Techniques for controlling authentication

1. A method implemented in a non-transitory machine-readable storage medium and processed by one or more processors of a processing device and configured to perform the method, comprising:

intercepting, by the processing device acting as a transparent proxy to a principal, a request from the principal that is made to access a resource, the resource is external to an enterprise processing environment and a device used by the principal within the enterprise processing environment is not preconfigured to interact with the transparent proxy, and wherein intercepting further includes authenticating the principal for access to the enterprise processing environment using enterprise credentials and ensuring that the principal has a valid session with an agent of the enterprise processing environment that includes an authentication token representing domain-based authentication of a desktop for the principal, the enterprise credentials are different from third-party credentials processed for authenticating the principal for access to the resource;

determining, by the processing device, that the resource utilizes a third-party authentication provider for authenticating access to the resource;

supplying, by the processing device, the third-party credentials to the third-party authentication provider to authenticate the principal to the resource, wherein supplying further includes managing the third-party credentials securely within the enterprise processing environment and the third-party credentials are unknown to, unavailable to, never supplied by, and never available to the principal and the enterprise credentials for the principal never leave the enterprise environment; and

proxying, by the processing device and from within the enterprise processing environment, an authentication session between the principal and the resource after successful authentication via the third-party authentication provider, the authentication session proxied by the enterprise environment for interactions between the principal and the resource during that authentication session.

2. The method of claim 1 further comprising, tracking, by the processing device, actions of the principal during the authenticated session.

3. The method of claim 2 further comprising, reporting, by the processing device, on any of the actions that violate a policy.

4. The method of claim 1 , wherein determining further includes detecting a redirection from an interface of the resource to the third-party authentication provider that requests a third-party identifier and the third-party credentials.

5. The method of claim 1 , wherein supplying further includes registering the principal for authentication services of the third-party authentication provider when the third-party credentials are not present within the enterprise processing environment to obtain the third-party credentials for the principal.

6. The method of claim 1 , wherein proxying further includes terminating the authenticated session when an action of the principal or the resource during the authenticated session violates a policy.

7. The method of claim 1 , wherein proxying further includes providing a warning message to the principal during the authenticated session when an action of the principal violates a policy.

8. The method of claim 7 , wherein providing further includes logging the action for automated reporting and notification actions.

9. A system, comprising:

a processing device configured with an authentication control agent that resides and is implemented as executable instructions within a non-transitory computer-readable storage medium that executes on the processing device as a transparent proxy within an enterprise processing environment; and

another processing device or the processing device configured with an authentication audit manager that resides and is implemented within a non-transitory computer-readable storage medium that executes on one of the processing devices;

the authentication control agent configured to intercept an access request to an external resource made by a principal and configured to identify a third-party authentication provider for the external resource and provide credentials on behalf of the principal for the principal to be authenticated to the external resource for an authenticated session, the principal unaware of the credentials, and the authentication audit manager is configured to proxy the authenticated session from within the enterprise processing environment and monitor actions of the principal during the authenticated session, wherein the authenticated session is proxied by the enterprise processing environment for interactions between the principal and the external resource during the authenticated session, where a device accessed by the principal is not preconfigured to access the transparent proxy, and wherein the principal is to authenticated to the enterprise processing environment using local credentials that do not leave control of the enterprise environment, and wherein the credentials are different from the local credentials and the credentials are unknown to the principal, the principal is unaware of the credentials, the principal never supplied the credentials, and the principal never have the credentials made available to principal, and wherein the authentication control agent is further configured, when the principal is authenticated to the enterprise processing environment, to: ensure that the principal has a valid session with an agent of the enterprise processing environment that includes an authentication token representing domain-based authentication of a desktop for the principal.

10. The system of claim 9 , wherein the third-party authentication provider is an industry consortium provider that provides single sign on services to principal via the credentials to the external resource and other external resources.