SINGLE SIGN-ON FOR UNMANAGED MOBILE DEVICES

摘要

Disclosed are various examples for providing a single sign-on experience for mobile applications that may or may not be managed. A first application executed in a client device sends an access request to a service provider. The first application receives a redirection response from the service provider that redirects the first application to an identity provider. The first application then receives a further redirection response from the identity provider that causes the first application to request an identity assertion from a second application executed in the client device. The first application receives the identity assertion from the second application. The first authentication then authenticates with the service provider using the identity assertion.

主权项

1. A non-transitory computer-readable medium embodying a program executable in a client device, the program, when executed by the client device, being configured to cause the client device to at least:
receive a first request for an identity assertion from a client application executed in the client device, the first request being redirected from an identity provider; authenticate with the identity provider using at least one security credential; send a second request for the identity assertion to the identity provider; receive the identity assertion from the identity provider; and return the identity assertion to the client application.