Single sign-on for managed mobile devices

A method for providing single sign-on using a management application, comprising:

• authenticating, by the management application executed in a computing device, with a device management service over a network,
• the computing device:
• including a plurality of managed applications installed thereon, each of the plurality of managed applications signed by one of a plurality of certificates,
• including a plurality of compliance rules managed by the device management service,
• in communication with the device management service executing on a server remote from the computing device, and
• rendering a user interface upon launch of the management application;
• receiving, by the management application and from the device management service, configuration to enforce the plurality of compliance rules;
• by the management application, causing the computing device to at least:
• receive, at the management application, a single sign-on request from a client application executed by the computing device;
• send, from the management application to the device management service, a request for a management credential that allows the management application to provide access to the plurality of managed application, wherein the request includes credentials entered into the user interface by the user;
• in an instance where the device management service determines that the credentials are valid, receive the management credential at the management application from the device management service, wherein:
• receiving the management credential is contingent on a determination by the device management service that the user is authenticated and that the management application is in an authenticated state with the device management service;
• and
• wherein the user may access each of the plurality of managed applications using the received management credential to be automatically authenticated with any of the plurality of managed applications without re-entering the entered credentials;
• provide, by the management application, the received management credential to the client application,
• establish a corresponding access-restricted storage area for each of the plurality of managed applications;
• and
• establish a secure communications link that conveys data comprising a plurality of data portions from the device management service to the computing device, each of the data portions for storage in one of the corresponding access-restricted storage areas,
• wherein the stored data portions are accessible only by a respective managed application corresponding to the corresponding access-restricted storage area storing the stored data portion and any of the other of the plurality of managed applications signed with the same one of the plurality of certificates that signed the respective managed application which corresponds to the corresponding access-restricted storage area storing the stored data portion;
• wherein a first compliance rule of the plurality of compliance rules restricts the user from capturing, sharing, or otherwise removing the conveyed data from the access-restricted storage areas, and
• wherein a second compliance rule of the plurality of compliance rules instructs the computing device to erase the conveyed data from the access-restricted storage areas in an instance where the client device is lost or stolen.

A non-transitory computer-readable medium embodying a program comprising a management application executable in a client device, the program, when executed by the client device, being configured to cause the client device to at least:

• authenticate with a device management service over a network;
• receive at the management application from the device management service configuration to enforce a plurality of compliance rules;
• receive, at the management application, a single sign-on request from a client application executed by the computing device,
• the computing device:
• including a plurality of managed applications installed thereon, each of the plurality of managed applications signed by one of a plurality of certificates;
• including the plurality of compliance rules managed by the device management service,
• in communication with the device management service executing on a server remote from the computing device, and
• rendering a user interface upon launch of the management application;
• send, from the management application to the device management service, a request for a management credential that allows the management application to provide access to the plurality of managed application, wherein the request includes credentials entered into the user interface by the user;
• in an instance where the device management service determines that the credentials are valid, receive the management credential at the management application from the device management service, wherein:
• receiving the management credential is contingent on a determination by the device management service that the user is authenticated and that the management application is in an authenticated state with the device management service;
• and
• wherein the user may access each of the plurality of managed applications using the received management credential to be automatically authenticated with any of the plurality of managed applications without re-entering the entered credentials;
• provide, by the management application, the received management credential to the client application,
• establish a corresponding access-restricted storage area for each of the plurality of managed applications;
• and
• establish a secure communications link that conveys data comprising a plurality of data portions from the device management service to the computing device, each of the data portions for storage in one of the corresponding access-restricted storage areas,
• wherein the stored data portions are accessible only by a respective managed application corresponding to the corresponding access-restricted storage area storing the stored data portion and any of the other of the plurality of managed applications signed with the same one of the plurality of certificates that signed the respective managed application which corresponds to the corresponding access-restricted storage area storing the stored data portion;
• wherein a first compliance rule of the plurality of compliance rules restricts the user from capturing, sharing, or otherwise removing the conveyed data from the access-restricted storage areas, and
• wherein a second compliance rule of the plurality of compliance rules instructs the computing device to erase the conveyed data from the access-restricted storage areas in an instance where the client device is lost or stolen.