System and method for proxying federated authentication protocols
AssigneeDuo Security, Inc.
InventorsJon Oberheide, Douglas Song
Life of this patent
Estimating the term…
Abstract
A system and method that include receiving a service provider identity request through a protocol; transmitting a proxy identity request to a configured identity provider; receiving an identity assertion; determining a proxy identity assertion based on the identity assertion; and transmitting the proxy identity assertion to the service provider.
Claims20
A computer-implemented method comprising:
- at one or more instances of a federated authentication proxy on a server:
- receiving a service provider identity request from a service provider;
- transmitting a proxy identity request based on the service provider identity request to a configured identity provider;
- receiving an identity request assertion from the configured identity provider;
- performing a second layer of authentication of the service provider identity request;
- determining a proxy identity assertion based on the identity request assertion and results of the second layer of authentication;
- and
- transmitting the proxy identity assertion to the service provider as a response to the service provider identity request.
A apparatus comprising:
- a computer readable medium configured to store instructions;
- and
- a processor configured to execute the instructions to implement one or more instances of a federated authentication proxy on a server and to perform:
- receiving a service provider identity request from a service provider;
- transmitting a proxy identity request based on the service provider identity request to a configured identity provider;
- receiving an identity request assertion from the configured identity provider;
- performing a second layer of authentication of the service provider identity request;
- determining a proxy identity assertion based on the identity request assertion and results of the second layer of authentication;
- and
- transmitting the proxy identity assertion to the service provider as a response to the service provider identity request.
A non-transitory computer readable medium storing instructions that, when executed by a processor of a proxy server, cause the processor to implement one or more instances of a federated authentication proxy and to perform:
- receiving a service provider identity request from a service provider;
- transmitting a proxy identity request based on the service provider identity request to a configured identity provider;
- receiving an identity request assertion from the configured identity provider;
- performing a second layer of authentication of the service provider identity request;
- determining a proxy identity assertion based on the identity request assertion and results of the second layer of authentication;
- and
- transmitting the proxy identity assertion to the service provider as a response to the service provider identity request.
Dependencies are inferred from the claim text.