A method for applying a security policy to an application session, comprising: recognizing the application session between a network and an application via a security gateway ; determining by the security gateway a user identity of the application session using information about the application session wherein, the determining comprises; determining the user identity from an application session record for the application session, wherein the application session record comprises the user identity used for accessing the network through a host, a host identity for the host, and an application session time and wherein a creating of the application session record comprises: querying an identity server by sending the host identity and the application session time in the application session record, wherein the identity server comprises an access session record for an access session between a second host and the network, wherein the access session record comprises a second user identity used for accessing the network through the second host, a second host identity for the second host, and an access session time; comparing by the identity server the host identity in the application session record with the second host identity in the access session record, and comparing the access session time with the application session time; returning by the identity server the second user identity in the access session record, if the host identity in the application session record matches the second host identity in the access session record, and if the access session time matches the application session time; and storing the second user identity as a network user identity used for accessing the network in the application session record; and the method further comprises; obtaining by the security gateway the security policy comprising network parameters mapped to the user identity; and applying the security policy to the application session by the security gateway . recognizing the application session between a network and an application via a security gateway ; determining by the security gateway a user identity of the application session using information about the application session wherein, the determining comprises; determining the user identity from an application session record for the application session, wherein the application session record comprises the user identity used for accessing the network through a host, a host identity for the host, and an application session time and wherein a creating of the application session record comprises: querying an identity server by sending the host identity and the application session time in the application session record, wherein the identity server comprises an access session record for an access session between a second host and the network, wherein the access session record comprises a second user identity used for accessing the network through the second host, a second host identity for the second host, and an access session time; comparing by the identity server the host identity in the application session record with the second host identity in the access session record, and comparing the access session time with the application session time; returning by the identity server the second user identity in the access session record, if the host identity in the application session record matches the second host identity in the access session record, and if the access session time matches the application session time; and storing the second user identity as a network user identity used for accessing the network in the application session record; and the method further comprises; obtaining by the security gateway the security policy comprising network parameters mapped to the user identity; and applying the security policy to the application session by the security gateway . <EOS>