Intelligent identity-aware application proxy

A first network apparatus comprising:

• one or more processors;
• and
• one or more computer-readable non-transitory storage media coupled to one or more of the processors and comprising instructions operable when executed by one or more of the processors to cause the first network apparatus to:
• receive, from a client device associated with a user, a request to access a resource;
• determine that the request does not comprise a session cookie;
• in response to determining that the request does not comprise a session cookie, send an authorization request to a second network apparatus;
• in response to sending the authorization request to the second network apparatus, receive, from the second network apparatus, an authorization response comprising a resource authorization token;
• determine that the user is authorized to access the resource based on the received resource authorization token;
• in response to determining that the user is authorized to access the resource, establish a first communication session with the client device by sending a message to the client device, wherein the message comprises a session cookie to be used in a subsequent request for accessing the resource;
• and
• establish a second communication session with a resource server that provides the resource, wherein the first network apparatus relays traffic between the client device and the resource server via the first communication session and the second communication session.

One or more computer-readable non-transitory storage media embodying software that is operable on a first network apparatus when executed to:

• receive, from a client device associated with a user, a request to access a resource;
• determine that the request does not comprise a session cookie;
• in response to determining that the request does not comprise a session cookie, send an authorization request to a second network apparatus;
• in response to sending the authorization request to the second network apparatus, receive, from the second network apparatus, an authorization response comprising a resource authorization token;
• determine that the user is authorized to access the resource based on the received resource authorization token;
• in response to determining that the user is authorized to access the resource, establish a first communication session with the client device by sending a message to the client device, wherein the message comprises a session cookie to be used in a subsequent request for accessing the resource;
• and
• establish a second communication session with a resource server that provides the resource, wherein the first network apparatus relays traffic between the client device and the resource server via the first communication session and the second communication session.