A data processing system, comprising: a plurality of network interfaces (514, 519) that are coupled to a data network (522, 528) for receiving one or more packets therefrom and sending one or more packets thereto; one or more processors; a switching system coupled to the one or more processors and packet forwarding logic, wherein the switching system and packet forwarding logic are configured to receive packets on a first network interface, determine a second network interface on which to send the packets, and to send the packets on the second network interface; means for receiving over the network an application-layer message comprising one or more of the packets; means for receiving a message identity policy that defines any one or more of: first identity information in a transport-layer protocol header of the application-layer message and whether to extract the first identity information from the transport-layer protocol header; second identity information in an application-layer protocol header of the application-layer message and whether to extract the second identity information from the application-layer protocol header; and third identity information in a message body of the application-layer message and whether to extract the third identity information from the message body; means for extracting any one or more of the first identity information, second identity information, and third identity information as specified in the message identity policy; means for determining one or more authentication operations to authenticate the one or more of the first identity information, second identity information, and third identity information; means for performing the one or more authentication operations, and in response, receiving one or more message sender identity attributes; means for creating an outbound application-layer message that includes the message sender identity attributes; means for forwarding the outbound application-layer message to a next endpoint. a plurality of network interfaces (514, 519) that are coupled to a data network (522, 528) for receiving one or more packets therefrom and sending one or more packets thereto; one or more processors; a switching system coupled to the one or more processors and packet forwarding logic, wherein the switching system and packet forwarding logic are configured to receive packets on a first network interface, determine a second network interface on which to send the packets, and to send the packets on the second network interface; means for receiving over the network an application-layer message comprising one or more of the packets; means for receiving a message identity policy that defines any one or more of: first identity information in a transport-layer protocol header of the application-layer message and whether to extract the first identity information from the transport-layer protocol header; second identity information in an application-layer protocol header of the application-layer message and whether to extract the second identity information from the application-layer protocol header; and third identity information in a message body of the application-layer message and whether to extract the third identity information from the message body; means for extracting any one or more of the first identity information, second identity information, and third identity information as specified in the message identity policy; means for determining one or more authentication operations to authenticate the one or more of the first identity information, second identity information, and third identity information; means for performing the one or more authentication operations, and in response, receiving one or more message sender identity attributes; means for creating an outbound application-layer message that includes the message sender identity attributes; means for forwarding the outbound application-layer message to a next endpoint.