I have a client that wants to protect access to a web app in case the employee leaves because the app gives access to clients, sales, etc. He wants to "hide" the login credentials to this app and asked us to write a login app that would need to be launched first, then the app would log the user in. This way the user would never know their true credentials and they could not have remote access to this app on weekend. Anyone have done this or have ideas?
I suppose that your problem is about using a Web application that you do not control. That Web application requires some "user credentials" (login and password) which you do not want to show to the human user. But these credentials must exist, and if they are not in the employee's head, then they must be in his machine or another relay machine.
In general, you can envision a proxy system: the employee connects not to the Web app, but to the proxy. The employee authenticates with the proxy through some proxy-specific method, which can be a login+password (not the same as the credentials for the Web app). The proxy then forwards all requests to the Web app, and responses back, except that it also performs the "true" authentication with the Web app.
That proxy can be some software running on the employee's desktop system, but that's kinda weak, because the employee has, by definition, physical access to his own desktop system, so he will be able to extract whatever secrets it contains, if he puts some effort into the task. A stronger system is to make the proxy a separate machine, kept in a bay in a server room, on the company internal network. The point here being that this proxy machine is not reachable by the employee from his home Internet access.
That's about as much as we can tell "in general". How easy or hard it would be to implement such a system depends a lot on how the Web app does things. For instance, if the target Web app uses HTTP Basic Authentication, then the proxy just has to transparently add a