Secure application access system

One or more non-transitory computer-readable storage media, storing one or more sequences of instructions, which when executed by one or more processors cause performance of:

• receiving, by an identity provider, a single-sign-on request from a user device for access to a cloud-based application program, the user device sends a request for access to the cloud-based application program to an application server and receives the cloud network location of the identity provider from the application server,
• the identity provider configured to authenticate computer
• security validation requests for the application program;
• validating, by the identity provider, the single-sign-on request;
• in response to validating the single-sign-on request, directing, by the identity provider,
• the user device to a cloud network location of an application proxy server with a valid identification assertion, the user device thereafter communicates with the application program via a URL rewritten to go through the application proxy server, the URL originally addressed to the application program, the application proxy server not co-located with the application server.

A system that improves secure access to cloud-based application programs, comprising:

• an identity provider, implemented at least partially in hardware, configured to receive a
• single-sign-on request from a user device for access to a cloud-based application program, the user device sends a request for access to the cloud-based application program to an application server and receives the cloud network location of the identity provider from the application server, the identity provider configured to authenticate computer security validation requests for the application program;
• an application proxy server, implemented at least partially in hardware, configured to direct all accesses to cloud-based application programs provided by an application provider to itself;
• wherein the identity provider validates the single-sign-on request;
• wherein, in response to validating the single-sign-on request, the identity provider directs the user device to a cloud network location of an application proxy server with a valid identification assertion, the user device thereafter communicates with the application program via a URL rewritten to go through the application proxy server, the URL originally addressed to the application program, the application proxy server not co-located with the application server.