Hybrid authentication systems and methods

A system for hybrid authentication, the system comprising:

• a processor;
• a non-transitory computer readable medium;
• and
• stored instructions translatable by the processor to provide a cloud-based authentication service in a cloud computing environment, wherein the cloud-based authentication service is adapted for:
• receiving, from a user device, login credentials of a user associated with a tenant of the cloud computing environment;
• responsive to receipt of the login credentials of the user, invoking, through a tunnel connection between a tunnel server operating in the cloud computing environment and a tunnel agent operating in an enterprise computing environment, an on-premises authentication service on a second computer operating in the enterprise computing environment, wherein the invoking including sending an authentication request to the on-premises authentication service through the tunnel connection, the authentication request containing the login credentials of the user, wherein the login credentials of the user is used by the on-premises authentication service to obtain a user profile for the user;
• receiving, from the on-premises authentication service through the tunnel connection, the user profile for the user;
• generating an authentication code using the user profile;
• communicating the authentication code to a cloud-based application running on the user device, wherein the cloud-based application obtains an access token from the cloud-based authentication service using the authentication code;
• and
• responsive to a request from the cloud-based application, passing, to the on-premises authentication service through the tunnel connection, the access token contained in the request from the cloud-based application, wherein the on-premises authentication service verifies the access token, impersonates the user, and processes the request via an on-premises application.

A computer program product for hybrid authentication, the computer program product comprising a non-transitory computer-readable medium storing instructions translatable by a processor to provide a cloud-based authentication service in a cloud computing environment, wherein the cloud-based authentication service is adapted for:

• receiving, from a user device, login credentials of a user associated with a tenant of the cloud computing environment;
• responsive to receipt of the login credentials of the user, invoking, through a tunnel connection between a tunnel server operating in the cloud computing environment and a tunnel agent operating in an enterprise computing environment, an on-premises authentication service on a second computer operating in the enterprise computing environment, wherein the invoking including sending an authentication request to the on-premises authentication service through the tunnel connection, the authentication request containing the login credentials of the user, wherein the login credentials of the user is used by the on-premises authentication service to obtain a user profile for the user;
• receiving, from the on-premises authentication service through the tunnel connection, the user profile for the user;
• generating an authentication code using the user profile;
• communicating the authentication code to a cloud-based application running on the user device, wherein the cloud-based application obtains an access token from the cloud-based authentication service using the authentication code;
• and
• responsive to a request from the cloud-based application, passing, to the on-premises authentication service through the tunnel connection, the access token contained in the request from the cloud-based application, wherein the on-premises authentication service verifies the access token, impersonates the user, and processes the request via an on-premises application.