Identity-based policy enforcement in wide area networks

A system associated with a network controller of a network, the system comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable media storing instructions that, when executed by the one or more processors, cause the network controller to perform operations comprising:
• identifying, by the network controller, an edge device associated with the network, the edge device corresponding to a user;
• sending, from the network controller and to the edge device, a networking policy associated with a user group, the networking policy to be applied to traffic sent by members of the user group;
• receiving, by the network controller and from an identity provider, a binding associated with the user who is accessing the network through the edge device, the binding indicating at least an internet protocol (IP) address associated with the user and an indication that the user is a member of the user group;
• and
• based at least in part on the indication that the user is the member of the user group, sending, by the network controller and to the edge device, an indication of the binding and instructions to cause the edge device to apply the networking policy to packets that include the IP address.

One or more non-transitory computer-readable media storing instructions that, when executed, cause one or more processors associated with an edge device to perform operations comprising:

• receiving, by the edge device within a network and from a controller of the network, multiple networking policies associated with respective user groups that access the network via the edge device, a specific networking policy of the multiple networking policies to be applied to traffic sent by members of a specific user group;
• receiving, by the edge device and from the controller, an indication of a binding associated with a user, the binding indicating at least an internet protocol (IP) address associated with the user and an indication that the user is a member of the specific user group;
• receiving, by the edge device, a packet that includes the IP address;
• and
• determining, based at least in part on the binding indicating the user is the member of the specific user group and the packet including the IP address, to apply the specific networking policy to the packet.