Policy based authentication for privileged remote access (PRA) systems

1 . A method comprising steps of:

receiving a request to access a Privileged Remote Access (PRA) system protected through a cloud-based system, wherein the request identifies a privileged console selected via a PRA portal and includes console information including a console name and a console type;

determining if any policy-based credential rules, preconfigured by an administrator, apply to a console associated with the request, wherein determining comprises, by an exporter of the cloud-based system, evaluating a credential mapping policy applicable to privileged consoles and different from an access policy applicable to an application segment, the credential mapping policy including an ordered set of rules that are evaluated in order to select a first applicable rule;

retrieving credentials associated with any of a user and the console from a database, thereby avoiding the user being required to provide credentials, wherein retrieving comprises retrieving, from the database, an encrypted privileged credential mapped to the first applicable rule, the encrypted privileged credential comprising any of (i) a username and password, (ii) a password, or (iii) a private key for authentication into the PRA system, and wherein the encrypted privileged credential is not sent in any API response to a user device and is not provided to a user;

decrypting the credentials using one or more crypto services and storing the decrypted credentials in memory for only a finite time in volatile memory and aging out the decrypted credentials from the volatile memory after the finite time; and

authenticating the request to access the PRA system and providing access to the requested PRA system based on the retrieved credentials, without requiring a user input, including injecting the retrieved credentials into a privileged session of the console, the privileged session comprising any of a Remote Desktop Protocol (RDP), Secure Shell (SSH), or Virtual Network Computing (VNC) session, further comprising forming connect instructions that include the decrypted credentials and sending the connect instructions from the exporter to an application connector, and wherein providing access comprises establishing, by the application connector using the connect instructions, the privileged session to the PRA system without requiring user input of the decrypted credentials.

2 . The method of claim 1 , wherein the credentials are retrieved based on matching credentials with the request, wherein preconfigured policy is configured by an administrator and is utilized for matching an identity of the user issuing the request to a stored credential.

3 . The method of claim 1 , wherein the database includes credentials stored in an encrypted form in database tables, and wherein the steps further include decrypting the credentials after the retrieving.

4 . The method of claim 1 , wherein credentials are retrieved based on a plurality of criteria including any of Security Assertion Markup Language (SAML) attributes, client posture, and end user network.

5 . The method of claim 1 , wherein responsive to no credentials being found, the steps further comprise:

providing an interactive credential retrieving window; and

instructing the user to provide credentials via the interactive credential retrieving window.

6 . A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:

receiving a request to access a Privileged Remote Access (PRA) system protected through a cloud-based system, wherein the request identifies a privileged console selected via a PRA portal and includes console information including a console name and a console type;

determining if any policy-based credential rules, preconfigured by an administrator, apply to a console associated with the request, wherein determining comprises, by an exporter of the cloud-based system, evaluating a credential mapping policy applicable to privileged consoles and different from an access policy applicable to an application segment, the credential mapping policy including an ordered set of rules that are evaluated in order to select a first applicable rule;

retrieving credentials associated with any of a user and the console from a database, thereby avoiding the user being required to provide credentials, wherein retrieving comprises retrieving, from the database, an encrypted privileged credential mapped to the first applicable rule, the encrypted privileged credential comprising any of (i) a username and password, (ii) a password, or (iii) a private key for authentication into the PRA system, and wherein the encrypted privileged credential is not sent in any API response to a user device and is not provided to a user;

decrypting the credentials using one or more crypto services and storing the decrypted credentials in memory for only a finite time in volatile memory and aging out the decrypted credentials from the volatile memory after the finite time; and

authenticating the request to access the PRA system and providing access to the requested PRA system based on the retrieved credentials, without requiring a user input, including injecting the retrieved credentials into a privileged session of the console, the privileged session comprising any of a Remote Desktop Protocol (RDP), Secure Shell (SSH), or Virtual Network Computing (VNC) session, further comprising forming connect instructions that include the decrypted credentials and sending the connect instructions from the exporter to an application connector, and wherein providing access comprises establishing, by the application connector using the connect instructions, the privileged session to the PRA system without requiring user input of the decrypted credentials.

7 . The non-transitory computer-readable medium of claim 6 , wherein the credentials are retrieved based on matching credentials with the request, wherein preconfigured policy is utilized for matching an identity of the user issuing the request to a stored credential.

8 . The non-transitory computer-readable medium of claim 6 , wherein the database includes credentials stored in an encrypted form, and wherein the steps further include decrypting the credentials after the retrieving.

9 . The non-transitory computer-readable medium of claim 6 , wherein credentials are retrieved based on a plurality of criteria including any of Security Assertion Markup Language (SAML) attributes, client posture, and end user network.

10 . The non-transitory computer-readable medium of claim 6 , wherein responsive to no credentials being found, the steps further comprise:

providing an interactive credential retrieving window; and

instructing the user to provide credentials via the interactive credential retrieving window.

11 . A cloud-based system comprising:

one or more processors and memory storing instructions that, when executed, cause the one or more processors to:

receive a request to access a Privileged Remote Access (PRA) system protected through the cloud-based system, wherein the request identifies a privileged console selected via a PRA portal and includes console information including a console name and a console type;

determine if any policy-based credential rules, preconfigured by an administrator, apply to a console associated with the request, wherein determining comprises, by an exporter of the cloud-based system, evaluating a credential mapping policy applicable to privileged consoles and different from an access policy applicable to an application segment, the credential mapping policy including an ordered set of rules that are evaluated in order to select a first applicable rule;

retrieve credentials associated with any of a user and the console from a database, thereby avoiding the user being required to provide credentials, wherein retrieving comprises retrieving, from the database, an encrypted privileged credential mapped to the first applicable rule, the encrypted privileged credential comprising any of (i) a username and password, (ii) a password, or (iii) a private key for authentication into the PRA system, and wherein the encrypted privileged credential is not sent in any API response to a user device and is not provided to a user;

decrypting the credentials using one or more crypto services and storing the decrypted credentials in memory for only a finite time in volatile memory and aging out the decrypted credentials from the volatile memory after the finite time; and

authenticate the request to access the PRA system and provide access to the requested PRA system based on the retrieved credentials, without requiring a user input, including injecting the retrieved credentials into a privileged session of the console, the privileged session comprising any of a Remote Desktop Protocol (RDP), Secure Shell (SSH), or Virtual Network Computing (VNC) session, further comprising forming connect instructions that include the decrypted credentials and sending the connect instructions from the exporter to an application connector, and wherein providing access comprises establishing, by the application connector using the connect instructions, the privileged session to the PRA system without requiring user input of the decrypted credentials.

12 . The cloud-based system of claim 11 , wherein the credentials are retrieved based on matching credentials with the request, wherein preconfigured policy is utilized for matching an identity of the user issuing the request to a stored credential.

13 . The cloud-based system of claim 11 , wherein the database includes credentials stored in an encrypted form, and wherein the instructions further cause the one or more processors to decrypt the credentials after the retrieving.

14 . The cloud-based system of claim 11 , wherein credentials are retrieved based on a plurality of criteria including any of Security Assertion Markup Language (SAML) attributes, client posture, and end user network.

15 . The cloud-based system of claim 11 , wherein responsive to no credentials being found, the instructions further cause the one or more processors to:

provide an interactive credential retrieving window; and

instruct the user to provide credentials via the interactive credential retrieving window.