US 12,335,263 B2
Identity proxy and access gateway
James Howard Royal, Austin, TX (US); and Samuel Douglas Rhea, Lisbon (PT)
Assigned to CLOUDFLARE, INC., San Francisco, CA (US)
Filed by CLOUDFLARE, INC., San Francisco, CA (US)
Filed on Jan. 29, 2024, as Appl. No. 18/425,713.
Application 18/425,713 is a continuation of application No. 17/867,355, filed on Jul. 18, 2022, granted, now 11,888,851.
Application 17/867,355 is a continuation of application No. 17/500,159, filed on Oct. 13, 2021, granted, now 11,394,710, issued on Jul. 19, 2022.
Prior Publication US 2024/0171576 A1, May 23, 2024
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 29/06 (2006.01); H04L 9/40 (2022.01)
CPC H04L 63/0884 (2013.01) [H04L 63/0281 (2013.01); H04L 63/20 (2013.01)] 21 Claims
OG exemplary drawing
 
1. A method implemented in an identity proxy and access gateway, comprising:
receiving a first authentication request from a client device that has been generated by a third-party application in response to a first access request from the client device to the third-party application requesting access to a resource at the third-party application, wherein the first authentication request is requesting an authentication of a user that is attempting to access the third-party application, and wherein the identity proxy and access gateway is configured as a first identity provider of the third-party application;
causing the client device to transmit a second authentication request to a second identity provider selected based on configuration data for the third-party application;
receiving, from the client device, a first authentication response that was generated by the second identity provider that indicates the user has successfully authenticated to the second identity provider;
enforcing a first set of one or more access rules to determine whether to allow access to the third-party application based on the first authentication request and first authentication response, wherein the first set of one or more access rules is enforced independently from any rules enforced at the second identity provider;
determining, from the enforcing of the first set of one or more access rules, to allow access the third-party application, and responsive to this determination, generating a second authentication response that indicates a successful authentication; and
transmitting the second authentication response that indicates the user has successfully authenticated to the client device to cause the client device to transmit the second authentication response to the third-party application.