, wherein the indication that the user account is authenticated comprises an authentication token or a cookie. ### Claim 11 (depends on 10) The method of claim 10, further comprising storing the authentication token or the cookie in a token store using an application programming interface (API) associated with an operating system executed by the client device. ### Claim 12 (depends on 7) The method of claim 7, wherein the authentication key is retrieved from a token store by the identity provider application, wherein the identity provider application registers as a local identity provider using an application programming interface (API) associated with an operating system of the client device, wherein the identity provider application specifies a particular identity provider server address for the identity provider server for which the identity provider application is the local identity provider. ### Claim 13 A non-transitory computer-readable medium comprising machine-readable instructions providing a single sign-on capability to a browser-based application accessed by a browser on a client device, wherein when executed by a processor of the client device, the machine-readable instructions cause the client device to at least: store an authentication key on the client device in response to a previous authentication of credentials associated with a user account; transmit a request to authenticate access to the browser-based application from the client device to an identity provider server in response to the browser-based application accessing a link that requires federated user authentication; receive an authentication challenge embedded in a tbauth request from the identity provider server in response to the request to authenticate access, the tbauth request including a uniform resource identifier (URI) for which an identity provider application on the client device is registered as a local identity provider; retrieve the authentication key; transmit the authentication key and the authentication challenge to the identity provider server; and obtain an indication that the user account is authenticated by the identity provider server. ### Claim 14 (depends on 13) The non-transitory computer-readable medium of claim 13, wherein the instructions further cause the client device to at least: obtain a request to perform the previous authentication of the user account; transmit at least one of a username and a password of the user account to the identity provider server; obtain the authentication key from the identity provider server; and store the authentication key on the client device. ### Claim 15 (depends on 13) The non-transitory computer-readable medium of claim 13, wherein the indication that the user account is authenticated comprises an authentication token or a cookie. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the machine-readable instructions further cause the computing device to at least store the authentication token or the cookie in a token store using an application programming interface (API) associated with an operating system executed by the client device. ### Claim 17 (depends on 13) The non-transitory computer-readable medium of claim 13, wherein the authentication key is retrieved from a token store by the identity provider application, wherein the identity provider application registers as a local identity provider using an application programming interface (API) associated with an operating system of the client device, wherein the identity provider application specifies a particular identity provider server address for the identity provider server for which the identity provider application is the local identity provider.