Abstract: Heuristics can be used to determine if an alternate behavior is desired on a particular mobile device to enable one-touch sign-out. The alternate behavior can be the appearance of a sign-out experience and mechanism. For example, instead of a “sign out” link appearing, an “end of shift” link can be displayed. Heuristics can be used to determine if a particular mobile device is a shared device. If the device is a shared device, this information can be made discoverable to mobile applications (e.g. by including a “shared device” flag in authentication tokens). When a mobile application finds the shared device flag indicates the device is shared, the “Sign-out” link for the mobile application can be replaced with an “End my shift” link. In response to a user clicking on the link, a global sign out can delete session artifacts on the device and/or on the server. Refresh tokens can be revoked to ensure that a user is signed out of third party mobile applications.

Abstract: An LDE authentication system is provided for granting to an LDE device access to a resource of a resource provider. In accordance with the LDE authentication system, an LDE device sends to the resource provider a request to access the resource. The LDE device receives an indication sent by the resource provider to authenticate the resource provider using an identity provider. A non-LDE device sends to the identity provider credentials for use in authentication and receives an authentication code sent by the identity provider that indicates successful authentication by the identity provider. The LDE device receives the authentication code that was received by the non-LDE device. The LDE device sends to the identity provider the authentication code and receives an authentication token sent by the identity provider in response to receiving the authentication code. The LDE device sends to the resource provider the authentication token and accesses the resource.