Passwordless privilege access
Systems and methods for network security are provided. Various embodiments of the present technology provide systems and methods for an identity security gateway agent that provides for privileged access. Embodiments include a system and method that uses a single sign-on (SSO) (or similar) mechanism to facilitate a user accessing web-based service providers, but separates the assertion and entire SSO process from the user credential.
1. A method of providing access to a client to facilitate connections to target network components, the method comprising:
responsive to receiving a request from a user device to access to a target network component, providing, by an agent component, abstracted credentials to the user device;
generating, by the user device, a first request intended for the target network component, the request including the abstracted credentials;
generating, by the agent component, a second request based on the first request by replacing the abstracted credentials with user credentials;
sending the second request to the target network component;
receiving, by the agent component, a first response from the target network component, the first response including a session identifier;
generating, by the agent component, a second response based on the first response by replacing the session identifier with an abstracted session identifier; and
sending the second response to the user device.
2. The method of claim 1 , wherein the user device communicates with the agent via a browser extension installed on the user device.
3. The method of claim 1 , wherein the abstracted session identifier comprises an abstracted response header.
4. The method of claim 1 , wherein the abstracted session identifier comprises an abstracted cookie.
5. The method of claim 1 , further comprising storing, by the agent component, the user credentials in a non-persistent cache.
6. The method of claim 5 , further comprising flushing the non-persistent cache after sending the second request to the target network component.
7. The method of claim 1 , further comprising wherein the first response is received from the target network component without the target network component requiring a password.
8. A system for providing access to a client to facilitate connections to target network components, the system comprising:
a processor; and
a non-transitory computer readable medium storing instructions translatable by the processor, the instructions when translated by the processor perform:
responsive to receiving a request from a user device to access to a target network component, providing, by an agent component, abstracted credentials to the user device
generating, by the user device, a first request intended for the target network component, the request including the abstracted credentials;
generating, by the agent component, a second request based on the first request by replacing the abstracted credentials with user credentials;
sending the second request to the target network component;
receiving, by the agent component, a first response from the target network component, the first response including a session identifier;
generating, by the agent component, a second response based on the first response by replacing the session identifier with an abstracted session identifier; and
sending the second response to the user device.
9. The system of claim 8 , wherein the user device communicates with the agent via a browser extension installed on the user device.
10. The system of claim 8 , wherein the abstracted session identifier comprises an abstracted response header.
11. The system of claim 8 , wherein the abstracted session identifier comprises an abstracted cookie.
12. The method of claim 8 , further comprising storing, by the agent component, the user credentials in a non-persistent cache.
13. The method of claim 12 , further comprising flushing the non-persistent cache after sending the second request to the target network component.
14. The method of claim 8 , further comprising wherein the first response is received from the target network component without the target network component requiring a password.
15. A computer program product comprising a non-transitory computer readable medium storing instructions translatable by a processor, the instructions when translated by the processor perform, in an enterprise computing network environment:
responsive to receiving a request from a user device to access to a target network component, providing, by an agent component, abstracted credentials to the user device
generating, by the user device, a first request intended for the target network component, the request including the abstracted credentials;
generating, by the agent component, a second request based on the first request by replacing the abstracted credentials with user credentials;
sending the second request to the target network component;
receiving, by the agent component, a first response from the target network component, the first response including a session identifier;
generating, by the agent component, a second response based on the first response by replacing the session identifier with an abstracted session identifier; and
sending the second response to the user device.
16. The computer program product of claim 15 , wherein the user device communicates with the agent via a browser extension installed on the user device.
17. The computer program product of claim 15 , wherein the abstracted session identifier comprises an abstracted response header.
18. The computer program product of claim 15 , wherein the abstracted session identifier comprises an abstracted cookie.
19. The computer program product of claim 15 , further comprising storing, by the agent component, the user credentials in a non-persistent cache.
20. The computer program product of claim 19 , further comprising flushing the non-persistent cache after sending the second request to the target network component.