Secure user credential access system
A proxy server mitigates security risks of user credentials sent across a network in clear text. The proxy server encrypts user credentials within a client application request destined for an application server. The proxy server forwards the client application request to the application server. The application server sends the encrypted user credentials to the proxy server where the proxy server decrypts the user credentials and authenticates the user credentials with an authentication server.
1. A method of operation of a proxy server, comprising:
receiving a third-party application access request and authentication credentials from a corporate client device, the third-party application residing on an application server hosted by a third-party, the application server configured to validate authentication credentials at the proxy server;
encrypting the authentication credentials, the encrypted authentication credentials are encrypted such that the encrypted authentication credentials are only decryptable by the proxy server;
sending the encrypted authentication credentials and the third-party application access request to the application server;
receiving the encrypted authentication credentials back from the application server in an authentication request;
validating decrypted authentication credentials against a corporate directory; and
sending the application server results of validating the decrypted authentication credentials.
2. The method as recited in claim 1 , wherein the application access request requests access to a resource managed by the application server.
3. The method as recited in claim 1 , wherein the application access request requests access to application specific data stored on the application server.
4. The method as recited in claim 1 , wherein prior to the encrypting the authentication credentials:
receiving a digitally signed certificate from the corporate client device;
validating the digitally signed certificate by using a public key of the corporate client device to decrypt the digitally signed certificate;
upon successful decryption of the digitally signed certificate, performing the encrypting the authentication credentials.
5. The method as recited in claim 1 , wherein the authentication credentials from the corporate client device are received in clear-text.
6. The method as recited in claim 1 , further comprising:
receiving a response to the results of validating the decrypted authentication credentials from the application server;
forwarding the response to the corporate client device.
7. One or more non-transitory computer-readable storage media, storing one or more sequences of instructions for operation of a proxy server, which when executed by one or more processors cause performance of:
receiving a third-party application access request and authentication credentials from a corporate client device, the third-party application residing on an application server hosted by a third-party, the application server configured to validate authentication credentials at the proxy server;
encrypting the authentication credentials, the encrypted authentication credentials are encrypted such that the encrypted authentication credentials are only decryptable by the proxy server;
sending the encrypted authentication credentials and the third-party application access request to the application server;
receiving the encrypted authentication credentials back from the application server in an authentication request;
validating decrypted authentication credentials against a corporate directory; and
sending the application server results of validating the decrypted authentication credentials.
8. The one or more non-transitory computer-readable storage media as recited in claim 7 , wherein the application access request requests access to a resource managed by the application server.
9. The one or more non-transitory computer-readable storage media as recited in claim 7 , wherein the application access request requests access to application specific data stored on the application server.
10. The one or more non-transitory computer-readable storage media as recited in claim 7 , wherein prior to the encrypting the authentication credentials:
receiving a digitally signed certificate from the corporate client device;
validating the digitally signed certificate by using a public key of the corporate client device to decrypt the digitally signed certificate;
upon successful decryption of the digitally signed certificate, performing the encrypting the authentication credentials.
11. The one or more non-transitory computer-readable storage media as recited in claim 7 , wherein the authentication credentials from the corporate client device are received in clear-text.
12. The one or more non-transitory computer-readable storage media as recited in claim 7 , wherein the one or more sequences of instructions, which when executed by the one or more processors cause further performance of:
receiving a response to the results of validating the decrypted authentication credentials from the application server;
forwarding the response to the corporate client device.
13. A proxy server, comprising:
one or more processors; and
a memory storing instructions, which when executed by the one or more processors, cause the one or more processors to:
receive a third-party application access request and authentication credentials from a corporate client device, the third-party application residing on an application server hosted by a third-party, the application server configured to validate authentication credentials at the proxy server;
encrypt the authentication credentials, the encrypted authentication credentials are encrypted such that the encrypted authentication credentials are only decryptable by the proxy server;
send the encrypted authentication credentials and the third-party application access request to the application server;
receive the encrypted authentication credentials back from the application server in an authentication request;
validate decrypted authentication credentials against a corporate directory; and
send the application server results of validating the decrypted authentication credentials.
14. The proxy server as recited in claim 13 , wherein the application access request requests access to a resource managed by the application server.
15. The proxy server as recited in claim 13 , wherein the application access request requests access to application specific data stored on the application server.
16. The proxy server as recited in claim 13 , wherein prior to the encrypting the authentication credentials:
receive a digitally signed certificate from the corporate client device;
validate the digitally signed certificate by using a public key of the corporate client device to decrypt the digitally signed certificate;
upon successful decryption of the digitally signed certificate, performing the encrypting the authentication credentials.
17. The proxy server as recited in claim 13 , wherein the authentication credentials from the corporate client device are received in clear-text.
18. The proxy server as recited in claim 13 , further comprising:
receive a response to the results of validating the decrypted authentication credentials from the application server;
forward the response to the corporate client device.