Streamlined authentication and authorization for virtual private network tunnel establishment

1. A method for an identity provider (IdP) service to interoperate with a Virtual Private Network (VPN) client, comprising:

by the IdP service, receiving a login request originating from the VPN client to establish a VPN tunnel between the VPN client and a VPN host, the login request indicating a user of the VPN client; and

by the IdP service, providing a response to the login request, the response including at least both:

first information including an indication that the user of the VPN client is an authorized user; and

second information including an indication of a VPN policy for the VPN tunnel, the VPN policy including a VPN client policy to be utilized during the VPN tunnel by the VPN client and a VPN host policy to be utilized during the VPN tunnel by the VPN host,

wherein:

the response is a single message that is formatted according to a Security Assertion Markup Language (SAML) protocol;

the VPN host policy is included in a host policy portion of the single message; and

the VPN client policy is included in a client policy portion of the single message.

2. The method of claim 1 , wherein:

the VPN client policy comprises at least a split tunneling policy.

3. The method of claim 1 , further comprising:

by the IdP service, providing an indication of the user to a policy manager service; and

determining the indication of the VPN policy based on data provided by the policy manager service corresponding to the user.

4. The method of claim 1 , wherein:

the host policy portion is signed in accordance with a key associated with the VPN host; and

the client policy portion is signed in accordance with a key associated with the VPN client.

5. The method of claim 1 , wherein:

the first information is included in an authorization portion of the single message, the authorization portion signed in accordance with a key associated with the IdP service.

6. A method for a Virtual Private Network (VPN) client to form a VPN tunnel with a VPN host, comprising:

by the VPN client, originating a login request to establish the VPN tunnel between the VPN client and the VPN host, the login request indicating a user of the VPN client; and

by the VPN client, receiving a response to the login request, the response including at least both:

first information including an indication that the user of the VPN client is an authorized user; and

second information including an indication of a VPN policy for the VPN tunnel, the VPN policy including a VPN client policy to be utilized during the VPN tunnel by the VPN client and a VPN host policy to be utilized during the VPN tunnel by the VPN host, wherein:

the response is a single message that is formatted according to a Security Assertion Markup Language (SAML) protocol;

the VPN host policy is included in a host policy portion of the single message; and

the VPN client policy is included in a client policy portion of the single message; and

by the VPN client, providing at least an indication of the VPN host policy to the VPN host.

7. The method of claim 6 , further comprising:

configuring the VPN client in accordance with at least the VPN client policy.

8. The method of claim 6 , further comprising:

by the VPN client, communicating in accordance with at least the VPN client policy.

9. The method of claim 6 , wherein:

the VPN host policy and the VPN client policy are encrypted in accordance with a public key associated with both the VPN host and the VPN client.

10. The method of claim 6 , wherein:

the host policy portion is encrypted with a public key associated with the VPN host; and

the client policy portion is encrypted with a public key associated with the VPN client.

11. The method of claim 6 , wherein:

the VPN client policy comprises at least a split tunneling policy.

12. The method of claim 6 , further comprising:

receiving a single sign-on (SSO) redirect message that includes at least an IdP service as an indicated destination for the login request.

13. A method for a Virtual Private Network (VPN) host to form a VPN tunnel with a VPN client, comprising:

receiving by the VPN host, originating from the VPN client, first information including at least an indication of a VPN host policy to be utilized during the VPN tunnel by a VPN host, wherein:

the first information is received via a single message formatted according to a Security Assertion Markup Language (SAML);

the VPN host policy is included in a host policy portion of the single message; and

by the VPN host, establishing the VPN tunnel with the VPN client, including processing the VPN host policy.

14. The method of claim 13 , wherein:

processing the VPN host policy includes configuring the VPN host in accordance with at least the VPN host policy.

15. The method of claim 13 , further comprising:

by the VPN host, communicating in accordance with the VPN host policy.

16. The method of claim 13 , further comprising:

receiving by the VPN host, second information originating from the VPN client, an indication that a user of the VPN client is an authorized user.

17. The method of claim 13 , further comprising:

by the VPN host, receiving a login request originating from the VPN client; and

providing to the VPN client a single sign-on (SSO) redirect message that includes at least an Identity Provider (IdP) service as an indicated destination for the login request.