A method at an identity server operating beyond a firewall of an enterprise network, comprising: receiving, from a client device, an authentication request (224, 324) for identity authentication required to the client device in order to access a service provider; transmitting, to the client device, an on-premises verification command (230, 330), wherein the on-premises verification command indicates an on-premises agent for verifying on-premises network connectivity of the client device, the on-premises agent operating behind the firewall of the enterprise network; determining whether an on-premises verification response message (244, 344) is received from the client device within a configured time period, the on-premises verification response message (244, 344) including an indication whether an on-premises verification network connectivity of the client device has failed or succeeded; and in response to determining that the on-premises verification response message (244, 344) has not been received within the configured time period, transmitting to the client device: an authentication response (252, 352) indicating that the authentication request fails; or a request for additional authentication credentials, in response to determining that the on-premises verification response message has been received within the configured time period, and on determining that the on-premises verification network connectivity of the client device has failed, transmitting to the client device: an authentication response (252, 352) indicating that the authentication request fails; or a request for additional authentication credentials, in response to determining that the on-premises verification response message has been received within the configured time period, and on determining that the on-premises verification network connectivity of the client device has succeeded, transmitting to the client device an authentication response (252, 352) indicating that the authentication request succeeds. receiving, from a client device, an authentication request (224, 324) for identity authentication required to the client device in order to access a service provider; transmitting, to the client device, an on-premises verification command (230, 330), wherein the on-premises verification command indicates an on-premises agent for verifying on-premises network connectivity of the client device, the on-premises agent operating behind the firewall of the enterprise network; determining whether an on-premises verification response message (244, 344) is received from the client device within a configured time period, the on-premises verification response message (244, 344) including an indication whether an on-premises verification network connectivity of the client device has failed or succeeded; and in response to determining that the on-premises verification response message (244, 344) has not been received within the configured time period, transmitting to the client device: an authentication response (252, 352) indicating that the authentication request fails; or a request for additional authentication credentials, an authentication response (252, 352) indicating that the authentication request fails; or a request for additional authentication credentials, in response to determining that the on-premises verification response message has been received within the configured time period, and on determining that the on-premises verification network connectivity of the client device has failed, transmitting to the client device: an authentication response (252, 352) indicating that the authentication request fails; or a request for additional authentication credentials, an authentication response (252, 352) indicating that the authentication request fails; or a request for additional authentication credentials, in response to determining that the on-premises verification response message has been received within the configured time period, and on determining that the on-premises verification network connectivity of the client device has succeeded, transmitting to the client device an authentication response (252, 352) indicating that the authentication request succeeds.