Authenticated data access using masked credential data

1 . A computer-implemented method, comprising:

receiving, by a processor of an application server, via executing a non-root process, and from a client device operated by a user having a first access level, a data retrieval request associated with accessing target data stored on a cloud storage platform;

providing, by the processor and via executing the non-root process, a script execution request to a root process having a second access level, wherein the second access level is greater than the first access level, and wherein the root process is configured to, based on receiving the script execution request:

execute a data retrieval script to perform operations comprising:

providing a credential data request associated with the data retrieval request and the cloud storage platform to a credential data management server;

based on the credential data request, receiving credential data from the credential data management server, wherein:

the credential data comprises a credential token,

the credential data is needed for establishing an authenticated connection, and

the credential data management server is configured to prevent access to the credential data by the non-root process based on the non-root process being non-root;

storing the credential data in a field of a data retrieval script; and

executing the data retrieval script based on the field, wherein executing the data retrieval script comprises:

establishing the authenticated connection between the root process and the cloud storage platform using the credential data comprising the credential token, and

accessing the target data using the authenticated connection;

providing, by the processor via the root process, the target data to the non-root process; and

receiving, by the processor, via executing the non-root process, and from the root process, the target data.

2 . The computer-implemented method of claim 1 , wherein the field is a local variable of the data retrieval script.

3 . The computer-implemented method of claim 1 , wherein the credential data management server is configured to retrieve the credential data based on an application identifier associated with the non-root process.

4 . The computer-implemented method of claim 1 , wherein the credential data management server is configured to retrieve the credential data based on a client identifier associated with the data retrieval request.

5 . The computer-implemented method of claim 1 , further comprising:

receiving, by the processor and from the client device, a data storage request associated with storing the target data in a local storage platform, wherein the local storage platform comprises a component of an application system, and the application system also comprises the application server;

providing, by the processor, an additional credential data request associated with the data storage request and the local storage platform to the credential data management server;

based on the additional credential data request, receiving, by the processor, additional credential data from the credential data management server;

storing, by the processor, the additional credential data in a field of a data storage script; and

executing, by the processor, the data storage script based on the field of the data storage script, wherein executing the data storage script comprises establishing an additional authenticated connection with the local storage platform and storing the target data using the additional authenticated connection.

6 . The computer-implemented method of claim 5 , wherein the additional authenticated connection is established using a Secure Shell File Transfer Protocol (SFTP) protocol.

7 . The computer-implemented method of claim 6 , wherein establishing the additional authenticated connection comprises providing the field of the data storage script using a bypass mechanism for a keyboard inactivity requirement of the STFP protocol.

8 . The computer-implemented method of claim 7 , wherein the bypass mechanism is an SSHPASS mechanism.

9 . The computer-implemented method of claim 5 , wherein the application system further comprises the credential data management server and the cloud storage platform is outside of the application system.

10 . The computer-implemented method of claim 1 , wherein:

the data retrieval script is executed by a first process of the application server; and

the application server is configured to prevent processes other than the first process from accessing the credential data.

11 . A computing system, comprising:

a processor of an application server; and

memory storing computer-executable instructions that, when executed by the processor, cause the computing system to perform operations comprising:

receiving, by the processor, via executing a non-root process, and from a client device operated by a user having a first access level, a data retrieval request associated with accessing target data stored on a cloud storage platform;

providing, by the processor and via executing the non-root process, a script execution request to a root process having a second access level, wherein the second access level is greater than the first access level, and wherein the root process is configured to, based on receiving the script execution request:

execute a data retrieval script to perform operations comprising:

providing a credential data request associated with the data retrieval request and the cloud storage platform to a credential data management server;

based on the credential data request, receiving credential data from the credential data management server, wherein;

 the credential data comprises a credential token,

 the credential data is needed for establishing an authenticated connection, and

 the credential data management server is configured to prevent access to the credential data by the non-root process based on the non-root process being non-root;

storing the credential data in a field of the data retrieval script; and

executing the data retrieval script based on the field, wherein executing the data retrieval script comprises:

 establishing the authenticated connection between the root process and cloud storage platform using the credential data comprising the credential token, and

 accessing the target data using the authenticated connection;

provide the target data to the non-root process; and

receiving, by the processor executing the non-root process and from the root process, the target data.

12 . The computing system of claim 11 , wherein the field is a local variable of the data retrieval script.

13 . The computing system of claim 11 , wherein the credential data management server is configured to retrieve the credential data based on a client identifier associated with the data retrieval request.

14 . The computing system of claim 11 , the operations further comprising:

receiving, by the processor and from the client device, a data storage request associated with storing the target data in a local storage platform, wherein the local storage platform comprises a component of an application system, and the application system also comprises the application server;

providing, by the processor, an additional credential data request associated with the data storage request and the local storage platform to the credential data management server;

based on the additional credential data request, receiving, by the processor, additional credential data from the credential data management server;

storing, by the processor, the additional credential data in a field of a data storage script; and

executing, by the processor, the data storage script based on the field of the data storage script, wherein executing the data storage script comprises establishing an additional authenticated connection with the local storage platform and storing the target data using the additional authenticated connection.

15 . One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by a processor of an application server, cause the processor to perform operations:

receiving, by the processor, executing a non-root process, and from a client device operated by a user having a first access level, a data retrieval request associated with accessing target data stored on a cloud storage platform;

providing, by the processor executing the non-root process, a script execution request to a root process having a second access level, wherein the second access level is greater than the first access level, and wherein the root process is configured to, based on receiving the script execution request:

execute a data retrieval script to perform first operations comprising:

providing a credential data request associated with the data retrieval request and the cloud storage platform to a credential data management server;

based on the credential data request, receiving credential data from the credential data management server, wherein:

the credential data comprises a credential token,

the credential data is needed for establishing an authenticated connection, and

the credential data management server is configured to prevent access to the credential data by the non-root process based on the non-root process being non-root;

storing the credential data in a field of the data retrieval script; and

executing the data retrieval script based on the field, wherein executing the data retrieval script comprises:

establishing the authenticated connection between the root process and the cloud storage platform using the credential data comprising the credential token, and

accessing the target data using the authenticated connection; and

providing, by the processor via the root process, the target data to the non-root process; and

receiving, by the processor executing the non-root process and from the root process, the target data.

16 . The one or more non-transitory computer-readable media of claim 15 , the operations further comprising:

receiving, by the processor and from the client device, a data storage request associated with storing the target data in a local storage platform, wherein the local storage platform comprises a component of an application system, and the application system also comprises the application server;

providing, by the processor, an additional credential data request associated with the data storage request and the local storage platform to the credential data management server;

based on the additional credential data request, receiving, by the processor, additional credential data from the credential data management server;

storing, by the processor, the additional credential data in a field of a data storage script; and

executing, by the processor, the data storage script based on the field of the data storage script, wherein executing the data storage script comprises establishing an additional authenticated connection with the local storage platform and storing the target data using the additional authenticated connection.