How Clientless Zero Trust Network Access works

Summary

The key components involved in the Zero Trust Access clientless workflow are:

  • User: Initiates access requests through a browser and provides authentication credentials.

  • Identity Provider (IdP): Handles user authentication including primary and multi-factor authentication challenges.

  • Threat Defense: Validates HTTPS requests, processes SAML responses, and controls application access.

  • Application: The target resource that users access after successful authentication and authorization.

Workflow

Clientless zero trust network access workflow
The clientless zero trust network access workflow illustrates the stages of processing user requests, including user authentication, HTTPS request validation, and application access control.

These stages describe how the clientless zero trust network access workflow processes user requests:

  1. User types the application URL in the browser and threat defense validates the HTTPS request.
    • If the HTTPS request is authenticated and the session is valid, the user is redirected to the mapped port and granted access to the application. The workflow stops here.
    • If the HTTPS request is not authenticated, the user is sent for authentication per application. The workflow continues.
  2. The user is redirected to the configured identity provider (IdP).
  3. The IdP performs authentication challenges for the user.
    • The user is redirected to the configured primary authentication source.
    • The user is challenged with the configured secondary multi-factor authentication, if any.
  4. After authentication, the IdP sends a SAML response. The user ID and other necessary parameters are retrieved from the SAML response through the browser.
  5. The user is redirected to the application mapped port.
  6. The user is allowed access to the application after session validation is successful.