Intermediary handling of identity services to guard against client side attack vectors

An apparatus that facilitates authentication of an untrusted end user client, the apparatus having circuitry forming one or more processors and memory holding computer program instructions for execution on the one or more processors including computer program instructions that, when executed, cause the apparatus to:

• provide a proxy between an end user client and a relying party (RP) host;
• with the proxy, monitor responses sent from the RP host to an end user client so as to detect a message redirecting the end user client to an identity domain;
• responsive to said detection of the message:
• block the message from reaching the end user client;
• synchronously obtain a first credential from the end user client;
• independent from the end user client, communicate with an identity provider associated with the identity domain to exchange the first credential for an identity assertion;
• communicate with the RP host to exchange the identity assertion for a second credential;
• and,
• without exposing the second credential to the end user client, proxy one or more content requests from the end user client to the RP host using the second credential on behalf of the end user client.

A non-transitory computer readable medium storing program instructions for execution on one or more processors, the program instructions comprising instructions to authenticate an untrusted client device, at least by:

• providing a proxy between an end user client and a relying party (RP) host;
• with the proxy, monitoring responses sent from the RP host to an end user client so as to detect a message redirecting the end user client to an identity domain;
• responsive to said detection of the message:
• blocking the message from reaching the end user client;
• synchronously obtaining a first credential from the end user client;
• independent from the end user client, communicating with an identity provider associated with the identity domain to exchange the first credential for an identity assertion;
• communicating with the RP host to exchange the identity assertion for a second credential;
• and,
• without exposing the second credential to the end user client, proxying one or more content requests from the end user client to the RP host using the second credential on behalf of the end user client.