How Clientless Zero Trust Network Access works

Summary

The key components involved in the Zero Trust Access clientless workflow are:

  • User: Initiates access requests through a browser and provides authentication credentials.

  • Identity Provider (IdP): Handles user authentication including primary and multi-factor authentication challenges.

  • Threat Defense: Validates HTTPS requests, processes SAML responses, and controls application access.

  • Application: The target resource that users access after successful authentication and authorization.

Workflow

Clientless zero trust network access workflow
The clientless zero trust network access workflow illustrates the stages of processing user requests, including user authentication, HTTPS request validation, and application access control.

These stages describe how the clientless zero trust network access workflow processes user requests:

  1. User types the application URL in the browser and threat defense validates the HTTPS request.
    • If the HTTPS request is valid, the user is redirected to the mapped port.
    • If the HTTPS request is invalid, the user is sent for authentication per application.
  2. The user is redirected to the configured identity provider (IdP).
  3. The IdP performs authentication challenges for the user.
    • The user is redirected to the configured primary authentication source.
    • The user is challenged with the configured secondary multi-factor authentication, if any.
  4. The IdP sends a SAML response to threat defense. The user ID and other necessary parameters are retrieved from the SAML response through the browser.
  5. The user is redirected to the application.
  6. The user is allowed access to the application after validation is successful.