Cross-platform single sign-on accessibility of a productivity application within a software as a service platform

A system for single sign-on accessibility of a web-based application at an application service, comprising:

• a processing unit;
• and
• a memory including instructions stored thereon for providing cross-platform single sign-on accessibility, which when executed by the processing unit, causes the system to:
• request, from a proxy token service, access to a web-based application based on an access request received from a user via the application service;
• receive a response from the proxy token service indicating that an identity (ID) token is needed to access the web-based application and redirecting the request to a directory service, wherein the need for the ID token indicates that the web-based application has not yet been accessed by the user via the application service and indicates that user account credentials need to be supplied to the directory service;
• based on the response from the proxy token server, request, from the directory service, access to the web-based application, wherein the request includes user account credentials for the web-based application;
• receive a response from the directory service including the ID token and an authorization code based upon the directory service determining that the user account credentials are authorized to access the web-based application;
• post the ID token and the authorization code to the proxy token service and store the ID token and the authorization code in storage accessible by the proxy token service;
• receive an access token from the proxy token service, the proxy token service having previously acquired, and stored in the storage, the access token by redeeming the posted authorization code at the directory service;
• and
• provide the access token to the application service to receive authorization to access the web-based application;
• and
• when authorization to access the web-based application based is received, based on the access token being received at the application service, display the web-based application in a user-accessible format.

A computer-readable memory device including instructions stored thereon for providing single sign-on accessibility of a web-based application at an application service, the instructions comprising:

• requesting, from a proxy token service, access to a first web-based application based on an access request received from a user via the application service;
• receiving a response from the proxy token service indicating that an identity (ID) token is needed to access the first web-based application and redirecting the request to a directory service, wherein the need for the ID token indicates that the first web-based application has not yet been accessed by the user via the application service and indicates that account credentials need to be supplied to the directory service;
• based on the response from the proxy token server, requesting, from the directory service, access to the first web-based application, wherein the request includes user account credentials for the first web-based application;
• receiving a response from the directory service including the ID token and an authorization code based upon the directory service determining that the user account credentials are authorized to access the first web-based application;
• posting the ID token and the authorization code to the proxy token service and storing the ID token and the authorization code in storage accessible by the proxy token service;
• receiving an access token from the proxy token service, the proxy token service having previously acquired, and stored in the storage, the access token by redeeming the posted authorization code at the directory service where the access token is assigned an expirable period of time;
• providing the access token to the application service for receiving authorization to access the first web-based application;
• displaying the first web-based application based on the received authorization;
• terminating the first web-based application and the display of the first web-based application;
• receiving a subsequent request to access the first web-based application from the user via the application service;
• in response to the subsequent request to access the first web-based application, requesting, from the proxy token service, access to the application;
• receiving the access token from the proxy token service based on the proxy token service having determined that an ID token is not required due to the access token already being stored in storage, wherein the access token was previously authorized for the expirable period of time;
• and
• providing the access token to the application service for receiving authorization to access the first web-based application.