Firewall access rule authenticated by security assertion markup language (SAML)
Disclosed are systems, apparatuses, methods, computer readable medium, and circuits for providing access to a network. According to at least one example, a method includes: intercepting a request at a firewall the request sent from a computing device regarding establishment of a secure communication session with a network; in response to determining that the request is unauthenticated, notifying a service provider node of the request, wherein the service provider node is configured to: generating a communication session between the computing device and a RBI server; receiving at the firewall authentication information pertaining to authorization for the computing device to establish the secure communication session with the network; identifying that the secure communication session is allowed to be established based on the authentication information; and providing access at the firewall to the computing device to establish the secure communication session with the network.
1 . A method for providing access to a network, the method comprising:
intercepting a request at a firewall that resides in a private network, wherein the request is unauthenticated, sent from a computing device, and corresponds to a plurality of security assertion markup language (SAML) requests;
identifying the computing device by an identity provider node in a public network, wherein the identity provider node identifies the computing device for verification prior to authenticating the computing device for access; and
notifying a service provider node of the request, wherein the service provider node verifies the request by:
generating a communication session between the computing device and a remote browser isolation (RBI) server;
receiving, at the firewall, authentication information pertaining to authorization for the computing device to establish a secure communication session with the private network;
identifying that the secure communication session is allowed to be established based on the authentication information; and
providing the computing device with authorization to establish the secure communication session and access the private network.
2 . The method of claim 1 , wherein the request is a resource request.
3 . The method of claim 2 , wherein the resource request further includes an authentication request to connect to the private network.
4 . The method of claim 3 , wherein the RBI server communicates with the identity provider node, and wherein the identity provider node verifies the authentication request prior to the authorization of the computing device to establish the secure communication session with the private network.
5 . The method of claim 1 , wherein intercepting the request is based on determining that one or more access rules associated with the firewall are invoked.
6 . The method of claim 1 , further comprising generating a secure redirect weblink that redirects to the RBI server; and transmitting the secure redirect weblink to a browser of the computing device.
7 . The method of claim 6 , wherein the secure redirect weblink includes an address of the RBI server.
8 . The method of claim 1 , further comprising prompting the computing device for the authentication information, and transmitting the authentication information to an identity provider node via the firewall.
9 . The method of claim 1 , wherein the private network further includes the computing device.
10 . A non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium having embodied thereon a program executable by a processor for implementing a method for providing access to a network, the method comprising:
intercepting a request at a firewall that resides in a private network, wherein the request is unauthenticated, sent from a computing device, and corresponds to a plurality of security assertion markup language (SAML) requests;
identifying the computing device by an identity provider node configured in a public network, wherein the identity provider node identifies the computing device for verification prior to authenticating the computing device for access; and
notifying a service provider node of the request, wherein the service provider node verifies the request by:
generating a communication session between the computing device and a remote browser isolation (RBI) server;
receiving, at the firewall, authentication information pertaining to authorization for the computing device to establish a secure communication session with the private network;
identifying that the secure communication session is allowed to be established based on the authentication information; and
providing the computing device with authorization to establish the secure communication session and access the private network.
11 . The non-transitory computer-readable storage medium of claim 10 , wherein the request is a resource request.
12 . The non-transitory computer-readable storage medium of claim 11 , wherein the resource request further includes an authentication request to connect to the private network.
13 . The non-transitory computer-readable storage medium of claim 12 , wherein the RBI server communicates with the identity provider node, and wherein the identity provider node verifies the authentication request prior to the authorization, of the computing device to establish the secure communication session with the private network.
14 . The non-transitory computer-readable storage medium of claim 10 , wherein intercepting the request is based on determining that one or more access rules associated with the firewall are invoked.
15 . The non-transitory computer-readable storage medium of claim 10 , further comprising instructions executable to generate a secure redirect weblink that redirects to the RBI server and to transmit the secure redirect weblink to a browser of the computing device.
16 . The non-transitory computer-readable storage medium of claim 15 , wherein the secure redirect weblink includes an address of the RBI server.
17 . The non-transitory computer-readable storage medium of claim 10 , further comprising instructions executable to prompt the computing device for the authentication information, and to transmit the authentication information to an identity provider node via the firewall.
18 . The non-transitory computer-readable storage medium of claim 10 , wherein the private network further includes the computing device.
19 . A system for providing access to a network, the system comprising:
a firewall that resides in a private network, wherein the firewall intercepts a request that is unauthenticated, sent from a computing device, and corresponds to a plurality of security assertion markup language (SAML) requests;
an identity provider node in a public network, wherein the identity provider node identifies the computing device for verification prior to authenticating the computing device for access; and
a service provider node that is notified of the request and verifies the request by:
generating a communication session between the computing device and a remote browser isolation (RBI) server, wherein the firewall receives authentication information pertaining to authorization for the computing device to establish a secure communication session with the private network,
identifying that the secure communication session is allowed to be established based on the authentication information, and
providing the computing device with authorization to establish the secure communication session and access the private network.
20 . The system of claim 19 , wherein the request is a resource request.