Network address transparency through user role authentication

1. A system comprising:

a server comprising one or more hardware processors configured to:

authenticate an endpoint associated with a network address on an initial virtual network;

determine a user identity of the endpoint based on authentication of the endpoint; and

determine an authorized virtual network associated with the user identity; and

generate a Change-Of-Authorization (COA) message moving the endpoint to the authorized virtual network; and

a controller device associated with a network fabric to which the endpoint is connected, the network fabric including a plurality of network elements configured to carry network traffic for the endpoint, wherein the controller is configured to:

receive the COA message from the server that the network traffic for the endpoint associated with the network address is to be routed over the authorized virtual network;

based on the COA message received from the server, store an association of the network address with the authorized virtual network;

based on the association of the network address with the authorized virtual network, update routing information to associate the network address with the authorized virtual network instead of the initial virtual network; and

send the updated routing information to the plurality of network elements, without changing the network address of the endpoint.

2. The system of claim 1 , wherein the controller is configured to update the routing information by associating the network address of the endpoint with a layer 2 identifier of the authorized virtual network or a layer 3 identifier of the authorized virtual network.

3. The system of claim 1 , wherein the plurality of network elements are further configured to receive a packet for the endpoint, encapsulate the packet in accordance with an overlay protocol, and route the packet along the authorized virtual network according to the updated routing information.

4. The system of claim 1 , wherein the server is further configured to:

receive an indication of the user identity from the endpoint;

confirm the user identity of the endpoint; and

associate user identities with one or more virtual networks through an identity service function.

5. The system of claim 4 , wherein the server is configured to associate user identities with one or more virtual networks through Source Group Tags based on an identity policy.

6. The system of claim 1 , further comprising a Dynamic Host Configuration Protocol server to provision the endpoint with the network address on the initial virtual network.

7. The system of claim 1 , wherein the network address is one of Media Access Control address, an Internet Protocol address, or an Organizational Unique Identifier.

8. A method comprising:

at a server comprising one or more hardware processors, authenticating an endpoint associated with a network address on an initial virtual network, the endpoint connected to the server through a network fabric;

determining a user identity of the endpoint based on the authentication of the endpoint;

determining an authorized virtual network associated with the determined user identity;

generating a Change-Of-Authorization (COA) message moving the endpoint to the authorized virtual network; and

transmitting the COA message to a controller of the network fabric, the COA message including an association of the network address of the endpoint with the authorized virtual network instead of the initial virtual network.

9. The method of claim 8 , wherein the COA message associates the network address of the endpoint with a layer 2 identifier of the authorized virtual network or a layer 3 identifier of the authorized virtual network.

10. The method of claim 8 , wherein determining the authorized virtual network is with an identity service function that is configured to associate user identities with virtual networks.

11. The method of claim 10 , wherein the identity service function associates user identities with virtual networks through Source Group Tags based on an identity policy.

12. The method of claim 8 , wherein the network address is one of Media Access Control address, an Internet Protocol address, or an Organizational Unique Identifier.

13. A method comprising:

at a controller device associated with a network fabric that comprises a plurality of network elements, receiving a Change-Of-Authorization (COA) message indicating that network traffic for an endpoint associated with a network address on an initial virtual network is to be routed over an authorized virtual network on the network fabric, the endpoint connected to a server through the network fabric;

based on the COA message received from the server, storing an association of the network address with the authorized virtual network;

based on the association of the network address with the authorized virtual network, updating routing information to associate the network address with the authorized virtual network instead of the initial virtual network; and

sending the updated routing information to the plurality of network elements without changing the network address of the endpoint.

14. The method of claim 13 , wherein updating the routing information comprises associating the network address of the endpoint with a layer 2 identifier of the authorized virtual network or a layer 3 identifier of the authorized virtual network.

15. The method of claim 13 , wherein the COA message is received from an identity service function of the server, the identity service function configured to associate user identities with virtual networks.

16. The method of claim 15 , wherein the COA message from the identity service function includes a Source Group Tag based on an identity policy to associate the authorized virtual network with a user identity of the endpoint.

17. The method of claim 13 , wherein the network address is one of Media Access Control address, an Internet Protocol address, or an Organizational Unique Identifier.

18. The system of claim 1 , wherein the authorized virtual network is associated with a separate Virtual Routing and Forwarder (VRF) than that of the initial virtual network.

19. The method of claim 8 , wherein the authorized virtual network is associated with a separate Virtual Routing and Forwarder (VRF) than that of the initial virtual network.

20. The system of claim 13 , wherein the authorized virtual network is associated with a separate Virtual Routing and Forwarder (VRF) than that of the initial virtual network.