Systems and methods for controlling email access
Examples described herein include systems and methods for controlling access to a server, such as an email server or a gateway, in situations where the identity of the requesting device is unknown or where the user device accesses the server using an unknown or unmanaged application. In one example, the system can utilize a user authentication credential included in the request to identify other devices belonging to the user that happen to be enrolled with the system. An out-of-band message can be sent to those enrolled devices, requesting confirmation from the user and, in conjunction with an authentication token, allowing the system to trust the previously unknown device. In the example of an unmanaged application attempting to access an email server, the system can confirm compliance of the requesting device and issue an authentication token that, along with an appropriate command sent to the email server, provides access.
1. A method for providing access to an email server, comprising:
receiving, at an identity management server, a communication from the email server, the communication including information regarding a request for access to the email server from a user device;
in response to receiving the communication from the email server at the identity management server, sending, from the identity management server to a management server at which the user device is enrolled, a request for authorization to access the email server;
determining, at the management server, whether the user device is authorized to access the email server; and
in response to the management server determining that the user device is authorized to access the email server, instructing the identity management server to provide an authentication token to the user device for accessing the email server.
2. The method of claim 1 , wherein the identity management server is identified to receive the communication from the email server based on a domain of an email address associated with the user device.
3. The method of claim 1 , further comprising updating, by the management server, a lookup table to indicate that the user device is authorized to access the email server, wherein the identity management server uses the lookup table to perform a subsequent authorization of the user device.
4. The method of claim 1 , further comprising, in response to the management server determining that the user device is not authorized to access the email server, instructing the email server to block access for the user device.
5. The method of claim 1 , wherein the information regarding the request for authorization to access the email server includes the identification of an application used to request access to the email server, and wherein determining whether the user device is authorized comprises determining, at the management server, whether the identified application is approved to access the email server.
6. The method of claim 1 , wherein determining whether the user device is authorized to access the email server comprises:
sending an out-of-band message to the user, the message requesting confirmation from the user regarding the request for access from the user device; and
receiving confirmation from the user in response to the out-of-band message.
7. The method of claim 1 , further comprising instructing the email server to request the authentication token from the user device, wherein access is contingent upon the authentication token being received at the email server.
8. A non-transitory, computer-readable medium comprising instructions that, when executed by a processor associated with a computing device, cause the processor to perform stages for providing access to an email server, the stages comprising:
receiving, at an identity management server, a communication from the email server, the communication including information regarding a request for access to the email server from a user device;
in response to receiving the communication from the email server at the identity management server, sending, from the identity management server to a management server at which the user device is enrolled, a request for authorization to access the email server;
determining, at the management server, whether the user device is authorized to access the email server; and
in response to the management server determining that the user device is authorized to access the email server, instructing the identity management server to provide an authentication token to the user device for accessing the email server.
9. The non-transitory, computer-readable medium of claim 8 , wherein the identity management server is identified to receive the communication from the email server based on a domain of an email address associated with the user device.
10. The non-transitory, computer-readable medium of claim 8 , the stages further comprising updating, by the management server, a lookup table to indicate that the user device is authorized to access the email server, wherein the identity management server uses the lookup table to perform a subsequent authorization of the user device.
11. The non-transitory, computer-readable medium of claim 8 , the stages further comprising, in response to the management server determining that the user device is not authorized to access the email server, instructing the email server to block access for the user device.
12. The non-transitory, computer-readable medium of claim 8 , wherein the information regarding the request for authorization to access the email server includes the identification of an application used to request access to the email server, and wherein determining whether the user device is authorized comprises determining, at the management server, whether the identified application is approved to access the email server.
13. The non-transitory, computer-readable medium of claim 8 , wherein determining whether the user device is authorized to access the email server comprises:
sending an out-of-band message to the user, the message requesting confirmation from the user regarding the request for access from the user device; and
receiving confirmation from the user in response to the out-of-band message.
14. The non-transitory, computer-readable medium of claim 8 , the stages-further comprising instructing the email server to request the authentication token from the user device, wherein access is contingent upon the authentication token being received at the email server.
15. A system for providing access to an email server, comprising:
an identity management server; and
a management server at which a user device is enrolled, wherein:
receiving, at an identity management server, a communication from the email server, the communication including information regarding a request for access to the email server from a user device;
in response to receiving the communication from the email server at the identity management server, sending, from the identity management server to a management server at which the user device is enrolled, a request for authorization to access the email server;
determining, at the management server, whether the user device is authorized to access the email server; and
in response to the management server determining that the user device is authorized to access the email server, instructing the identity management server to provide an authentication token to the user device for accessing the email server.
16. The system of claim 15 , wherein the identity management server is identified to receive the communication from the email server based on a domain of an email address associated with the user device.
17. The system of claim 15 , further comprising updating, by the management server, a lookup table to indicate that the user device is authorized to access the email server, wherein the identity management server uses the lookup table to perform a subsequent authorization of the user device.
18. The system of claim 15 , further comprising, in response to the management server determining that the user device is not authorized to access the email server, instructing the email server to block access for the user device.
19. The system of claim 15 , wherein the management server determines whether the user device is authorized to access the email server by:
sending an out-of-band message to the user, the message requesting confirmation from the user regarding the request for access from the user device; and
receiving confirmation from the user in response to the out-of-band message.
20. The system of claim 15 , further comprising instructing the email server to request the authentication token from the user device, wherein access is contingent upon the authentication token being received at the email server.