# US 12,015,609 B2 · Secure identity provider authentication for native application to access web service > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,609 B2 - Document ID: US12015609B2 - Status: Granted - Kind: B2 - Application number: 18/411,622 - Filed: 2024-01-12 - Published: 2024-05-09 - Granted: 2024-06-18 - Earliest claimed: 2020-12-29 - Assignees: Inductive Automation, LLC - Applicants: Inductive Automation, LLC - Inventors: Joel Specht; Matthew Rojas - Web page: https://patentgrep.com/patent/US12015609B2 ## CPC - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 63/168: {above the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A native application on a client computing device enables secure user authentication via an identity provider (IdP) for accessing services of a web service provider. The native application forwards a redirect request generated by a main gateway of the service provider and including an IdP uniform resource locator (URL) to a system browser of the client computing device. The redirect request directs the system browser to a broker gateway of the service provider that registers an authentication response handler and redirects the system browser to the IdP URL to enable a user of the native client computing device to authenticate. After the broker gateway receives an IdP authentication response from the IdP following authentication by the user, the broker gateway provides the IdP authentication response to the native application for providing back to the main gateway. The main gateway finally processes the authentication response to complete the authentication request. ## Claims ### Claim 1 A method comprising: intercepting, by an authentication server, a web browser redirect requested from a broker gateway; redirecting, by the authentication server, a web browser to an identity provider using a cached security assertion markup language (“SAML”) authentication request received from a main gateway; and providing sequentially received partitioned SAML components from the broker gateway assembled into a SAML authentication response to the main gateway. ### Claim 2 (depends on 1) The method of claim 1, wherein the broker gateway receives the SAML authentication response from an identity provider and partitions the SAML authentication response into a plurality of partitioned components. ### Claim 3 (depends on 1) The method of claim 1, wherein assembling the partitioned SAML components comprises extracting a portion of the SAML authentication response from a URL corresponding to each of the partitioned SAML components and concatenating the extracted portions of the SAML authentication response. ### Claim 4 (depends on 3) The method of claim 3, wherein the broker gateway embeds portions of the SAML authentication response into the URLs such that a size of the URL is below the web browser URL size limit. ### Claim 5 (depends on 1) The method of claim 1, wherein the authentication server is initialized within a native application. ### Claim 6 (depends on 1) The method of claim 1, wherein the web browser redirect request is modified to be directed to the authentication server, and wherein the broker gateway registers a response handler using an authentication server port included within the modified redirect request. ### Claim 7 (depends on 1) The method of claim 1, wherein the main gateway generates the web browser redirect request in response to receiving a request for access from a native application. ### Claim 8 (depends on 7) The method of claim 7, wherein the web browser redirect request includes an identify provider (“IdP”) URL. ### Claim 9 (depends on 1) The method of claim 1, wherein the SAML authentication request is generated by the main gateway in response to a request for an SAML authentication request received from a native application. ### Claim 10 (depends on 9) The method of claim 9, wherein the native application communicates with the main gateway using a web view of the native application. ### Claim 11 A non-transitory computer-readable storage medium storing instructions that, when executed by a processor, cause the processor to perform operations comprising: intercepting, by an authentication server, a web browser redirect requested from a broker gateway; redirecting, by the authentication server, a web browser to an identity provider using a cached security assertion markup language (“SAML”) authentication request received from a main gateway; and providing sequentially received partitioned SAML components from the broker gateway assembled into a SAML authentication response to the main gateway. ### Claim 12 (depends on 11) The non-transitory computer-readable storage medium of claim 11, wherein the broker gateway receives the SAML authentication response from an identity provider and partitions the SAML authentication response into a plurality of partitioned components. ### Claim 13 (depends on 11) The non-transitory computer-readable storage medium of claim 11, wherein assembling the partitioned SAML components comprises extracting a portion of the SAML authentication response from a URL corresponding to each of the partitioned SAML components and concatenating the extracted portions of the SAML authentication response. ### Claim 14 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the broker gateway embeds portions of the SAML authentication response into the URLs such that a size of the URL is below the web browser URL size limit. ### Claim 15 (depends on 11) The non-transitory computer-readable storage medium of claim 11, wherein the authentication server is initialized within a native application. ### Claim 16 (depends on 11) The non-transitory computer-readable storage medium of claim 11, wherein the web browser redirect request is modified to be directed to the authentication server, and wherein the broker gateway registers a response handler using an authentication server port included within the modified redirect request. ### Claim 17 (depends on 11) The non-transitory computer-readable storage medium of claim 11, wherein the main gateway generates the web browser redirect request in response to receiving a request for access from a native application. ### Claim 18 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the web browser redirect request includes an identify provider (“IdP”) URL. ### Claim 19 (depends on 11) The non-transitory computer-readable storage medium of claim 11, wherein the SAML authentication request is generated by the main gateway in response to a request for an SAML authentication request received from a native application. ### Claim 20 (depends on 19) The non-transitory computer-readable storage medium of claim 19, wherein the native application communicates with the main gateway using a web view of the native application.