Native application single sign-on

A system comprising:

• an authentication client application operating on a client device;
• and
• an authentication service comprising one or more processors and configured to:
• establish a virtual private network (VPN) connection between a client device and an authentication service;
• receive at the authentication service, via the VPN connection, a request from a third-party application on the client device, the request for a third-party service, the request also including first credentials entered by a user;
• obtain, at the authentication service, a log-in web page corresponding to the third-party service;
• scan the log-in page to determine a credential type associated with the log-in web page;
• obtain second credentials, of the determined credential type, corresponding to a user of the client device and also uniquely corresponding to the third-party service;
• detect that the user has multiple possible credentials for the third-party service;
• send a notification to the authentication client application on the client device, the notification including the multiple possible credentials and designed to trigger the authentication client application to notify the user of the multiple possible credentials and obtain a credential choice from the user;
• receive the credential choice from the authentication client application;
• and
• submit the second credentials corresponding to the selection to the third-party service to log-in the user to the third-party service by filling in the log-in web page with the credential choices.

A non-transitory machine-readable storage medium comprising instructions, which when implemented by one or more machines, cause the one or more machines to perform operations comprising:

• establishing a virtual private network (VPN) connection between a client device and an authentication service;
• receiving, at the authentication service, via the VPN connection, a request from a third-party application on the client device, the request for a third-party service, the request also including first credentials entered by a user;
• obtaining, at the authentication service, a log-in web page corresponding to the third-party service;
• scanning the log-in page to determine a credential type associated with the log-in web page;
• obtaining second credentials, of the determined credential type, corresponding to a user of the client device and also uniquely corresponding to the third-party service;
• submitting, to the third-party service, the second credentials by filling in the log-in web page with the second credentials.