Security group authentication

A method for security group authentication, comprising:

• receiving a request from a user to perform an action;
• determining, using a hardware processor, that a current authentication level for the user is not adequate to perform the action based at least in part on a current authentication type associated with the user, comprising:
• determining whether the action is permitted under a first set of access restrictions associated with the current authentication type associated with a security group associated with the user, wherein the first set of access restrictions is associated with a first security group, wherein a second set of access restrictions is associated with a second security group, wherein each factor associated with the first security group is the same or is more restrictive than each corresponding factor of the second security group, wherein a factor associated with the first security group is more restrictive than a corresponding factor of the second security group, and wherein the security group is determined based on the following factors:
• whether the user is an administrative user or a basic user, the basic user being more restrictive than the administrative user;
• a network associated with a login of the user from a login request, the network being a corporate network or a home network, the home network being more restrictive than the corporate network;
• and
• an allowed authentication type, the allowed authentication types including at least two of the following in order of most restrictive to least restrictive:
• username and password, single sign-on authentication, certificate authentication, or required two-factor authentication;
• and
• in response to a determination that the action is not permitted under the first set of access restrictions, determining that the current authentication level for the user is not adequate to perform the action, comprising:
• determining that the action is not permitted in response to a determination that the network is the home network and the user is logged in with the current authentication type;
• determining that a new authentication level for the user is adequate to perform the action, wherein the new authentication level for the user is associated with a different authentication type, wherein allowed authentication types associated with the security group include the current authentication type and a new authentication type, and wherein the determining that the new authentication level for the user is adequate to perform the action comprises:
• determining whether the action is permitted under the second set of access restrictions associated with the different authentication type associated with the security group associated with the user;
• and
• in response to a determination that the action is permitted under the second set of access restrictions, determining that the new authentication level for the user is adequate to perform the action, comprising:
• performing one or more of the following:
• logging onto the corporate network using the current authentication type to obtain the new authentication level to perform the action using the corporate network;
• or
• upgrading, via the home network, the current authentication type to a more restrictive authentication type by performing the new authentication type to obtain the new authentication level to perform the action using the home network;
• providing a request to authenticate the new authentication level to the user, wherein the current authentication level and the new authentication level are associated with the security group;
• and
• in response to a determination that authentication information is valid for the different authentication type, permitting the user to perform the action.

A computer program product for security group authentication, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

• receiving a request from a user to perform an action;
• determining, using a hardware processor, that a current authentication level for the user is not adequate to perform the action based at least in part on a current authentication type associated with the user, comprising:
• determining whether the action is permitted under a first set of access restrictions associated with the current authentication type associated with a security group associated with the user, wherein the first set of access restrictions is associated with a first security group, wherein a second set of access restrictions is associated with a second security group, wherein each factor associated with the first security group is the same or is more restrictive than each corresponding factor of the second security group, wherein a factor associated with the first security group is more restrictive than a corresponding factor of the second security group, and wherein the security group is determined based on the following factors:
• whether the user is an administrative user or a basic user, the basic user being more restrictive than the administrative user;
• a network associated with a login of the user from a login request, the network being a corporate network or a home network, the home network being more restrictive than the corporate network;
• and
• an allowed authentication type, the allowed authentication types including at least two of the following in order of most restrictive to least restrictive:
• username and password, single sign-on authentication, certificate authentication, or required two-factor authentication;
• and
• in response to a determination that the action is not permitted under the first set of access restrictions, determining that the current authentication level for the user is not adequate to perform the action, comprising:
• determining that the action is not permitted in response to a determination that the network is the home network and the user is logged in with the current authentication type;
• determining that a new authentication level for the user is adequate to perform the action, wherein the new authentication level for the user is associated with a different authentication type, wherein allowed authentication types associated with the security group include the current authentication type and a new authentication type, and wherein the determining that the new authentication level for the user is adequate to perform the action comprises:
• determining whether the action is permitted under the second set of access restrictions associated with the different authentication type associated with the security group associated with the user;
• and
• in response to a determination that the action is permitted under the second set of access restrictions, determining that the new authentication level for the user is adequate to perform the action, comprising:
• performing one or more of the following:
• logging onto the corporate network using the current authentication type to obtain the new authentication level to perform the action using the corporate network;
• or
• upgrading, via the home network, the current authentication type to a more restrictive authentication type by performing the new authentication type to obtain the new authentication level to perform the action using the home network;
• providing a request to authenticate the new authentication level to the user, wherein the current authentication level and the new authentication level are associated with the security group;
• and
• in response to a determination that authentication information is valid for the different authentication type, permitting the user to perform the action.