Application Proxy MFA Enforcement Across Identity Providers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional application proxies rely on external identity providers for authentication, making it difficult to configure per-application multifactor authentication (MFA) policies and unable to perform step-up authentication, as they cannot independently enforce authentication methods.
Innovation Solution
An application proxy that operates independently of identity providers, allowing customers to configure and enforce authentication policies on a per-application basis, including MFA and step-up authentication, by redirecting authentication requests to identity providers for verification and comparing the results against configured policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If an application proxy relies on an external identity provider for authentication, then authentication can be performed using established identity provider infrastructure, but the application proxy cannot configure per-application MFA policies or perform step-up authentication
Solution Approach 1:
The patent segments the authentication enforcement capability from the identity provider by introducing a policy evaluation module in the application proxy. This module independently evaluates authentication policies and determines whether step-up authentication is required, separating the policy decision-making function from the identity provider's authentication function. This allows per-application MFA policy configuration while maintaining reliance on the identity provider for actual authentication execution.
2Reliability
If the application proxy redirects back to the identity provider for additional MFA prompt, then the identity provider can verify the user's identity, but the existing session is recognized as valid without triggering the additional MFA prompt
Solution Approach 1:
The patent applies preliminary action by having the policy evaluation module assess authentication policies and determine step-up requirements before the authentication flow completes. The system evaluates the risk level and policy requirements in advance, and only redirects to the identity provider for additional MFA prompts when the preliminary evaluation determines it is necessary. This prevents unnecessary redirects while ensuring step-up authentication is triggered when required.
Solution Approach 2:
The patent implements a feedback mechanism where the policy evaluation module continuously monitors authentication status and risk levels, and provides feedback to control whether additional MFA prompts are required. The system evaluates the current authentication state against configured policies and dynamically determines whether step-up authentication should be enforced, creating a closed-loop control system that adapts to changing security requirements.
3Ease of operation
If the same MFA policy is applied to each application protected by the application proxy, then configuration is simplified at the identity provider, but flexible per-application authentication enforcement cannot be achieved
Solution Approach 1:
The patent applies local quality by enabling different MFA policies to be configured and enforced for different applications through the policy evaluation module. Each application can have its own authentication policy requirements (e.g., specific MFA methods, risk thresholds, step-up rules) that are independently evaluated and enforced. This allows granular, per-application control while the centralized policy management interface maintains ease of configuration.
Data Source
AI summary
An intermediary server operates an application proxy. An access request is received for access to an application, where an access policy is associated with the application that specifies authentication method(s) acceptable for satisfying an authentication requirement enforced by the application proxy. The user agent is redirected to submit an authentication request to an identity provider for identity verification. An authentication response generated by the identity provider is received and includes information that specifies authentication method(s) used during the identity verification. If the authentication method(s) used during the identity verification match the authentication method(s) acceptable for satisfying the authentication requirement, the user will not be prompted to perform those authentication method(s) and the authentication requirement enforced by the application proxy is met. If they do not match, the user will be prompted to perform the authentication method(s) as a condition to access the application.