Preventing access to single sign on credentials associated with executing applications

1. A method comprising:

creating, by a computer, a sandboxed user account on the computer, wherein creating the sandboxed user account comprises generating single-sign-on (SSO) credentials for the sandboxed user account;

storing the SSO credentials for the sandboxed user account in a credentials vault;

creating, by the computer, an operating system session and executing a SSO tool in the operating system session in association with the sandboxed user account; and

in response to a request from an end user account to start up a first application, the computer:

determining that the end user account is authorized to use the first application based on user credentials associated with the end user account; and

starting up the first application for the end user account under the sandboxed user account, wherein starting up the first application comprises using the SSO tool to communicate with an agent of the credentials vault to request the SSO credentials for the sandboxed user account, receive the SSO credentials from the agent, and inject the SSO credentials into the first application to cause the first application to be executed under the sandboxed user account,

the SSO tool communicating with the credentials vault, via the agent, to store the user credentials for the end user account in the credentials vault.

2. The method of claim 1 , wherein the sandboxed user account is a non-administrator user account.

3. The method of claim 1 , wherein the sandboxed user account has inhibited access to a memory space of the first application.

4. The method of claim 1 , wherein the sandboxed user account is prohibited from accessing a memory dump option for the first application.

5. The method of claim 1 , wherein the sandboxed user account is prohibited from debugging the first application.

6. The method of claim 1 , wherein the SSO tool and the first application are running under the sandboxed user account, and the operating system session prevents the end user account from debugging the first application under the sandboxed user account.

7. The method of claim 1 , wherein creating the sandboxed user account occurs in response to installation of an SSO agent on the computer.

8. The method of claim 1 , wherein using the SSO tool to inject the SSO credentials comprises using the SSO tool to provide the SSO credentials to a graphical user interface (GUI)-based log in prompt provided by the first application.

9. The method of claim 1 , wherein the agent is associated with the computer, and the credentials vault is associated with a remote computer.

10. The method of claim 1 , wherein the first application allows starting of a second application associated with the end user account, the method further comprising:

providing a system hook to detect start-up of the second application while the first application is being executed; and

perform an action to prevent the second application from accessing a memory space associated with the first application.

11. The method of claim 10 , wherein providing the system hook comprises registering a kernel driver with an operating system of the computer to cause the kernel driver to be executed in response to an attempted start-up of the second application, and the execution of the kernel driver performs the action to prevent the second application from accessing the memory space of the first application.

12. The method of claim 10 , wherein the second application is executable to perform a memory dump of the first application or to debug the first application.

13. The method of claim 10 , further comprising performing one or more of the following in response to the start-up of the second application:

terminating the first application or a thread associated with the first application, terminating an access right of the end user account to the first application, or suspending the first application or Hail the thread associated with the first application.

14. A non-transitory computer-readable storage medium that stores instructions that, when executed by a machine, cause the machine to:

create a sandboxed user account, including generating single-sign-on (SSO) credentials for the sandboxed user account;

store the SSO credentials for the sandboxed user account in a credentials vault;

execute a SSO tool in an operating system session in association with the sandboxed user account; and

in response to a request from an end user account to start up a first application,

determine that the end user account is authorized to use the first application based on user credentials associated with the end user account;

start up the first application under the sandboxed user account, wherein to start up the first application, the instructions cause the machine to: use the SSO tool to communicate with an agent of the credentials vault to request the SSO credentials for the sandboxed user account, receive the SSO credentials from the agent, and inject the SSO credentials into the first application to cause the first application to be executed under the sandboxed user account; and

use the SSO tool to communicate with the credentials vault, via the agent, to store the user credentials for the end user account in the credentials vault.

15. The non-transitory computer-readable storage medium of claim 14 , wherein the instructions, when executed by the machine, cause the machine to use a kernel driver of the machine to prevent the end user account from accessing a memory dump of the first application or debugging the first application.

16. The non-transitory computer-readable storage medium of claim 15 , wherein the instructions, when executed by the machine, cause the machine to use the kernel driver to perform at least one of terminating the first application or a thread associated with the first application, terminating an access right of the end user account to the first application, or suspending the first application or the thread associated with the first application.

17. An apparatus comprising:

a processor; and

a memory storing instructions that, when executed by the processor, cause the processor to:

create a sandboxed user account, including generating (SSO) credentials for the sandboxed user account;

store the SSO credentials for the sandboxed user account in a credentials vault;

execute a SSO tool in an operating system session in association with the sandboxed user account; and

in response to a request from an end user account to start up a first application,

determine that the end user account is authorized to use the first application based on user credentials associated with the end user account,

start up the first application under the sandboxed user account, wherein to start up the first application, the instructions cause the processor to: use the SSO tool to communicate with an agent of the credentials vault to request the SSO credentials for the sandboxed user account, receive the SSO credentials from the agent, and inject the SSO credentials into the first application to cause the first application to be executed under the sandboxed user account, and

use the SSO tool to communicate with the credentials vault, via the agent, to store the user credentials for the end user account in the credentials vault.

18. The apparatus of claim 17 , wherein the sandboxed user account is prohibited from accessing a memory dump option for the first application or debugging of the first application.

19. The apparatus of claim 17 , wherein the processor and the memory are part of a computer, and the first application is installed on the computer.