Secure password-based single sign-on

1. A system, comprising:

at least one processor and a memory coupled to the at least one processor;

wherein the at least one processor is configured to perform acts that:

receive, at a directory service, a first request to sign into a user account of a user at the directory service, wherein the first request includes a first credential of the user account;

upon successful authentication of the first request, return a directory service home web page of the user;

receive a second request, at the directory service, for access to a web application of the user account;

obtain, from the directory service a second credential of the user for the web application, wherein the first credential and the second credential differ;

generate a first sign-on script, at the directory service, the first sign-on script includes the second credential;

execute the first sign-on script in an isolation execution environment in the directory service;

obtain an authentication state from the execution of the first sign-on script; and

return a second sign-on script, the second sign-on script including the authentication state.

2. The system of claim 1 , wherein the at least one processor is configured to perform acts that provide access to the web application upon execution of the second sign-on script.

3. The system of claim 1 , wherein the isolation execution environment includes a container having a dedicated Operating System (OS) kernel.

4. The system of claim 1 , wherein the second sign-on script performs a single sign-in to the web application.

5. The system of claim 1 , wherein the at least one processor is further configured to perform acts that obtain the second credential of the user for the web application from a credential vault of the directory service.

6. The system of claim 5 , wherein the second credential is not included in the second sign-on script.

7. The system of claim 1 , wherein the first sign-on script is executed in the isolation execution environment with a headless browser.

8. The system of claim 1 , wherein the authentication state is a browser cookie.

9. A method performed on a computing device having at least one processor and a memory, the method comprising:

hosting a directory service to perform single sign-on into a first web application associated with a user account of a user of the directory service;

storing, in the directory service, a second credential for access to the first web application;

receiving, at the directory service, a first request to sign-on to the user account, the first request including a first credential associated with the user account;

receiving, at the directory service, a second request to sign-on to the first web application;

executing, in the directory service, the sign-on to the first web application in an isolation execution environment on behalf of the user, the sign-on including the second credential obtained from the directory service, wherein the first credential differs from the second credential;

obtaining a browser cookie from execution of the sign-on to the first web application;

creating a second sign-on script for subsequent accesses to web applications associated with the user account, the second sign-on script including the browser cookie; and

returning the second sign-on script to the user.

10. The method of claim 9 , further comprising:

configuring the isolation execution environment in the directory service with a Hyper-V container.

11. The method of claim 9 , further comprising:

generating, in the directory service, a first sign-on script including the second credential associated with the first web application; and executing the first sign-on script in the isolation execution environment.

12. The method of claim 11 , further comprising:

receiving the browser cookie from the execution of the first sign-on script.

13. The method of claim 9 , wherein the isolation execution environment includes a container having a dedicated Operating System (OS) kernel.

14. The method of claim 9 , further comprising:

receiving a third request for access to a second web application, the third request including the browser cookie; and

performing a sign-on to the second web application using the browser cookie.

15. A device, comprising:

at least one processor; and

a memory;

wherein the memory includes a browser including instructions for displaying one or more web pages; and a browser extension,

wherein the browser extension includes instructions that when executed by the at least one processor perform actions that:

receives a user directory service home page, of a user, upon successful access to a user account, of the user, at a directory service with a first credential;

upon successful access to the user account, performs a first user request to the directory service to sign-on to a web application of the user account, wherein the directory service authenticates access to the web application in an isolation execution environment in the directory service using a second credential stored in the directory service, wherein the first credential and the second credential differ;

receives a browser cookie from the directory service upon successful verification of the first user request, the browser cookie representing an authentication state from the directory service;

sends a second request to access the web application, the second request including the browser cookie; and

receives a signed-on web page of the web application.

16. The device of claim 15 , wherein the browser extension includes further instructions that when executed by the at least one processor perform actions that:

updates the browser to display the signed-on web page of the web application.

17. The device of claim 15 , wherein the browser extension includes instructions that when executed by the at least one processor includes actions that:

generates an HTTP request to sign-on to the web application using the browser cookie without a user credential.

18. The device of claim 15 , wherein the browser extension includes instructions that when executed by the at least one processor includes actions that:

receives a sign-on script with the browser cookie.

19. The device of claim 18 , wherein the browser extension includes instructions that when executed by the at least one processor includes actions that:

uses the sign-on script with the browser cookie to obtain a home page of the web application.

20. The device of claim 15 , wherein the browser extension includes instructions that when executed by the at least one processor includes actions that:

updates the browser with the browser cookie.