Secure web proxy and temporary passcode for SSL exempted session-based authentication
Approaches to providing endpoint client authentication and application access control in a zero-trust network access (ZTNA) environment are described. A secure session is generated with a secure web proxy based on a request from a browser, wherein the request corresponds to a user and requests access to a server. A secure tunnel is established between the secure web proxy and the browser. A web proxy address corresponding to the user is generated. The user is identified based on a handshake procedure with the secure web proxy. A temporary passcode is generated for the user to be used for access to the server. The temporary passcode is sent to an email address associated with the user. The server is caused to authenticate the user utilizing the temporary passcode to allow the user access to the server if the temporary passcode is approved.
1 . A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more hardware processors, are configurable to cause the one or more hardware processors to:
generate a secure session with a secure web proxy based on a request from a browser, wherein the request corresponds to a user and requests access to a server;
establish a secure tunnel between the secure web proxy and the browser;
generate a web proxy address corresponding to the user;
identify the user based on a handshake procedure with the secure web proxy;
generate a temporary passcode for the user to be used for access to the server;
send the temporary passcode to an email address associated with the user; and
cause the server to authenticate the user utilizing the temporary passcode to allow the user access to the server if the temporary passcode is approved.
2 . The non-transitory computer-readable medium of claim 1 further comprising instructions that, when executed by the one or more hardware processors, are configurable to cause the one or more hardware processors to grant access to the server in response to authentication of the user based on the temporary passcode.
3 . The non-transitory computer-readable medium of claim 1 , wherein the secure session comprises a Secure Socket Layer (SSL) or Transport Layer Security (TLS) compliant secure session.
4 . The non-transitory computer-readable medium of claim 1 , wherein the web proxy address comprises a Fully Qualified Domain Name (FQDN).
5 . The non-transitory computer-readable medium of claim 1 , wherein identifying the user comprises parsing out a user identifier (ID) from a server name indication (SNI) during the handshake procedure between a browser being used by the user and the secure web proxy.
6 . The non-transitory computer-readable medium of claim 1 , wherein authenticating the user to allow access to the server comprises using a HyperText Transfer Protocol (HTTP) Basic authentication.
7 . The non-transitory computer-readable medium of claim 1 , wherein the access to the server is based on a session-based authentication that is authenticated using security assertion markup language (SAML)-based authentication.
8 . A system comprising:
one or more storage devices;
one or more hardware processors coupled with the one or more storage devices, the one or more hardware processors configurable to:
generate a secure session with a secure web proxy based on a request from a browser, wherein the request corresponds to a user and requests access to a server;
establish a secure tunnel between the secure web proxy and the browser;
generate a web proxy address corresponding to the user;
identify the user based on a handshake procedure with the secure web proxy;
generate a temporary passcode for the user to be used for access to the server;
send the temporary passcode to an email address associated with the user; and
cause the server to authenticate the user utilizing the temporary passcode to allow the user access to the server if the temporary passcode is approved.
9 . The system of claim 8 , wherein the one or more hardware processors are configurable to grant access to the server in response to authentication of the user based on the temporary passcode.
10 . The system of claim 8 , wherein the secure session comprises a Secure Socket Layer (SSL) or Transport Layer Security (TLS) compliant secure session.
11 . The system of claim 8 , wherein the web proxy address comprises a Fully Qualified Domain Name (FQDN).
12 . The system of claim 8 , wherein identifying the user comprises parsing out a user identifier (ID) from a server name indication (SNI) during the handshake procedure between a browser being used by the user and the secure web proxy.
13 . The system of claim 8 , wherein authenticating the user to allow access to the server comprises using a HyperText Transfer Protocol (HTTP) Basic authentication.
14 . The system of claim 8 , wherein the access to the server is based on a session-based authentication that is authenticated using security assertion markup language (SAML)-based authentication.
15 . A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more hardware processors, are configurable to cause the one or more hardware processors to:
generate a secure session with a secure cloud portal service based on a request from a browser, wherein the request corresponds to a user and requests access to a server;
perform at least a portion of a handshake procedure between the browser and the secure cloud portal service, wherein the secure cloud portal service redirects the browser to an identity provider;
authenticate the user;
generate a web proxy address for the user, wherein a portion of the web proxy address maps to a username corresponding to the user;
provide the web proxy address to the browser;
identify the user based on a second handshake procedure with the secure cloud portal service, wherein the second handshake protocol does not allow for deep inspection;
generate a temporary passcode for the user to be used for access to the server;
send the temporary passcode to an email address associated with the user; and
cause the server to authenticate the user utilizing the temporary passcode to allow the user access to the server if the temporary passcode is approved.
16 . The non-transitory computer-readable medium of claim 15 further comprising instructions that, when executed by the one or more hardware processors, are configurable to cause the one or more hardware processors to grant access to the server in response to authentication of the user based on the temporary passcode.
17 . The non-transitory computer-readable medium of claim 15 , wherein the handshake procedure comprises a Secure Socket Layer (SSL) or Transport Layer Security (TLS) compliant handshake procedure.
18 . The non-transitory computer-readable medium of claim 15 , wherein the user authentication comprises a security assertion markup language (SAML)-based authentication.
19 . The non-transitory computer-readable medium of claim 15 , wherein the web proxy address comprises a Fully Qualified Domain Name (FQDN).
20 . The non-transitory computer-readable medium of claim 15 , wherein identifying the user comprises parsing out a user identifier (ID) from a server name indication (SNI) during the handshake procedure between a browser being used by the user and the secure web proxy.