Patent ID: 11888851
Assignee: CLOUDFLARE, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 14:
15. An apparatus, comprising:
a processor; and
a non-transitory machine-readable storage medium that provides instructions that, if executed by the processor, will cause an identity proxy and access gateway to perform operations comprising:
receive a first authentication request from a client device that has been generated by a third-party application in response to a first access request from the client device to the third-party application requesting access to a resource at the third-party application, wherein the first authentication request is requesting an authentication of a user that is attempting to access the third-party application, and wherein the identity proxy and access gateway is configured as a first identity provider of the third-party application;
transmit an identity provider selection page to the client device, the identity provider selection page including one or more identity provider options for the user to select for authentication;
receive, from the client device, a selection of one of the one or more identity provider options;
cause the client device to transmit a second authentication request to a second identity provider corresponding to the selected one of the one or more identity provider options;
receive, from the client device, a first authentication response that was generated by the second identity provider that indicates the user has successfully authenticated to the second identity provider;
enforce a first set of one or more access rules to determine whether the user is permitted to access the third-party application, wherein the first set of one or more access rules is enforced independently from any rules enforced at the second identity provider;
determine, from the enforcing of the first set of one or more access rules, that the user is permitted to access the third-party application, and responsive to this determination, generate a second authentication response that indicates the user has successfully authenticated; and
transmit the second authentication response to the client device, wherein the second authentication response is caused to be transmitted to the third-party application that indicates the user has successfully authenticated.