Browser credential management for virtual execution environments

1. A method, comprising:

upon initializing a virtual machine (VM) managed by a virtual machine manager (VMM) running on a host computer system, communicating credential manager data stored in a local database of the host computer system to a credential manager application programming interface (API) of the VM;

receiving, by the VMM, a credential manager API request intercepted by a hook module installed into a browser running on the VM;

forwarding the intercepted API request to a VM client application;

receiving, from the VM client application, a client response to the intercepted API request;

producing, using the client response, a VMM response to the intercepted API request; and forwarding the VMM response to the hook module.

2. The method of claim 1 , wherein producing the VMM response further comprises:

forwarding the intercepted API request to a credential manager API; receiving, from the credential manager API, a credential manager response to the intercepted API request; selecting, among the client response and the credential manager response, a response having a more recent timestamp.

3. The method of claim 2 , further comprising:

responsive to determining that a first timestamp associated with the credential manager response is more recent than a second timestamp associated with the client response, forward at least part of the credential manager response to the VM client application.

4. The method of claim 1 , wherein the intercepted API request represents a request to perform one of:

enumerate items in a credential database, find items in the credential database, retrieve an item from the credential database, add an item to the credential database, or remove an item from the credential database.

5. A non-transitory computer-readable storage medium comprising executable instructions that, when executed by a computer system, cause the computer system to:

receive, by a virtualization server application, a credential manager application programming interface (API} request intercepted by a hook module installed into a browser running within a virtual execution environment managed by the virtualization server;

forward the intercepted API request to a virtualization client application associated with the virtualization server;

receive, from the virtualization client application, a client response to the intercepted API request;

forward the intercepted API request to a credential manager API;

receive, from the credential manager API, a credential manager response to the intercepted API request;

select, among the client response and the credential manager response, a response having a more recent timestamp; and

forward selected response to the hook module.

6. The non-transitory computer-readable storage medium of claim 5 , wherein the virtualization server application is provided by one of: a virtual machine manager or a terminal server.

7. The non-transitory computer-readable storage medium of claim 5 , wherein the virtual execution environment is provided by one of: a virtual machine or a terminal session.

8. The non-transitory computer-readable storage medium of claim 5 , wherein the virtualization client application is provided by one of: a VM client application or a terminal service client application.

9. The non-transitory computer-readable storage medium of claim 5 , wherein the intercepted API request represents a request to perform one of:

enumerate items in a credential database, find items in the credential database, retrieve an item from the credential database, add an item to the credential database, or remove an item from the credential database.

10. The non-transitory computer-readable storage medium of claim 5 , further comprising executable instructions to:

responsive to determining that a first timestamp associated with the credential manager response is more recent than a second timestamp associated with the client response, forward at least part of the credential manager response to the VM client application.

11. The non-transitory computer-readable storage medium of claim 5 , further comprising executable instructions to:

cause the virtualization client application to install the hook module into the browser to monitor browser-initiated requests to the credential manager API.

12. The non-transitory computer-readable storage medium of claim 11 , wherein installing the hook module further comprises:

responsive to detecting a new browser window being opened within the virtualization client application, installing the hook into a processing thread associated with the new browser window.

13. The non-transitory computer-readable storage medium of claim 11 , wherein installing the hook module further comprises:

responsive to detecting a new browser process having been initiated within the virtualization client application, installing the hook into a processing thread associated with the new browser process.

14. A method, comprising:

responsive to detecting a new browser process having been initiated on a virtual machine (VM) managed by a virtual machine manager (VMM) running on a host computer system, causing the VM to install a hook module into a processing thread associated with the new browser process, wherein the hook is configured to monitor browser-initiated requests to a credential manager application programming interface (API) of the VM;

receiving, by the VMM, a credential manager API request intercepted by the hook module;

forwarding the intercepted API request to a VM client application;

receiving, from the VM client application, a client response to the intercepted API request;

producing, using the client response, a VMM response to the intercepted API request; and

forwarding the VMM response to the hook module.

15. The method of claim 14 , wherein producing the VMM response further comprises:

forwarding the intercepted API request to a credential manager API; receiving, from the credential manager API, a credential manager response to the intercepted API request; selecting, among the client response and the credential manager response, a response having a more recent timestamp.

16. The method of claim 14 , further comprising:

responsive to determining that a first timestamp associated with the credential manager response is more recent than a second timestamp associated with the client response, forward at least part of the credential manager response to the VM client application.

17. The method of claim 14 , wherein the intercepted API request represents a request to perform one of:

enumerate items in a credential database, find items in the credential database, retrieve an item from the credential database, add an item to the credential database, or remove an item from the credential database.