Private network access

1. A method, comprising:

establishing a browser session in response to receiving a request from a browser application in a public network;

assigning the browser session to a dedicated network service running in a dedicated network name space;

proxying, by a proxy, requests received from the browser application to the dedicated network service;

authenticating, by a local web session in the dedicated network service, a user of the browser application for access to at least one private webservice, wherein the authenticating comprises authenticating the user with an authentication server, and receiving from the authentication server a client access list identifying at least one private name resolving service for resolving a private network address of the private webservice, and wherein the client access list further identifies the private webservice and at least one remote gateway for accessing the private webservice;

establishing, by a security client in the dedicated network service, a networking tunnel between the proxy and a remote gateway to a private network, thereby obtaining network access to the private webservice from the dedicated network name space; and

forwarding, within the dedicated network name space, proxied requests addressing the private webservice over the networking tunnel to the private network.

2. The method of claim 1 , wherein the proxying comprises:

marking the requests of the browser application to identify the browser session; and

identifying the dedicated network service and routing the requests to the dedicated network service.

3. The method of claim 1 , wherein the proxying further comprises:

replacing a source address of the requests of the browser application with a network address of the proxy.

4. The method of claim 3 , wherein the proxying further comprises:

when a request is destined for a domain name, resolving the private network address of the private webservice by performing a name resolving request over the networking tunnel within the private network; and

replacing a destination address of the request with the private network address.

5. The method of claim 4 , wherein the resolving further comprises:

marking the name resolving request according to the browser session;

forwarding the marked name resolving request to a local name resolving service within the proxy;

based on the marking, identifying a private name resolving service within the private network assigned to the security client;

unmarking and forwarding the name resolving request to the identified private name resolving service; and

receiving the resolved private network address in return.

6. The method of claim 1 , wherein the establishing the networking tunnel further comprises:

obtaining at least one private name resolving service for resolving domain names within the private network.

7. The method of claim 5 , wherein the establishing the networking tunnel further comprises:

registering the private name resolving service with the local name resolving service; and associating the private name resolving service with the browser session.

8. The method of claim 1 , wherein the proxying further comprises:

when receiving a request associated with an unauthenticated web session, redirecting the request to a landing page to perform the authenticating the user.

9. The method of claim 1 , wherein the proxying further comprises:

when receiving a request for the proxy, and when the request is associated with an authenticated web session, then redirecting the request to a landing page with a reference to the private webservice.

10. The method of claim 1 , wherein the authenticating further comprises:

receiving access credentials from the user, wherein the authenticating is performed using the access credentials; and

receiving from the authentication server a client tunnel list comprising tunnel authentication information for establishing network tunnels with the remote gateway.

11. A controller, comprising at least one processor and at least one memory including computer program code, the at least one memory and computer program code configured to, with the at least one processor, cause the controller to perform:

providing browser-based access from a public network to at least one private webservice, wherein the private webservice is network addressable by a private network address within a private network, and wherein the private webservice is identifiable by a domain name that resolves to the private network address within the private network and resolves to the controller within the public network;

upon request of a browser application in the public network, establish a browser session;

assign the browser session to a dedicated network service running in a dedicated network name space;

proxying requests received from the browser application to the dedicated network service and vice versa;

authenticate, by a local web session in the dedicated network service, a user of the browser application for access to the at least one private webservice, wherein the authenticating comprises authenticating the user with an authentication server, and receiving from the authentication server a client access list identifying at least one private name resolving service for resolving the private network address, and wherein the client access list further identifies the private webservice and at least one remote gateway for accessing the private webservice;

establish, by a security client in the dedicated network service, a networking tunnel between the controller and a remote gateway to the private network thereby obtaining network access to the private webservice from the dedicated network name space; and

forwarding, within the dedicated network name space, proxied requests addressing the private webservice over the networking tunnel to the private network.

12. A computer readable storage medium comprising computer-executable instructions for performing a method when the instructions are run on a computer, the method comprising:

establishing a browser session in response to receiving a request from a browser application in a public network;

assigning the browser session to a dedicated network service running in a dedicated network name space;

proxying, by a proxy, requests received from the browser application to the dedicated network service;

authenticating, by a local web session in the dedicated network service, a user of the browser application for access to at least one private webservice, wherein the authenticating comprises authenticating the user with an authentication server, and receiving from the authentication server a client access list identifying at least one private name resolving service for resolving a private network address of the private webservice, and wherein the client access list further identifies the at least one private webservice and at least one remote gateway for accessing the private webservice;

establishing, by a security client in the dedicated network service, a networking tunnel between the proxy and a remote gateway to a private network, thereby obtaining network access to the private webservice from the dedicated network name space; and

forwarding, within the dedicated network name space, proxied requests addressing the private webservice over the networking tunnel to the private network.

13. The computer readable storage medium of claim 12 , wherein the proxying comprises:

marking the requests of the browser application to identify the browser session; and

identifying the dedicated network service and routing the requests to the dedicated network service.

14. The computer readable storage medium of claim 12 , wherein the proxying further comprises:

replacing a source address of the requests of the browser application with a network address of the proxy.

15. The computer readable storage medium of claim 14 , wherein the proxying further comprises:

when a request is destined for a domain name, resolving the private network address of the private webservice by performing a name resolving request over the networking tunnel within the private network; and

replacing a destination address of the request with the private network address.

16. The computer readable storage medium of claim 15 , wherein the resolving further comprises:

marking the name resolving request according to the browser session;

forwarding the marked name resolving request to a local name resolving service within the proxy;

based on the marking, identifying a private name resolving service within the private network assigned to the security client;

unmarking and forwarding the name resolving request to the identified private name resolving service; and

receiving the resolved private network address in return.

17. The computer readable storage medium of claim 12 , wherein the establishing the networking tunnel further comprises:

obtaining at least one private name resolving service for resolving domain names within the private network.

18. The computer readable storage medium of claim 17 , wherein the establishing the networking tunnel further comprises:

registering the at least one private name resolving service with a local name resolving service; and associating the at least one private name resolving service with the browser session.

19. The computer readable storage medium of claim 12 , wherein the proxying further comprises:

when receiving a request associated with an unauthenticated web session, redirecting the request to a landing page to perform the authenticating the user.

20. The computer readable storage medium of claim 12 , wherein the proxying further comprises:

when receiving a request for the proxy, and when the request is associated with an authenticated web session, then redirecting the request to a landing page with a reference to the private webservice.