Patent ID: 8904475

Claim:
A method for assigning a client to an authorization group based on a client-side attribute, the method comprising: (a) identifying, by a device intermediary to a plurality of clients and a server, a policy for evaluating a client responsive to a first request of the client to access the server, the policy specifying an expression comprising a plurality of clauses joined by one or more logical operators, each clause of the plurality of clauses identifying a different client-side attribute to be evaluated by the client; (b) transmitting, by the device to the client, a second request to the client to have the client evaluate the plurality of clauses; (c) receiving, by the device from the client, a response to the second request, the response comprising a result of evaluation by the client of the plurality of clauses of the expression; (d) assigning, by the device, the client to an authorization group responsive to applying the policy to the result of the evaluation; and (e) establishing, by the device, a virtual private network connection with the client responsive to the assigned authorization group.