Credential-free user login to remotely executed applications
Provided is a process including: receiving, with an intermediary server, a request to access web content at a web server; submitting, from the intermediary server a value by which possession of an access credential is demonstrated, wherein the value is withheld from the client web browser; receiving, by the intermediary web browser, instructions to store in web browser memory an access token; and sending, from the intermediary server, to the client web browser executing on the client computing device, instructions to store the access token in browser memory of the client web browser, thereby authenticating the client web browser without the client web browser having access to the value by which possession of the access credential is demonstrated.
1. A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:
receiving, with the one or more processors executing a permission-management application, a first request to manage permissions of one or more users to access resources with client computing devices, wherein:
the permission-management application is configured to manage permissions for users of an organization to access a plurality of different network-accessible applications;
the plurality of different network-accessible applications have different permission-management application program interfaces; and
the permission-management application is configured to manage permissions for users to access respective instances of a plurality of different native applications executing on the client computing devices;
determining, with the permission-management application, that the first request specifies a first user is to be de-permissioned for a first native application among the plurality of different native applications and, in response, sending via a network, with the permission-management application, instructions to a first client computing device to revoke the first user's authority to access the first native application;
receiving, with the permission-management application, a second request to manage the permissions of one or more users to access the resources with the client computing devices; and
determining, with the permission-management application, that the second request specifies a second user is to be de-permissioned for a first network-accessible application among the plurality of different network-accessible applications and, in response, sending via the network, with the permission-management application, instructions to revoke the second user's authority to access the first network-accessible application.
2. The medium of claim 1 , wherein:
the instructions to revoke the second user's authority to access the first network-accessible application are sent to an intermediary server; and
the permission-management application is configured to provide a centralized interface to manage permissions of a heterogenous set of monolithic native applications and hosted software-as-a-service applications with a uniform interface.
3. The medium of claim 1 , wherein the operations comprise logging a record indicative of the first request to a tamper-evident immutable data store.
4. The medium of claim 3 , wherein logging the record indicative of the first request to the immutable data store comprises:
segmenting the record into a plurality of segments and logging the segments to a plurality of blockchains.
5. The medium of claim 4 , wherein logging the segments to a plurality of blockchains comprises:
storing the segments in leaf nodes of Merkle trees in the blockchains.
6. The medium of claim 1 , wherein:
the permission-management application is configured to provide a centralized interface to manage permissions of a heterogenous set of monolithic native applications and hosted software-as-a-service applications with a uniform interface.
7. The medium of claim 6 , wherein:
the uniform interface includes a drag-and-drop graphical user interface by which the first request and the second request are initiated from one or more client computing devices.
8. The medium of claim 7 , wherein:
the drag-and-drop user interface includes one or more graphical regions representing at least some of the one or more users and one or more graphical regions representing at least some of the heterogenous set of monolithic native applications and hosted software-as-a-service applications.
9. The medium of claim 8 , wherein:
the operations comprise sending instructions to render the drag-and-drop graphical user interface to at least some of the client computing devices; and
the instructions to render the drag-and-drop graphical user interface are configured to be rendered in a web browser to cause the web browser to present the graphical user interface.
10. The medium of claim 1 , wherein:
the permission-management application is configured to translate a permission-grant request or de-permission request in a unified format by which permission-grant requests or de-permission requests for the plurality of different network-accessible applications are communicated to the permission-management application into a network-application-specific format compliant with an application program interface of a selected one of the plurality of different network-accessible applications.
11. The medium of claim 10 , wherein:
the network-application-specific format is not compliant with an application program interface of an unselected one of the plurality of different network-accessible applications.
12. The medium of claim 11 , wherein the sending instructions to the first client computing device to revoke the first user's authority to access the first native application comprises:
sending the instructions to revoke the first user's authority to access the first native application to an agent executing on the first client computing device.
13. The medium of claim 12 , wherein the operations comprise:
receiving, with the agent executing on the first client computing device, the instructions to revoke the first user's authority to access the first native application; and
in response to receiving the instructions to revoke the first user's authority to access the first native application, changing or deleting a value stored on the first client computer effective to prevent the first user from accessing the first native application on the first client computing device.
14. The medium of claim 13 , wherein:
the first native application is an offline application; and
the changed or deleted value is effective to prevent the first user from accessing the first native application on the first client computing device in an absence of network access.
15. The medium of claim 1 , wherein the operations comprise:
receiving, with the permission-management application, a third request to manage the permissions of one or more users to access the resources with the client computing devices; and
determining, with the permission-management application, that the third request specifies a third user is to be granted permission for a second native application and, in response, sending, via the network, with the permission-management application, instructions to a third client computing device to grant the third user authority to access the second native application.
16. The medium of claim 1 , wherein the operations comprise:
receiving, with the permission-management application, a fourth request to manage the permissions of one or more users to access the resources with the client computing devices; and
determining, with the permission-management application, that the fourth request specifies a fourth user is to be granted permission for a second network-accessible application and, in response, sending, via a network, with the permission-management application, instructions to an intermediary server to grant the fourth user authority to access the second network-accessible application, the second network-accessible application being a web application accessible by a web browser.
17. The medium of claim 1 , wherein:
permissions for more than 1,000 users are managed for more than 5 native applications and more than 5 network-accessible applications.
