Certificate-based single sign-on (SSO) from mobile applications over the internet

An apparatus configured as an identity provider (IdP) to facilitate establishment of a secure session to a network-accessible application from a mobile device executing a native app, comprising:

• a processor;
• computer memory holding computer program instructions executed by the processor, the computer program instructions comprising program code configured to:
• configure the network-accessible application for access by mobile device users by associating a set of one or more enterprise users with the network-accessible application;
• receive a request to validate that an enterprise user seeking access to the network-accessible application is associated with the network-accessible application, the request to validate having been generated by the network-accessible application in response to a login request initiated from the native app to the network-accessible application from a mobile device of the enterprise user, wherein a certificate for the network-accessible application is not available to the native app executing on the mobile device;
• and
• upon validating that the enterprise user is associated with the network-accessible application, return to the network-accessible application an authentication token, the authentication token evidencing that the enterprise user is permitted to access the network-accessible application for a session;
• wherein upon receipt of the authentication token, access to the network-accessible application from the native app executing on the mobile device is enabled for the session.

A computer program product in a non-transitory computer readable medium for use in a data processing system configured as an identity provider (IdP), the identity provider configured to facilitate establishment of a secure session to a network-accessible application from a mobile device executing a native app, the computer program product holding computer program instructions executed by the data processing system, the computer program instructions comprising program code configured to:

• configure the network-accessible application for access by mobile device users by associating a set of one or more enterprise users with the network-accessible application;
• receive a request to validate that an enterprise user seeking access to the network-accessible application is associated with the network-accessible application, the request to validate having been generated by the network-accessible application in response to a login request initiated from the native app to the network-accessible application from a mobile device of the enterprise user, wherein a certificate for the network-accessible application is not available to the native app executing on the mobile device;
• and
• upon validating that the enterprise user is associated with the network-accessible application, return to the network-accessible application an authentication token, the authentication token evidencing that the enterprise user is permitted to access the network-accessible application for a session;
• wherein upon receipt of the authentication token, access to the network-accessible application from the native app executing on the mobile device is enabled for the session.