Systems and methods for authorizing third-party authentication to a service

A method comprising:

• receiving a request from a user to use a third-party authentication service to authenticate the user to an online service provided by an online service provider subsystem;
• in response to the receiving of the request, directing the user to authenticate to the third-party authentication service;
• responsive to the directing, receiving a third-party user identifier for the user from the third-party authentication service;
• responsive to the receiving of the third-party user identifier, generating a unique token based at least in part on the received third-party user identifier, wherein the online service provider subsystem maintains data representative of the unique token, the third-party user identifier, and a link between the unique token and the third-party user identifier;
• responsive to the generating of the unique token, generating a Uniform Resource Locator (“URL”) that includes the unique token and an address of an authorization invocation page;
• sending the URL to a user device associated with the user;
• receiving, from the user device, a request to access the authorization invocation page, the request including the URL;
• providing the authorization invocation page to the user device;
• receiving, from the user device by way of the authorization invocation page, login credentials specific to the user and the online service;
• validating the login credentials;
• using the validated login credentials to identify a service account associated with the user;
• using the unique token in the URL included in the request to access the authorization invocation page to identify the third-party user identifier;
• and
• linking the third-party user identifier to the service account associated with the user such that the third-party user identifier is usable to authenticate the user to the online service;
• wherein the online service provider subsystem performs the receiving of the request, the directing of the user to authenticate, the receiving of the third-party user identifier, the generating of the unique token, the generating of the URL, the sending of the URL, the receiving of the request to access the authorization invocation page, the providing of the authorization invocation page, the receiving of the login credentials, the validating, the using of the login credentials, the using of the unique token, and the linking of the third-party user identifier.

A system comprising:

• an authentication facility configured to:
• receive a request from a user to use a third-party authentication service to authenticate the user to an online service and responsive to the receiving of the request,
• direct the user to authenticate to the third-party authentication service, and responsive to the directing,
• receive, from the third-party authentication service, a third-party user identifier for the user;
• and
• an authorization facility communicatively coupled to the authentication facility and configured to:
• require the user to verify an identity of the user by:
• generating a unique token based at least in part on the received third-party user identifier,
• maintaining data representative of the unique token, the third-party user identifier, and a link between the unique token and the third-party user identifier,
• generating a Uniform Resource Locator (“URL”) that includes the unique token and an address of an authorization invocation page used to verify the identity of the user,
• sending the URL to a user device associated with the user;
• receiving, from the user device, a request to access the authorization invocation page, the request including the URL;
• providing the authorization invocation page to the user device;
• receiving, from the user device by way of the authorization invocation page, login credentials specific to the user and the online service;
• and
• validating the login credentials;
• and
• authorize, based on the verified identity of the user, use of the third-party user identifier to authenticate the user to the online service.