18. The medium of claim 1 , the operations comprising:
steps for providing a centralized platform for management of users within external applications.
19. The medium of claim 1 , the operations comprising:
executing a plurality of enterprise applications on the client computing devices for which the permission-management application manages access; and
accessing the plurality of enterprise applications on the client computing devices for which the permission-management application manages access with the client computing devices.
20. A method, comprising:
receiving, with one or more processors executing a permission-management application, a first request to manage permissions of one or more users to access resources with client computing devices, wherein:
the permission-management application is configured to manage permissions for users of an organization to access a plurality of different network-accessible applications;
the plurality of different network-accessible applications have different permission-management application program interfaces; and
the permission-management application is configured to manage permissions for users to access respective instances of a plurality of different native applications executing on the client computing devices;
determining, with the permission-management application, that the first request specifies a first user is to be de-permissioned for a first native application among the plurality of different native applications and, in response, sending via a network, with the permission-management application, instructions to a first client computing device to revoke the first user's authority to access the first native application;
receiving, with the permission-management application, a second request to manage the permissions of one or more users to access the resources with the client computing devices; and
determining, with the permission-management application, that the second request specifies a second user is to be de-permissioned for a first network-accessible application among the plurality of different network-accessible applications and, in response, sending via the network, with the permission-management application, instructions to revoke the second user's authority to access the first network-accessible application.
21. The method of claim 20 , wherein:
the instructions to revoke the second user's authority to access the first network-accessible application are sent to an intermediary server; and
the permission-management application is configured to provide a centralized interface to manage permissions of a heterogenous set of monolithic native applications and hosted software-as-a-service applications with a uniform interface.
22. The method of claim 20 , comprising logging a record indicative of the first request to a tamper-evident immutable data store.
23. The method of claim 22 , wherein logging the record indicative of the first request to the immutable data store comprises:
segmenting the record into a plurality of segments and logging the segments to a plurality of blockchains.
24. The method of claim 23 , wherein logging the segments to a plurality of blockchains comprises:
storing the segments in leaf nodes of Merkle trees in the blockchains.
25. The method of claim 20 , wherein:
the permission-management application is configured to provide a centralized interface to manage permissions of a heterogenous set of monolithic native applications and hosted software-as-a-service applications with a uniform interface.
26. The method of claim 25 , wherein:
the uniform interface includes a drag-and-drop graphical user interface by which the first request and the second request are initiated from one or more client computing devices.
27. The method of claim 26 , wherein:
the drag-and-drop user interface includes one or more graphical regions representing at least some of the one or more users and one or more graphical regions representing at least some of the heterogenous set of monolithic native applications and hosted software-as-a-service applications.
28. The method of claim 27 , wherein:
the method comprises sending instructions to render the drag-and-drop graphical user interface to at least some of the client computing devices; and
the instructions to render the drag-and-drop graphical user interface are configured to be rendered in a web browser to cause the web browser to present the graphical user interface.
29. The method of claim 20 , wherein:
the permission-management application is configured to translate a permission-grant request or de-permission request in a unified format by which permission-grant requests or de-permission requests for the plurality of different network-accessible applications are communicated to the permission-management application into a network-application-specific format compliant with an application program interface of a selected one of the plurality of different network-accessible applications.
30. The method of claim 29 , wherein:
the network-application-specific format is not compliant with an application program interface of an unselected one of the plurality of different network-accessible applications.
31. The method of claim 30 , wherein the sending instructions to the first client computing device to revoke the first user's authority to access the first native application comprises:
sending the instructions to revoke the first user's authority to access the first native application to an agent executing on the first client computing device.
32. The method of claim 31 , comprising:
receiving, with the agent executing on the first client computing device, the instructions to revoke the first user's authority to access the first native application; and
in response to receiving the instructions to revoke the first user's authority to access the first native application, changing or deleting a value stored on the first client computer effective to prevent the first user from accessing the first native application on the first client computing device.
33. The method of claim 32 , wherein:
the first native application is an offline application; and
the changed or deleted value is effective to prevent the first user from accessing the first native application on the first client computing device in an absence of network access.
34. The method of claim 20 , comprising:
receiving, with the permission-management application, a third request to manage the permissions of one or more users to access the resources with the client computing devices; and
determining, with the permission-management application, that the third request specifies a third user is to be granted permission for a second native application and, in response, sending, via the network, with the permission-management application, instructions to a third client computing device to grant the third user authority to access the second native application.
35. The method of claim 20 , comprising:
receiving, with the permission-management application, a fourth request to manage the permissions of one or more users to access the resources with the client computing devices; and
determining, with the permission-management application, that the fourth request specifies a fourth user is to be granted permission for a second network-accessible application and, in response, sending, via a network, with the permission-management application, instructions to an intermediary server to grant the fourth user authority to access the second network-accessible application, the second network-accessible application being a web application accessible by a web browser.
36. The method of claim 20 , wherein:
permissions for more than 1,000 users are managed for more than 5 native applications and more than 5 network-accessible applications.
37. The method of claim 20 , comprising:
steps for providing a centralized platform for management of users within external applications.
38. The method of claim 20 , comprising:
executing a plurality of enterprise applications on the client computing devices for which the permission-management application manages access; and
accessing the plurality of enterprise applications on the client computing devices for which the permission-management application manages access with the client computing devices.