Secure application access system

A non-transitory computer readable medium, storing software instructions, which when executed by one or more processors cause performance of:

• receiving, by a proxy server, a single-sign-on request from a device for access to an application program, the device directed by an application server to a cloud network location of the proxy server, the proxy server configured to authenticate computer security validation requests for the application program;
• directing, by the proxy server, the device an identity provider by sending the device a network location of the identity provider, the identity provider configured to authenticate computer security validation requests for the proxy server, the device communicates directly with the identity provider using the network location of the identity provider, the identity provider redirects the device to the cloud network location of the proxy server with a single-sign-on validation after validation of the single-sign-on request;
• receiving, at the proxy server, the single-sign-on validation from the device;
• creating, by the proxy server, a valid identification assertion;
• directing, by the proxy server, the device to the application server by sending the device a network location of the application server and the valid identification assertion, the device communicates directly with the application server using the network location of the application server and the valid identification assertion, the device thereafter communicates directly with the application server for subsequent accesses to the application program.

A system that improves secure access to application programs, comprising:

• a proxy server, the proxy server configured to authenticate computer security validation requests for application programs;
• an application proxy server, the application proxy server directs all accesses to application programs from an application service provider to itself;
• a device request receiver, implemented at least partially in hardware at the proxy server, that receives from a device a single-sign-on request for access to an application program, the device directed by the application proxy server to a cloud network location of the proxy server;
• a device redirector, implemented at least partially in hardware at the proxy server, that directs the device to an identity provider by sending the device a network location of the identity provider, the identity provider configured to authenticate computer security validation requests for the proxy server, the device communicates directly with the identity provider using the network location of the identity provider, the identity provider redirects the device to the cloud network location of the proxy server with a single-sign-on validation after validation of the single-sign-on request;
• wherein the device request receiver receives the single-sign-on validation from the device;
• an assertion generator, implemented at least partially in hardware at the proxy server, that creates a valid identification assertion;
• wherein the device redirector directs the device to the application proxy server by sending the device a network location of the application proxy server and the valid identification assertion, the device communicates directly with the application server using the network location of the application server and the valid identification assertion, the device thereafter communicates directly with the application proxy server for subsequent accesses to the application program.