Using an out-of-band password to provide enhanced SSO functionality

A system for using an out-of-band password to provide enhanced SSO functionality comprising a processor, a memory coupled to the processor, and a computer-readable hardware storage device coupled to the processor, the storage device containing program code configured to be run by the processor via the memory to implement a method for using an out-of-band password to provide enhanced SSO functionality, the method comprising:

• the processor receiving notice of a user's access request from an Identity Provider (IDP) of a Federated Single Sign-On (F-SSO) federation, wherein the access request requests access to a service provided by a Service Provider (SP) of the federation, and wherein the federation does not support Single Sign-On functionality for that service;
• the processor, in response to receiving the notice, identifying and validating the user;
• the processor sending a temporary password to the user, wherein the temporary password is subject to constraints selected from a group consisting of:
• limiting the temporary password to a certain number of uses, limiting the temporary password to use during a single session of the secured service, limiting the temporary password to use during a specified period of time, limiting the temporary password to use during a specified period of time after the first use of the temporary password, and requiring the user to perform an additional authentication procedure when entering the temporary password;
• the processor updating an information repository with a value of the temporary password;
• the processor detecting that the user has entered a correct value of the temporary password;
• the processor generating a single-use password;
• and
• the processor communicating the single-use password to the user, such that the user may use the single-use password to access the service, and wherein the in-band communication is a secure communication that is communicated through a medium under control of the Service Provider to a device under control of the Service Provider.

A computer program product, comprising a computer-readable hardware storage device having a computer-readable program code stored therein, the program code configured to be executed by a system comprising a processor, a memory coupled to the processor, and a computer-readable hardware storage device coupled to the processor, the storage device containing program code configured to be run by the processor via the memory to implement a method for using an out-of-band password to provide enhanced SSO functionality, the method comprising:

• the processor receiving notice of a user's access request from an Identity Provider (IDP) of a Federated Single Sign-On (F-SSO) federation, wherein the access request requests access to a service provided by a Service Provider (SP) of the federation, and wherein the federation does not support Single Sign-On functionality for that service;
• the processor, in response to receiving the notice, identifying and validating the user;
• the processor sending a temporary password to the user, wherein the temporary password is subject to constraints selected from a group consisting of:
• limiting the temporary password to a certain number of uses, limiting the temporary password to use during a single session of the secured service, limiting the temporary password to use during a specified period of time, limiting the temporary password to use during a specified period of time after the first use of the temporary password, and requiring the user to perform an additional authentication procedure when entering the temporary password;
• the processor updating an information repository with a value of the temporary password;
• the processor detecting that the user has entered a correct value of the temporary password;
• the processor generating a single-use password;
• and
• the processor communicating the single-use password to the user, such that the user may use the single-use password to access the service, and wherein the in-band communication is a secure communication that is communicated through a medium under control of the Service Provider to a device under control of the Service Provider.