Native application single sign-on

1. A method of providing single sign-on, the method comprising:

establishing a virtual private network (VPN) connection between a client device and an authentication service;

receiving, at the authentication service, via the VPN connection, a request from a third-party application on the client device, the request for a third-party service;

requesting a log-in page from the third-party service, the log-in page including one or more log-in fields usable to enter credential information;

modifying the log-in page, the modifying hiding the one or more log-in fields;

obtaining credentials corresponding to a user of the client device and also corresponding to the third-party service;

sending the modified log-in page to the client device via the VPN connection;

receiving a log-in submission, via the VPN connection, from the third-party application; and

submitting, to the third-party service, the credentials corresponding to the user and to the third-party service to log-in the user to the third-party service.

2. The method of claim 1 , further comprising:

detecting that the user has multiple possible credential identifications for the third-party service;

wherein the modifying comprises injecting a credentials chooser into the log-in page, the credentials chooser, when run, presenting the user with a choice of the multiple possible credential identifications;

wherein the receiving a log-in submission comprises receiving a selection of one of the multiple possible credential identifications; and

wherein the submitting the credentials comprises submitting credentials corresponding to the selection.

3. The method of claim 1 , wherein the modifying the log-in page includes removing code corresponding to the one or more log-in fields from the log-in page.

4. The method of claim 1 , wherein the modifying the log-in page includes inserting code in the log-in page, the code causing the one or more fields to not be visible to the user when the log-in page is displayed.

5. The method of claim 1 , wherein the receiving a log-in submission comprises receiving dummy credentials; and

wherein the submitting the credentials includes replacing the dummy credentials with the credentials corresponding to the user and to the third-party service.

6. The method of claim 1 , wherein the obtaining credentials comprises obtaining credentials from a data store managed by the authentication service.

7. A system comprising:

an authentication service comprising one or more processors and configured to:

establish a virtual private network (VPN) connection between a client device and an authentication service;

receive, at the authentication service, via the VPN connection, a request from a third-party application on the client device, the request for a third-party service;

request a log-in page from the third-party service, the log-in page including one or more log-in fields usable to enter credential information;

modify the log-in page, the modifying hiding one or more log-in fields;

obtain credentials corresponding to a user of the client device and also corresponding to the third-party service;

send the modified log-in page to the client device via the VPN connection;

receive a log-in submission, via the VPN connection, from the third-party application; and

submit, to the third-party service, the credentials corresponding to the user and to the third-party service to log-in the user to the third-party service.

8. The system of claim 7 , wherein the client device is a mobile device.

9. A non-transitory machine-readable storage medium comprising instructions, which when implemented by one or more machines, cause the one or more machines to perform operations comprising:

establishing a virtual private network (VPN) connection between a client device and an authentication service;

receiving, at the authentication service, via the VPN connection, a request from a third-party application on the client device, the request for a third-party service;

requesting a log-in page from the third-party service, the log-in page including one or more log-in fields usable to enter credential information;

modifying the log-in page, the modifying hiding the one or more log-in fields;

obtaining credentials corresponding to a user of the client device and also corresponding to the third-party service;

sending the modified log-in page to the client device via the VPN connection;

receiving a log-in submission, via the VPN connection, from the third-party application; and

submitting, to the third-party service, the credentials corresponding to the user and to the third-party service to log-in the user to the third-party service.

10. The non-transitory machine-readable storage medium of claim 9 , wherein the operations further comprise:

detecting that the user has multiple possible credential identifications for the third-party service;

wherein the modifying comprises injecting a credentials chooser into the log-in page, the credentials chooser, when run, presenting the user with a choice of the multiple possible credential identifications;

wherein the receiving a log-in submission comprises receiving a selection of one of the multiple possible credential identifications; and

wherein the submitting the credentials comprises submitting credentials corresponding to the selection.

11. The non-transitory machine-readable storage medium of claim 9 , wherein the modifying the log-in page includes removing code corresponding to the one or more log-in fields from the log-in page.

12. The non-transitory machine-readable storage medium of claim 9 , wherein the modifying the log-in page includes inserting code in the log-in page, the code causing the one or more fields to not be visible to the user when the log-in page is displayed.