Efficient centralized credential storage for remotely managed networks

1. A system comprising:

a proxy server application executing on a proxy server device that is disposed within a managed network; and

a server device that is disposed within a remote network management platform that remotely manages the managed network, wherein the server device stores a plurality of access credentials for computing devices that are disposed within the managed network, and wherein the server device is configured to:

receive, from the proxy server application, a request containing a label and an indication of an application service,

map the label and the application service to an endpoint identifier of a target computing device that is disposed within the managed network, wherein the endpoint identifier is associated with particular access credentials of the plurality of access credentials that are usable to access the application service executing on the target computing device, and wherein the particular access credentials include a password usable to log on to the application service executing on the target computing device, and

transmit, to the proxy server application, the endpoint identifier and the particular access credentials, wherein reception of the endpoint identifier and the particular access credentials causes the proxy server application to remotely access the application service executing on the target computing device, and wherein transmitting the particular access credentials comprises:

decrypting the password with an instance key that is not available to the proxy server application;

encrypting the password with a session key that is shared between the server device and the proxy server application; and

transmitting the password as encrypted with the session key.

2. The system of claim 1 , wherein the endpoint identifier is an IP address or uniform resource locator.

3. The system of claim 1 , wherein reception of the endpoint identifier and the particular access credentials also causes the proxy server application to store a record associating the label, the application service, and the particular access credentials.

4. The system of claim 1 , wherein the application service is a remote login service.

5. The system of claim 1 , wherein the server device is a first server device that is part of a first computing instance that is disposed within the remote network management platform, wherein the target computing device is a first target computing device, wherein the endpoint identifier is a first endpoint identifier, and wherein the plurality of access credentials are a first plurality of access credentials, the system further comprising:

a second server device that stores a second plurality of access credentials for computing devices that are disposed within the managed network, wherein the second server device is part of a second computing instance that is disposed within the remote network management platform, wherein the second computing instance is logically isolated from the first computing instance, and wherein the second server device is configured to:

receive, from the proxy server application, a second request containing the label and the indication of the application service,

map the label and the application service to a second endpoint identifier of a second target computing device that is disposed within the managed network, wherein second particular access credentials of the second plurality of access credentials are usable to access the application service executing on the second target computing device, and

transmit, to the proxy server application, the second endpoint identifier and the second particular access credentials.

6. The system of claim 1 , wherein the particular access credentials include a userid usable to log on to the application service executing on the target computing device.

7. The system of claim 1 , wherein the password is stored, in the server device, in an encrypted manner.

8. The system of claim 1 , wherein the server device stores, in a single database table, all access credentials that are managed by the remote network management platform on behalf of the managed network.

9. A method comprising:

receiving, by a server device that stores a plurality of access credentials for computing devices that are disposed within a managed network, a request containing a label and an indication of an application service, wherein the server device is disposed within a remote network management platform that remotely manages the managed network, and wherein the request is received from a requesting device;

mapping, by the server device, the label and the application service to an endpoint identifier of a target computing device that is disposed within the managed network, wherein the endpoint identifier is associated with particular access credentials of the plurality of access credentials that are usable to access the application service executing on the target computing device, and wherein the particular access credentials include a password usable to log on to the application service executing on the target computing device; and

transmitting, by the server device and to the requesting device, the endpoint identifier and the particular access credentials, wherein reception of the endpoint identifier and the particular access credentials causes the requesting device to remotely access the application service executing on the target computing device, and wherein transmitting the particular access credentials comprises:

decrypting the password with an instance key that is not available to the proxy server application;

encrypting the password with a session key that is shared between the server device and the proxy server application; and

transmitting the password as encrypted with the session key.

10. The method of claim 9 , wherein the requesting device is a proxy server device that is disposed within the managed network.

11. The method of claim 9 , wherein the endpoint identifier is an IP address or uniform resource locator.

12. The method of claim 9 , wherein reception of the endpoint identifier and the particular access credentials also causes the requesting device to store a record associating the label, the application service, and the particular access credentials.

13. The method of claim 9 , wherein the application service is a remote login service.

14. The method of claim 9 , wherein the server device is a first server device that is part of a first computing instance that is disposed within the remote network management platform, wherein the target computing device is a first target computing device, wherein the endpoint identifier is a first endpoint identifier, and wherein the plurality of access credentials are a first plurality of access credentials, the method further comprising:

receiving, by a second server device that stores a second plurality of access credentials for computing devices that are disposed within the managed network, a second request containing the label and the application service, wherein the second server device is part of a second computing instance that is disposed within the remote network management platform, wherein second particular access credentials of the second plurality of access credentials are usable to access the application service executing on a second target computing device that is disposed within the managed network, and wherein the second request is received from the requesting device;

mapping, by the second server device, the label and the application service to a second endpoint identifier of the second target computing device, wherein the second endpoint identifier is associated with the second particular access credentials that are usable to access the application service executing on the second target computing device; and

transmitting, by the server device and to the requesting device, the second endpoint identifier and the second particular access credentials.

15. The method of claim 9 , wherein the particular access credentials include a userid usable to log on to the application service of the target computing device.

16. The method of claim 9 , wherein the password is stored, in the server device, in an encrypted manner.

17. The method of claim 9 , wherein the server device stores, in a single database table, all access credentials that are managed by the remote network management platform on behalf of the managed network.

18. An article of manufacture including a non-transitory computer-readable medium, having stored thereon program instructions that, upon execution by a server computing system that is disposed within a remote network management platform that remotely manages a managed network, cause the server computing system to perform operations comprising:

receiving, from a proxy server application executing on a proxy server device that is disposed within the managed network, a request containing a label and an indication of an application service;

mapping the label and the application service to an endpoint identifier of a target computing device that is disposed within the managed network, wherein the endpoint identifier is associated with particular access credentials of a plurality of access credentials that are usable to access the application service executing on the target computing device, and wherein the particular access credentials include a password usable to log on to the application service executing on the target computing device; and

transmitting, to the proxy server application, the endpoint identifier and the particular access credentials, wherein reception of the endpoint identifier and the particular access credentials causes the proxy server application to remotely access the application service executing on the target computing device, and wherein transmitting the particular access credentials comprises:

decrypting the password with an instance key that is not available to the proxy server application;

encrypting the password with a session key that is shared between the server device and the proxy server application; and

transmitting the password as encrypted with the session key.