System and method for authenticating client devices communicating with an enterprise system

A method of authenticating client devices communicating with an enterprise system, the method executed by a server device and comprising:

• providing a policy enforcement interceptor to intercept application programming interface (API) calls to an API used to access an application by a client device;
• enabling the policy enforcement interceptor to communicate with a policy information point connected to at least one endpoint in the enterprise system to query the at least one endpoint for entitlements associated with an account;
• intercepting, by the policy enforcement interceptor, an API call to the application API comprising an operation for payload elements and account information;
• communicating, by the policy enforcement interceptor and via an encrypted channel, with the policy information point to request entitlements associated with the account information;
• querying, by the policy information point, via the encrypted channel, an entitlements database in the enterprise system to receive the requested entitlements;
• communicating, from the policy information point to the policy enforcement interceptor, via the encrypted channel, the received entitlements associated with the account information;
• determining, with the policy enforcement interceptor, whether the received entitlements have been altered;
• in response to determining the received entitlements are valid, invoking a policy decision point
• validating, with the policy decision point, the client device, that the account has access privileges that permit the requested operation, and that the account has authority to operate against the payload elements;
• in response to determining the client device is validated, permitting invocation of the API;
• and
• providing an API response to the client device to permit access to the application via the API.

A non-transitory computer readable medium for authenticating client devices communicating with an enterprise system, the computer readable medium comprising computer executable instructions for:

• providing a policy enforcement interceptor to intercept application programming interface (API) calls to an API used to access an application by a client device;
• enabling the policy enforcement interceptor to communicate with a policy information point connected to at least one endpoint in the enterprise system to query the at least one endpoint for entitlements associated with an account;
• intercepting, by the policy enforcement interceptor, an API call to the application API comprising an operation for payload elements and account information;
• communicating, by the policy enforcement interceptor and via an encrypted channel, with the policy information point to request entitlements associated with the account information;
• querying, by the policy information point, via the encrypted channel, an entitlements database in the enterprise system to receive the requested entitlements;
• communicating, from the policy information point to the policy enforcement interceptor, via the encrypted channel, the received entitlements associated with the account information;
• determining, with the policy enforcement interceptor, whether the received entitlements are valid;
• in response to determining the received entitlements are valid, invoking a policy decision point
• validating, with the policy decision point, the client device, that the account has access privileges that permit the requested operation, and that the account has authority to operate against the payload elements;
• in response to determining the client device is validated, permitting invocation of the API;
• and
• providing an API response to the client device to permit access to the application via the API.