Step-up authentication for single sign-on

A non-transitory, computer-readable storage medium comprising instructions that, when executed by a processor of a computing device of a user, performs stages for authenticating a user seeking access to first and second resources having different authentication levels, the stages comprising:

• receiving, at a token agent installed on a computing device of a user, information authenticating the user, wherein the token agent is not a browser;
• sending, from the token agent to an authentication server, a request for a primary token authorizing access to the first resource, the request including the information authenticating the user;
• receiving the primary token at the token agent, from the authentication server, wherein the token agent associates the primary token with a plurality of applications installed on the computing device;
• receiving, at the token agent, a request to access the second resource from a first application of the plurality of applications installed on the computing device;
• sending, from the token agent to the authentication server, the primary token and the request to access the second resource;
• receiving, at the token agent, instructions from the authentication server to perform a second authentication event;
• in response to receiving instructions from the authentication server to perform a second authentication event, launching a user interface on the computing device through which the user provides authentication information for the second authentication event;
• sending, from the token agent to the authentication server, information associated with the second authentication event;
• receiving, at the token agent, an updated primary token from the authentication server, wherein the token agent associates the updated primary token with more than one of the plurality of applications installed on the computing device;
• resubmitting, from the token agent to the authentication server, the request to access the second resource from the first application, the resubmitted request including the updated primary token;
• and
• receiving, at the token agent, a secondary token from the authentication server, the secondary token authorizing the first application to access the second resource.

A system for authenticating a user seeking access to first and second resources that have different authentication levels, comprising:

• a computing device assigned to a user and having a plurality of applications installed, the computing device comprising a processor and a memory storage;
• and
• a token agent installed on the computing device, wherein the token agent operates on the computing device as a background process that receives token requests from the plurality of applications, and wherein the token agent is not a browser;
• wherein the processor of the computing device is programmed to carry out stages for authentication of the user, the stages comprising:
• receiving information authenticating the user at the token agent;
• sending, from the token agent to the authentication server, a request for a primary token authorizing access to the first resource, the request including the information authenticating the user;
• receiving the primary token at the token agent, from the authentication server, wherein the token agent associates the primary token with a plurality of applications installed on the computing device;
• receiving, at the token agent, a request to access the second resource from a first application of the plurality of applications installed on the computing device;
• sending, from the token agent to the authentication server, the primary token and the request to access the second resource;
• receiving, at the token agent, instructions from the authentication server to perform a second authentication event;
• in response to receiving instructions from the authentication server to perform a second authentication event, launching a user interface on the computing device through which the user provides authentication information for the second authentication event;
• sending, from the token agent to the authentication server, information associated with the second authentication event;
• receiving, at the token agent, an updated primary token from the authentication server, wherein the token agent associates the updated primary token with more than one of the plurality of applications installed on the computing device;
• resubmitting, from the token agent to the authentication server, the request to access the second resource from the first application, the resubmitted request including the updated primary token;
• and
• receiving, at the token agent, a secondary token from the authentication server, the secondary token authorizing the first application to access the second resource.