# US 2018/0324172 A1 · Single sign-on for remote applications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0324172 A1 - Document ID: US20180324172A1 - Status: Published application - Kind: A1 - Application number: 14/611,275 - Filed: 2015-02-01 - Published: 2018-11-08 - Earliest claimed: 2015-02-01 - Inventors: Mahesh Unnikrishnan; Samuel Devasashayam; Arun Nanda - Web page: https://patentgrep.com/patent/US20180324172A1 ## CPC - H04L 63/0815: {providing single-sign-on or federations} - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/102: {Entity profiles} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The present disclosure is directed to a method and system for obtaining or allowing single sign-on capability for remote applications. The system receives a request a user device to register with a remote application or desktop service. The system then authenticates the user with the service, by receiving the user's credentials, and generating an access token and a single sign-on token. The user is presented with a list of remote applications that can be accessed through the service. The system receives the indication of the selection by the user and then proceeds to authenticate the user with the remote application. The remote application connects with the authentication service and presents the tokens that were generated in a certificate request to the authentication service. The authentication service uses this request and obtains a certificate authority a logon certificate that is used to log the user into the remote application. ## Claims ### Claim 1 A method for obtaining single sign-on capability for at least two remote applications, the method comprising: receiving a request to register an access application on a user device with a remote application service on a remote device; authenticating a user of the access application with the service; receiving an indication of a selection of a remote application by the user; authenticating the user with the selected remote application based upon the authentication of the user with the service and without requesting additional credentials from the user a second time; and granting access to the user to access the remote application. ### Claim 2 (depends on 1) The method of claim 1 wherein one of the at least two remote applications is on a different virtual machine than another of the at least two remote applications. ### Claim 3 (depends on 1) The method of claim 1 wherein authenticating the user with the access application further comprises, generating a single sign-on token for the user. ### Claim 4 (depends on 1) The method of claim 1 wherein authenticating the user with the access application further comprises: issuing an access token and a refresh token for the access application to access the remote application service. ### Claim 5 (depends on 1) The method of claim 1 wherein authentication the user with the selected remote application further comprises: connecting to a remote desktop hosting the selected remote application; and authenticating the user with the selected remote application based upon an access token associated with the authentication of the user with the remote application service. ### Claim 6 (depends on 5) The method of claim 5 further comprising: validating the access token. ### Claim 7 (depends on 5) The method of claim 5 further comprising: creating a certificate signing request. ### Claim 8 (depends on 5) The method of claim 5 further comprising: creating a logon certificate request; validating the logon certificate request; and returning a logon certificate to the remote desktop. ### Claim 9 (depends on 8) The method of claim 8 wherein validating the logon certificate is performed by a certificate authority separate from an authentication service. ### Claim 10 (depends on 8) The method of claim 8 wherein validating the logon certificate is performed by an authentication service. ### Claim 11 (depends on 1) The method of claim 1 further comprising: receiving an indication of a selection of a second remote application from the user; authenticating the user with the second remote application based without requesting additional credentials from the user; and granting access to the user to access the second remote application following successful authentication of the user. ### Claim 12 A system for permitting a single sign on experience to at least two remote applications comprising: at least two remote applications, the at least two remote applications requiring that a user is authenticated to access the application prior to granting the user access to the application; an authentication service configured to authenticate the user to access the at least two remote applications and further configured to authenticate the user to access a remote application service; and the remote application service hosting the at least two remote applications, the remote application service configured to receive credentials from a user to access the service and to receive from the authentication service at least one token indicating that the user is authorized to access the service, and further configured to use the at least one token to authenticate the user to use one of the at least two remote applications. ### Claim 13 (depends on 12) The system of claim 12 further comprising: a user device configured to connect with the remote application service through an application on the user device, the application configured to display to the user an interface that that the user can select at least one of the at least two remote applications. ### Claim 14 (depends on 12) The system of claim 12 further comprising: a certificate authority configured to provide a logon certificate to the authentication service in response to a certificate request from the authentication service when the certificate request can be validated by the certificate authority. ### Claim 15 (depends on 14) The system of claim 14 wherein the certificate authority is a component of the authentication service. ### Claim 16 (depends on 12) The system of claim 12 wherein the authentication service further comprises: a security token service, configured to issue access and refresh tokens for the user upon validation of the user. ### Claim 17 (depends on 16) The system of claim 16 wherein the security token service is further configured to redirect the user to a second authentication service, and to receive from the second authentication service an indication that the user has been authenticated. ### Claim 18 (depends on 17) The system of claim 17 wherein the second authentication service is an authentication service controlled by an organization different from an organization controlling the authentication service. ### Claim 19 (depends on 12) The system of claim 12 wherein the remote application service is configured to receive from the user an indication of a selection of a different remote application and further configured to request a logon certificate from the authentication service for the different remote application without receiving additional input from the user. ### Claim 20 A computer readable storage medium having computer executable instructions that when executed by at least one computer having at least one processor causes the computer to: register an application disposed on a user device with a remote application service; authenticate the user with the remote application service by providing from the remote application service user supplied credentials to an authentication service and receiving from the authentication service an access token granting the user access to the remote application service; connect the user with a remote application hosted by a remote desktop on the remote application service; authenticate the user to access the remote application by providing a request for a logon certificate to a credential authority wherein the request is based upon the access token received when authenticating the user to the service; receive a logon certificate from the credential authority; and log the user on to the remote application using the logon certificate.