Single sign-on functionality for secure communications over insecure networks

1. A method, comprising:

receiving, by a credentialing service, verification that a principal has been authenticated by a third-part authentication service;

delivering, by the credentialing service, a self-loading and self-executing applet to the principal;

receiving, by the credentialing service, a request for a communication credential from the applet;

generating, by the credentialing service, the communication credential as a random number tuple representing a user name and password combination for the principal; and

supplying, by the credentialing service, the communication credential to a Virtual Private Network (VPN) client, initiated by the applet on the principal, and to a VPN server, the communication credential used by the VPN client to establish a VPN session between the VPN client and the VPN server instead of requiring the principal to separately log into the VPN server, and further used to re-authenticate the VPN session without requiring the principal to separately log into the VPN server, wherein the VPN client is a Secure Socket Layer (SSL) client and the VPN server is a SSL server that utilize two-tier authentication techniques.

2. The method of claim 1 , wherein supplying further includes, providing the communication credential over the Internet, wherein the insecure network connection is an Internet connection.

3. The method of claim 1 further comprising, destroying the communication credential upon detecting a termination event.

4. A method, comprising:

requesting, by a client machine for a principal, a credential from a credentialing service to authenticate communications between a Virtual Private Network (VPN) client on the client machine and VPN server through a VPN tunnel that is to be established over an insecure network connection, the credential being generated by the credentialing service after receiving verification that the principal has been authenticated by a third-party authentication service, and the credentialing service separately supplying the credential to the VPN server in advance of any authentication by the VPN client;

receiving, by the client machine, a self-loading and self-executing applet that is dynamically delivered to and processes within an Internet browser of the client machine when the principal initially authenticates to the server via the third-party authentication service, the applet initiating the VPN client;

receiving, by the applet on the client machine, the credential as a random number tuple representing a valid user name and password combination for the principal in response to a request for the tuple by the applet; and

using, by the VPN client, the credential to authenticate communications of the principal to establish the VPN tunnel for secure interactions with the VPN server instead of requiring the principal to separately log into the VPN server, the credential further used to re-authenticate the VPN tunnel whenever authentication is requested for one or more of the secure interactions without requiring the principal to separately log into the VPN server, wherein the VPN client is a Secure Socket Layer (SSL) client and the VPN server is a SSL server that utilize two-tier authentication techniques.

5. The method of claim 4 , wherein requesting further includes requesting the credential from the credentialing service using Hypertext Transfer Protocol over a Secure Sockets Layer (HTTPS).

6. The method of claim 5 , wherein receiving further includes receiving the credential from the credentialing service using HTTPS.

7. The method of claim 4 , further comprising:

receiving the VPN client from the VPN server;

installing and executing the VPN client on the client machine; and

passing the credential to the VPN client to establish and maintain the VPN tunnel.

8. A system, comprising:

a Virtual Private Network (VPN) server implemented in a machine accessible medium and to process on a server machine;

a VPN client implemented in a machine accessible medium and to process on a client machine for a principal; and

an applet implemented in a machine accessible and readable medium and to be delivered from the VPN server to the client machine, wherein the applet is self-loaded and self-executed within a browser to acquire and initiate the VPN client from the VPN server over the insecure network using secure communications,

wherein the VPN server is to communicate securely with the VPN client over an insecure network, and is to randomly generate a random number tuple for a user name and password combination for a principal, in response to an initial request for the tuple from the applet, after a credentialing service receives verification that the principal has been authenticated by a third party authentication service, and

wherein the VPN client is to subsequently use the tuple to authenticate the principal to the VPN server for access to a secure VPN tunnel between the VPN client and the VPN server over the insecure network without requiring the principal to separately log into the VPN server, the tuple further being used to re-authenticate the VPN tunnel without requiring the principal to separately log into the VPN server, and

wherein the VPN client is an Secure Socket Layer (SSL) client and the VPN server is a SSL server that utilize a two-tier authentication technique.

9. The system of claim 8 further comprising, the authentication service implemented in a machine accessible and readable medium and to process on a machine, wherein the authentication service is to authenticate the principal using principal acquired credentials and is to further inform or indicate to the VPN server that the principal is authenticated.

10. The system of claim 8 , wherein the VPN server is to destroy the tuple on detection of a termination event.