A method of enabling single sign-on, SSO, access to an application executing in an enterprise, the application being configured for access via multiple, distinct authentication methods, comprising: configuring an enterprise-based connector in association with an enterprise infrastructure on which the application executes, the enterprise-based connector being managed by a cloud service provider to provide end users located external to the enterprise infrastructure with authorized, network-based secure access to the application without inbound open tunnels or ports to the enterprise infrastructure, thereby preventing the enterprise infrastructure from being exposed; during a first access to the application and responsive to successful authentication of an end user by the cloud service provider and via a first authentication method, encrypting a credential associated with the successful authentication to generate an encrypted user token; forwarding the encrypted user token from the enterprise-based connector for storage in a database located externally to the enterprise infrastructure and accessible by the enterprise-based connector; during a second subsequent access to the application and following a redirect that returns the end user to the enterprise-based connector, the enterprise-based connector fetching the encrypted user token from the database; the enterprise-based connector decrypting the encrypted user token to recover the credential; and the enterprise-based connector performing an authentication protocol translation by using the credential so recovered to authenticate the user to the application via a second authentication method non over-lapping to the first authentication method. configuring an enterprise-based connector in association with an enterprise infrastructure on which the application executes, the enterprise-based connector being managed by a cloud service provider to provide end users located external to the enterprise infrastructure with authorized, network-based secure access to the application without inbound open tunnels or ports to the enterprise infrastructure, thereby preventing the enterprise infrastructure from being exposed; during a first access to the application and responsive to successful authentication of an end user by the cloud service provider and via a first authentication method, encrypting a credential associated with the successful authentication to generate an encrypted user token; forwarding the encrypted user token from the enterprise-based connector for storage in a database located externally to the enterprise infrastructure and accessible by the enterprise-based connector; during a second subsequent access to the application and following a redirect that returns the end user to the enterprise-based connector, the enterprise-based connector fetching the encrypted user token from the database; the enterprise-based connector decrypting the encrypted user token to recover the credential; and the enterprise-based connector performing an authentication protocol translation by using the credential so recovered to authenticate the user to the application via a second authentication method non over-lapping to the first authentication method.