Single sign on proxy for regulating access to a cloud service
AssigneePalo Alto Network, Inc.
InventorNishant Doshi
Life of this patent
Estimating the term…
Abstract
Embodiments disclosed herein provide systems, methods, and computer readable media for using a single sign-on proxy to regulate access to a cloud service. In a particular embodiment, a method provides receiving an authentication request from a user system directed to a SSO service and determining whether the authentication request satisfies at least one criterion for allowing access to the cloud service associated with the SSO service. Upon determining that the authentication request satisfies the at least one criterion, the method provides forwarding the authentication request to the SSO service.
Claims14
A method of regulating access to a cloud service using a single sign-on (SSO) proxy, the method comprising:
- in the SSO proxy:
- receiving an authentication request from a user system directed to a SSO service;
- in response to receiving the authentication request, determining whether the authentication request satisfies at least one criterion for allowing access to the cloud service associated with the SSO service, wherein determining whether the authentication request satisfies at least one criterion comprises determining whether the authentication request was received from a geographic location that satisfies a geographic location limitation included in the at least one criterion and determining whether the authentication request was received at a time that satisfies a time limitation included in the at least one criterion;
- upon determining that the authentication request satisfies the at least one criterion, forwarding the authentication request to the SSO service;
- after the SSO service authenticates the authentication request, determining that the at least one criterion is no longer satisfied;
- and
- upon determining that the at least one criterion is no longer satisfied, transferring a sign-off request to the SSO service.
A single sign-on (SSO) proxy system for regulating access to a cloud service, the SSO proxy system comprising:
- a communication interface configured to receive an authentication request from a user system directed to a SSO service;
- a processing system configured to, in response to the communication interface receiving the authentication request, determine whether the authentication request satisfies at least one criterion for allowing access to the cloud service associated with the SSO service, wherein to determine whether the authentication request satisfies at least one criterion the processing system determines whether the authentication request was received from a geographic location that satisfies a geographic location limitation included in the at least one criterion and determines whether the authentication request was received at a time that satisfies a time limitation included in the at least one criterion;
- the communication interface further configured to, upon determining that the authentication request satisfies the at least one criterion, forward the authentication request to the SSO service;
- the processing system further configured to, after the SSO service authenticates the authentication request, determine that the at least one criterion is no longer satisfied;
- and
- the communication interface further configured to, upon the processing system determining that the at least one criterion is no longer satisfied, transfer a sign-off request to the SSO service.
A non-transitory computer readable storage medium having instructions stored thereon for regulating access to a cloud service, the instructions, when executed by a single sign-on (SSO) proxy system, direct the SSO proxy system to:
- receive an authentication request from a user system directed to a SSO service;
- in response to receiving the authentication request, determine whether the authentication request satisfies criteria for allowing access to the cloud service associated with the SSO service, wherein to determine whether the authentication request satisfies at least one criterion the instruct the SSO proxy system to determine whether the authentication request was received from a geographic location that satisfies a geographic location limitation included in the at least one criterion and determine whether the authentication request was received at a time that satisfies a time limitation included in the at least one criterion;
- upon determining that the authentication request satisfies the criteria, forward the authentication request to the SSO service;
- after the SSO service authenticates the authentication request, determine that the at least one criterion is no longer satisfied;
- and
- upon determining that the at least one criterion is no longer satisfied, transfer a sign-off request to the SSO service.
Dependencies are inferred from the claim text.