Single sign-on for unmanaged mobile devices

A system, comprising:

• at least one computing device;
• and
• a service provider executable by the at least one computing device, the service provider configured to cause the at least one computing device to at least:
• receive an access request from a first client application executed in a client device;
• cause the first client application, using a redirection response that redirects the access request to an identity provider, to request an authentication token from a second client application executed in the client device;
• receive the authentication token from the first client application;
• and
• authenticate the first client application in response to verifying the authentication token.

A method, comprising:

• receiving an access request from a first client application executed in a client device;
• redirecting the first client application to request an authentication token from a second client application executed in the client device;
• receiving the authentication token from the first client application;
• verifying the authentication token;
• and
• authenticating the first client application.