Secure identity propagation in a cloud-based computing environment

A system, comprising:

• a memory;
• at least one hardware processor interoperably coupled with the memory and configured to:
• receive, from a user application and at a cloud-based security token service (STS) executing in the same cloud domain name server (DNS) domain as a cloud application a first security response message used to generate a Token Granting Token (TGT) for generating a Service Token (ST), wherein the user application is external to the cloud DNS domain, and wherein the first security response message is generated externally to the cloud DNS domain by an Identity Provider (IDP) after successful verification of the user application following an attempted access by the user application of a protected resource in the cloud application;
• transmit, from the STS and to the user application in response to receiving the first security response message, a second security response message, wherein the second security response message is generated by the STS, wherein the second security response message comprises the TGT, and wherein the TGT includes a unique identifier of the TGT and a unique identifier of the cloud application;
• receive, at the STS and from the cloud application, a ST request, wherein the ST request comprises the TGT received from the user application;
• verify, at the STS, the ST request based on the TGT;
• generate, at the STS and in response to the verifying, a ST, wherein the ST is used to validate an access request to access a backend system;
• and
• transmit the ST from the STS to the cloud application.

A non-transitory, computer-readable medium storing computer-readable instructions for secure identity propagation, the instructions executable by a computer and configured to:

• receive, from a user application and at a cloud-based security token service (STS) executing in the same cloud domain name server (DNS) domain as a cloud application a first security response message used to generate a Token Granting Token (TGT) for generating a Service Token (ST), wherein the user application is external to the cloud DNS domain, and wherein the first security response message is generated externally to the cloud DNS domain by an Identity Provider (IDP) after successful verification of the user application following an attempted access by the user application of a protected resource in the cloud application;
• transmit, from the STS and to the user application in response to receiving the first security response message, a second security response message, wherein the second security response message is generated by the STS, wherein the second security response message comprises the TGT, and wherein the TGT includes a unique identifier of the TGT and a unique identifier of the cloud application;
• receive, at the STS and from the cloud application, a ST request, wherein the ST request comprises the TGT received from the user application;
• verify, at the STS, the ST request based on the TGT;
• generate, at the STS and in response to the verifying, a ST, wherein the ST is used to validate an access request to access a backend system;
• and
• transmit the ST from the STS to the cloud application.