Dual domain cloud Kerberos authentication

A non-transitory computer-readable storage medium storing computer program instructions executable by a computer processor to perform operations for authorizing access to a web domain, the operations comprising:

• receiving, from a browser of a computing device, a request to access a web domain hosted on a cloud computing infrastructure;
• sending, to the browser of the computing device:
• a web page comprising a redirect script that redirects the browser to a particular companion domain of the web domain, wherein the particular companion domain comprises a domain name system (DNS) zone file comprising an ALIAS record for the particular subdomain;
• and
• an authentication challenge for access to the web domain;
• receiving, from the browser of the computing device, a Kerberos service ticket, wherein the particular companion domain redirects the browser to the web domain from the particular companion domain responsive to receipt of the Kerberos service ticket;
• and
• providing, to the browser, access to the web domain.

A system, comprising:

• a computer processor;
• and
• a non-transitory computer-readable storage medium storing computer program instructions executable by the computer processor to perform operations for authorizing access to a web domain, the operations comprising:
• receiving, from a browser of a computing device, a request to access a web domain hosted on a cloud computing infrastructure;
• sending, to the browser of the computing device:
• a web page comprising a redirect script that redirects the browser to a particular companion domain of the web domain, wherein the particular companion domain comprises a domain name system (DNS) zone file comprising an ALIAS record for the particular subdomain;
• and
• an authentication challenge for access to the web domain;
• receiving, from the browser of the computing device, a Kerberos service ticket, wherein the particular companion domain redirects the browser to the web domain from the particular companion domain responsive to receipt of the Kerberos service ticket;
• and
• providing, to the browser, access to the web domain.