Computer security system with remote browser isolation using forward proxying

1. A system for managing access to a network-provided service, the system comprising a client device and at least one remote browser isolation (RBI) host, wherein a data network communicably couples the client device and the RBI hosts to a service provider and an identity provider;

wherein the client device comprises a processor and memory, the client device configured to perform operations comprising:

receive user-input from, and provide user-output to, a client-user;

wherein the service provider comprises a processor and memory, the service provider configured to:

serve a network-provided service for authorized client-users;

wherein the identity provider comprises a processor and memory, the identity provider configured to:

maintain authorization information for the network-provided service; and

generate a permission-object that specifies that the client-user is an authorized user of the network-provided service, wherein the generation of the permission-object comprises creating the permission-object to comprise, at the time of creation, an access-override field that specifies a network address of a remote browser isolation (RBI) host;

wherein the RBI host comprises a processor and memory, the RBI host configured to:

receive the permission-object; and

instantiate an RBI instance configured to:

access the network-provided service;

run the network-provided service in an isolation environment to

generate a graphic user interface (GUI);

provide a visual reproduction of the GUI to the client device;

receive browser-input from the client device; and

apply the browser-input to the running network-provided service.

2. The system of claim 1 , wherein:

the client device is configured to:

send, to the identity provider, an access-request to access the network-provided service that is served by the service provider;

the identity provider is configured to:

receive, from the client device, the access-request; and

send, to the client device, the permission-object;

the client device is configured to:

receive, from the identity provider, the permission-object; and

send, to the RBI host, the permission-object.

3. The system of claim 2 , wherein:

the client device is configured to:

send, to the identity provider, credentials for the client-user; and

the identity provider is configured to:

verify the identity and permissions of the client-user.

4. The system of claim 2 , wherein the identity provider is configured to, responsive to verifying the identity and permissions of the client-user, send, to the client device, the permission-object.

5. The system of claim 2 , wherein the identity provider is further configured to send, to the client device, a dashboard to be rendered with elements that, when selected by the client-user, cause the client device to send, to the identity provider, the access-request.

6. The system of claim 1 , wherein:

the client device is configured to:

send, to the service provider, an access-request to access the network-provided service that is served by the service provider;

the service provider is configured to:

receive, from the client device, the access-request;

send an authentication request;

the identity provider is configured to:

receive the authentication request;

determine that the client-user is an authorized user of the network-provided service;

send, to the client device, the permission-object;

the client device is configured to:

receive, from the identity provider, the permission-object; and

send, to the RBI host, the permission-object.

7. The system of claim 6 , wherein to determine that the client-user is an authorized user of the network-provided service, the identity provider is configured to:

send, to the client device, a credential request;

receive, from the client device, credentials for the client-user; and

verify authentication of the client-user.

8. The system of claim 6 , wherein to determine that the client-user is an authorized user of the network-provided service, the identity provider is configured to determine that the client-user is already authenticated.

9. The system of claim 1 , wherein the permission-object is a Security Assertion Markup Language (SAML) object.

10. The system of claim 1 , wherein a schema for the permission-object further defines:

the access-override field as containing a network address that is consistent for a plurality of the authorized user.

11. The system of claim 1 , wherein the identity provider is one of a plurality of identity providers each configured to generate permission-objects the network-provided service.

12. The system of claim 1 , wherein the RBI host is one of a plurality of RBI hosts each configured to run the network-provided service.

13. The system of claim 1 , wherein:

the identity provider is configured to send, to the client device, the permission-object; and

the client device is configured to send the permission-object to the RBI host.

14. The system of claim 1 , wherein the identity provider is configured to send, to the RBI host, the permission-object.

15. A system for managing access to a network-provided service, the system comprising a client device and an identity provider, wherein a data network communicably couples the client device and identity provider to a browser isolation (RBI) host and a service provider;

wherein the client device comprises a processor and memory, the client device configured to perform operations comprising:

receive user-input from, and provide user-output to, a client-user;

wherein the service provider comprises a processor and memory, the service provider configured to:

serve a network-provided service for authorized client-users;

wherein the identity provider comprises a processor and memory, the identity provider configured to:

maintain authorization information for the network-provided service; and

generate a permission-object that specifies that the client-user is an authorized user of the network-provided service, wherein the generation of the permission-object comprises creating the permission-object to comprise, at the time of creation, an access-override field that specifies a network address of a remote browser isolation (RBI) host;

wherein the RBI host comprises a processor and memory, the RBI host configured to:

receive the permission-object; and

instantiate an RBI instance configured to:

access the network-provided service;

run the network-provided service in an isolation environment to

generate a graphic user interface (GUI);

provide a visual reproduction of the GUI to the client device;

receive browser-input from the client device; and

apply the browser-input to the running network-provided service.

16. The system of claim 15 , wherein the permission-object is a Security Assertion Markup Language (SAML) object.

17. The system of claim 15 , wherein a schema for the permission-object further defines:

the access-override field as containing a network address that is consistent for a plurality of the authorized user.

18. A remote browser isolation (RBI) host, wherein a data network communicably couples the RBI host with a client device, an identity provider, and a service provider;

wherein the client device comprises a processor and memory, the client device configured to perform operations comprising:

receive user-input from, and provide user-output to, a client-user;

wherein the service provider comprises a processor and memory, the service provider configured to:

serve a network-provided service for authorized client-users;

wherein the identity provider comprises a processor and memory, the identity provider configured to:

maintain authorization information for the network-provided service; and

generate a permission-object that specifies that the client-user is an authorized user of the network-provided service, wherein the generation of the permission-object comprises creating the permission-object to comprise, at the time of creation, an access-override field that specifies a network address of a RBI host;

wherein the RBI host comprises a processor and memory, the RBI host configured to:

receive the permission-object; and

instantiate an RBI instance configured to:

access the network-provided service;

run the network-provided service in an isolation environment to

generate a graphic user interface (GUI);

provide a visual reproduction of the GUI to the client device;

receive browser-input from the client device; and

apply the browser-input to the running network-provided service.

19. The RBI host of claim 18 , wherein the permission-object is a Security Assertion Markup Language (SAML) object.

20. The RBI host of claim 18 , wherein a schema for the permission-object further defines:

the access-override field as containing a network address that is consistent for a plurality of the authorized user.