A method for authenticating a user to an on-premises system through a cloud platform, comprising: receiving login credentials from a user through a login page displayed in a browser running on a user device, the receiving performed by a cloud-based authentication service, the cloud-based authentication service running on a first computer operating in a cloud computing environment; invoking an on-premises authentication service through a tunnel connection, the on-premises authentication service running on a second computer operating in an enterprise computing environment, the invoking performed by the cloud-based authentication service, the invoking including forwarding an authentication request to the on-premises authentication service through the tunnel connection, the authentication request containing the login credentials of the user, the on-premises authentication service using the login credentials of the user to obtain a user profile for the user; receiving the user profile for the user from the on-premises authentication service through the tunnel connection; generating, by the cloud-based authentication service, an authentication code using the user profile; communicating the authentication code to the browser running on the user device the browser forwarding the authentication code generated by the cloud-based authentication service to a cloud-based application running within the browser, wherein the cloud-based application obtains, in requesting access to an on-premises content server, an access token from the cloud-based authentication service using the authentication code; and passing the access token to the on-premises authentication service through the tunnel connection, the passing performed by the cloud-based authentication service, wherein the on-premises authentication service verifies the access token and impersonates the user by authenticating as the user to the on-premises content server. receiving login credentials from a user through a login page displayed in a browser running on a user device, the receiving performed by a cloud-based authentication service, the cloud-based authentication service running on a first computer operating in a cloud computing environment; invoking an on-premises authentication service through a tunnel connection, the on-premises authentication service running on a second computer operating in an enterprise computing environment, the invoking performed by the cloud-based authentication service, the invoking including forwarding an authentication request to the on-premises authentication service through the tunnel connection, the authentication request containing the login credentials of the user, the on-premises authentication service using the login credentials of the user to obtain a user profile for the user; receiving the user profile for the user from the on-premises authentication service through the tunnel connection; generating, by the cloud-based authentication service, an authentication code using the user profile; communicating the authentication code to the browser running on the user device the browser forwarding the authentication code generated by the cloud-based authentication service to a cloud-based application running within the browser, wherein the cloud-based application obtains, in requesting access to an on-premises content server, an access token from the cloud-based authentication service using the authentication code; and passing the access token to the on-premises authentication service through the tunnel connection, the passing performed by the cloud-based authentication service, wherein the on-premises authentication service verifies the access token and impersonates the user by authenticating as the user to the on-premises content server.