Patent ID: 8646035

Claim:
A method for securely accessing an application on an internal network, comprising: configuring a first host name associated with an unrestricted application in a computer as associated with an internal data communication network, wherein the unrestricted application is located in the internal data communication network and eligible for single sign on, and wherein the internal data communication network comprises a communication network linking a plurality of computers whose internet protocol addresses are separated from the public Internet by at least one firewall; invoking the unrestricted application hosted over the internal data communication network with an unrestricted application invocation command, wherein the unrestricted application invocation command includes a second host name that is related to the first host name and resolves to an internet protocol address of an authentication server in the internal data communication network; in response to the invocation of the unrestricted application, transmitting a request to invoke the unrestricted application that includes stored user authentication credentials to the authentication server based on the second host name provided by the unrestricted application invocation command so as to enable single sign on for the unrestricted application; configuring an aliased host name associated with a restricted application in the computer as associated with an external data communication network, wherein the restricted application is located in the internal data communication network and ineligible for single sign on, and wherein the aliased host name resolves to the internet protocol address of the authentication server in the internal data communication network; invoking the restricted application hosted over the internal data communication network with a restricted application invocation command, wherein the restricted application invocation command includes the aliased host name; in response to the invocation of the restricted application, transmitting a request that does not include the stored user authentication credentials to invoke the restricted application to the authentication server based on the aliased host name provided by the restricted application invocation command so as to prevent single sign on for the restricted application; and presenting a manual login requiring an additional sign-on prior to allowing access to the restricted application.