Secure binding workflow

1. A system comprising one or more computers and one or more storage devices storing instructions that, when executed by the one or more computers, cause the one or more computers to perform operations comprising:

receiving a service bind request for an application in a cloud application platform system, wherein the service bind request comprises a request to bind a service provided by a service host in the cloud application platform system, wherein the service bind request specifies (i) an identifier for the service and (ii) a unique identifier for the application;

receiving, from the service host, credentials for the application to access the service;

providing the credentials to a secure credential hub installed on the cloud application platform system, wherein the secure credential hub stores the credentials in association with a credential location identifier;

granting, to the unique identifier for the application, read access to the credential location identifier; and

storing the credential location identifier as application metadata for the application.

2. The system of claim 1 , wherein the operations further comprise:

receiving a request to populate the credentials within an environment of the application;

generating, by a computing resource host that hosts the application within the cloud application platform system, a certificate that encodes the unique identifier of the application;

providing, by the computing resource host to the secure credential hub, the certificate that encodes the unique identifier of the application and the credential location identifier; and

receiving, by the computing resource host from the secure credential hub, the credentials for the application to access the service.

3. The system of claim 2 , wherein the operations further comprise:

populating the credentials within a process environment of a running instance of the application on the computing resource host,

wherein the application is configured to access the service by obtaining the credentials from the process environment.

4. The system of claim 3 , wherein populating the credentials within a process environment of a running instance of the application on the computing resource host occurs at application launch.

5. The system of claim 2 , wherein the secure credential hub verifies that the application has read access to the location identified by the credential location identifier.

6. The system of claim 2 , wherein generating the certificate includes generating a public and private key pair.

7. The system of claim 2 , wherein generating the certificate includes signing the certificate with an intermediate certificate.

8. The system of claim 7 , wherein the computing resource host is preconfigured with the intermediate certificate.

9. The system of claim 1 , wherein storing the credential location identifier as application metadata for the application comprises storing the credential location identifier in a centralized database on the cloud application platform, and wherein the operations further comprise:

retrieving, by a computing resource host that hosts the application within the cloud application platform, the credential location identifier from the centralized database.

10. The system of claim 1 , wherein providing the credentials to a secure credential hub comprises:

authenticating with a preconfigured client.

11. The system of claim 1 , wherein the unique identifier is for an application that has not yet launched.

12. The system of claim 1 , wherein the credential location identifier is a path.

13. The system of claim 1 , wherein multiple applications have read access to a same credential location identifier.

14. A method comprising:

receiving a service bind request for an application in a cloud application platform system, wherein the service bind request comprises a request to bind a service provided by a service host in the cloud application platform system, wherein the service bind request specifies (i) an identifier for the service and (ii) a unique identifier for the application;

receiving, from the service host, credentials for the application to access the service;

providing the credentials to a secure credential hub installed on the cloud application platform system, wherein the secure credential hub stores the credentials in association with a credential location identifier;

granting, to the unique identifier for the application, read access to the credential location identifier; and

storing the credential location identifier as application metadata for the application.

15. The method of claim 14 , further comprising:

receiving a request to populate the credentials within an environment of the application;

generating, by a computing resource host that hosts the application within the cloud application platform system, a certificate that encodes the unique identifier of the application;

providing, by the computing resource host to the secure credential hub, the certificate that encodes the unique identifier of the application and the credential location identifier; and

receiving, by the computing resource host from the secure credential hub, the credentials for the application to access the service.

16. The method of claim 15 , further comprising:

populating the credentials within a process environment of a running instance of the application on the computing resource host,

wherein the application is configured to access the service by obtaining the credentials from the process environment.

17. The method of claim 16 , wherein populating the credentials within a process environment of a running instance of the application on the computing resource host occurs at application launch.

18. The method of claim 15 , wherein the secure credential hub verifies that the application has read access to the location identified by the credential location identifier.

19. The method of claim 15 , wherein generating the certificate includes generating a public and private key pair.

20. The method of claim 15 , wherein generating the certificate includes signing the certificate with an intermediate certificate.

21. The method of claim 20 , wherein the computing resource host is preconfigured with the intermediate certificate.

22. The method of claim 14 , wherein storing the credential location identifier as application metadata for the application comprises storing the credential location identifier in a centralized database on the cloud application platform, further comprising:

retrieving, by a computing resource host that hosts the application within the cloud application platform, the credential location identifier from the centralized database.

23. The method of claim 14 , wherein providing the credentials to a secure credential hub comprises:

authenticating with a preconfigured client.

24. The method of claim 14 , wherein the unique identifier is for an application that has not yet launched.

25. The method of claim 14 , wherein the credential location identifier is a path.

26. The method of claim 14 , wherein multiple applications have read access to a same credential location identifier.

27. One or more non-transitory computer storage media storing instructions that are operable, when executed by one or more computers, to cause the one or more computers to perform operations comprising:

receiving a service bind request for an application in a cloud application platform system, wherein the service bind request comprises a request to bind a service provided by a service host in the cloud application platform system, wherein the service bind request specifies (i) an identifier for the service and (ii) a unique identifier for the application;

receiving, from the service host, credentials for the application to access the service;

providing the credentials to a secure credential hub installed on the cloud application platform system, wherein the secure credential hub stores the credentials in association with a credential location identifier;

granting, to the unique identifier for the application, read access to the credential location identifier; and

storing the credential location identifier as application metadata for the application.