Systems and methods for controlling email access
Examples described herein include systems and methods for controlling access to a server, such as an email server or a gateway, in situations where the identity of the requesting device is unknown or where the user device accesses the server using an unknown or unmanaged application. In one example, the system can utilize a user authentication credential included in the request to identify other devices belonging to the user that happen to be enrolled with the system. An out-of-band message can be sent to those enrolled devices, requesting confirmation from the user and, in conjunction with an authentication token, allowing the system to trust the previously unknown device. In the example of an unmanaged application attempting to access an email server, the system can confirm compliance of the requesting device and issue an authentication token that, along with an appropriate command sent to the email server, provides access.
1. A method for obtaining access to an email server using first and second user devices of a user, comprising:
sending, from the first user device to a gateway server, a request for access to an email server, wherein the gateway server has privileged access to the email server and routes emails to and from the email server, and wherein the request includes a user authentication credential associated with the user, a device identifier associated with the user device, and an application identifier associated with an email application being used to request access;
receiving, at the second user device from an out-of-band communication module separate from the gateway server, a message requesting confirmation from the user regarding the request for access sent by the first user device;
providing, from the second user device to the out-of-band communication module, a confirmation in response to the message;
receiving, at the first user device, an authentication token, wherein the authentication token is specific to the first user device, the user, and the email application; and
accessing the email server with the first user device using the authentication token.
2. The method of claim 1 , wherein the authentication token is received from the out-of-band communication module.
3. The method of claim 1 , wherein the authentication token is received from the gateway server.
4. The method of claim 1 , wherein providing the confirmation by the second user device causes a database to be updated with information regarding the authentication token and the associated user device, user, and application.
5. The method of claim 1 , wherein the request for access is sent in response to the user operating the email application on the first user device.
6. The method of claim 1 , wherein the message requesting confirmation is sent by the out-of-band communication module in an instance where the device identifier associated with the first user device is not present on a list of device identifiers approved for access to the email server.
7. The method of claim 1 , wherein the out-of-band communication module executes on the gateway server.
8. A non-transitory, computer-readable medium comprising instructions that, when executed by processors associated with a first user device and a second user device, cause the processors to perform stages for obtaining access to an email server using the first and second user devices of a user, the stages comprising:
sending, from the first user device to a gateway server, a request for access to an email server, wherein the gateway server has privileged access to the email server and routes emails to and from the email server, and wherein the request includes a user authentication credential associated with the user, a device identifier associated with the user device, and an application identifier associated with an email application being used to request access;
receiving, at the second user device from an out-of-band communication module separate from the gateway server, a message requesting confirmation from the user regarding the request for access sent by the first user device;
providing, from the second user device to the out-of-band communication module, a confirmation in response to the message;
receiving, at the first user device, an authentication token, wherein the authentication token is specific to the first user device, the user, and the email application; and
accessing the email server with the first user device using the authentication token.
9. The non-transitory, computer-readable medium of claim 8 , wherein the authentication token is received from the out-of-band communication module.
10. The non-transitory, computer-readable medium of claim 8 , wherein the authentication token is received from the gateway server.
11. The non-transitory, computer-readable medium of claim 8 , wherein providing the confirmation by the second user device causes a database to be updated with information regarding the authentication token and the associated user device, user, and application.
12. The non-transitory, computer-readable medium of claim 8 , wherein the request for access is sent in response to the user operating the email application on the first user device.
13. The non-transitory, computer-readable medium of claim 8 , wherein the message requesting confirmation is sent by the out-of-band communication module in an instance where the device identifier associated with the first user device is not present on a list of device identifiers approved for access to the email server.
14. The non-transitory, computer-readable medium of claim 8 , wherein the out-of-band communication module executes on the gateway server.
15. A system for obtaining access to an email server, the system comprising a first user device and a second user device of a user, wherein the system performs stages comprising:
sending, from the first user device to a gateway server, a request for access to an email server, wherein the gateway server has privileged access to the email server and routes emails to and from the email server, and wherein the request includes a user authentication credential associated with the user, a device identifier associated with the user device, and an application identifier associated with an email application being used to request access;
receiving, at the second user device from an out-of-band communication module separate from the gateway server, a message requesting confirmation from the user regarding the request for access sent by the first user device;
providing, from the second user device to the out-of-band communication module, a confirmation in response to the message;
receiving, at the first user device, an authentication token, wherein the authentication token is specific to the first user device, the user, and the email application; and
accessing the email server with the first user device using the authentication token.
16. The system of claim 15 , wherein the authentication token is received from the out-of-band communication module.
17. The system of claim 15 , wherein the authentication token is received from the gateway server.
18. The system of claim 15 , wherein providing the confirmation by the second user device causes a database to be updated with information regarding the authentication token and the associated user device, user, and application.
19. The system of claim 15 , wherein the request for access is sent in response to the user operating the email application on the first user device.
20. The system of claim 15 , wherein the message requesting confirmation is sent by the out-of-band communication module in an instance in which the device identifier associated with the first user device is not present on a list of device identifiers approved for access to the email server.