Steering traffic on a flow-by-flow basis by a single sign-on service

A system comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable media storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• receiving, at a first single sign-on (SSO) service and from a client device, first data including a first request to authenticate a user of the client device to access a service provider;
• generating, at the first SSO service, second data representing a second request configured to prompt a second SSO service to authenticate the user of the client device;
• sending the second data to the client device;
• receiving an indication from the client device that an identity of the user was authenticated by the second SSO service;
• determining, at the first SSO service and based at least in part on the identity of the user and a service of the service provider which the user is attempting to access, whether:
• (i) a communication flow from the client device is allowed to access the service of the service provider using an unsecured connection;
• or
• (ii) the communication flow from the client device is to be routed through a security service before being provided access to the service of the service provider to result in a secured connection;
• in response to determining that the communication flow is allowed to access the service using the unsecured connection, routing the communication flow to the service;
• and
• in response to determining that the communication flow is to be routed through the security service before being provided access to the service to result in the secured connection, routing the communication flow to the security service.

A system comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable media storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• receiving, at a first single sign-on authentication service, first data including a first request to authenticate a user of a client device to access an application of a service provider;
• sending, to at least one of the client device or a second authentication service, second data representing a second request configured to prompt the second authentication service to authenticate the user of the client device;
• receiving an indication that the user was authenticated by the second authentication service;
• and
• determining, at the first single sign-on authentication service and based at least in part on an attribute associated with the client device and the application of the service provider which the user is attempting to access, whether:
• (i) a communication flow from the client device is allowed to access the application of the service provider using an unsecured connection;
• or (ii) the communication flow from the client device is to be routed through a security service before being provided access to the application of the service provider to result in a secured connection;
• in response to determining that the communication flow is allowed to access the application using the unsecured connection, routing the communication flow to the application;
• and in response to determining that the communication flow is to be routed through the security service before being provided access to the application to result in the secured connection, routing the communication flow to the security service.