Applying forwarding policy to an application session

A system for applying a forwarding policy by a network gateway comprising:

• a network gateway that:
• recognizes an application session between a first host having a first host identity and an application server;
• determines an application identifier, application session time, and first user identity associated with the application session;
• queries an identity server by providing the first host identity and the application session time;
• receives, from the identity server, a second user identity from an access session record in response to the query, wherein the identity server further:
• determines a correlation between the first host identity and a second host identity associated with a second host in the access session record;
• determines a correlation between the application session time and an access session time in the access session record;
• associates the second user identity with the first user identity;
• receives a forwarding policy based on the second user identity or the first user identity;
• and
• applies the forwarding policy to the application session.

A non-transitory computer-readable medium having instructions stored thereon, the instructions being executable by at least one processor to perform a method, the method comprising:

• recognizing an application session between a first host having a first host identity and an application server;
• determining an application identifier, application session time, and first user identity associated with the application session;
• querying an identity server by providing the first host identity and the application session time;
• receiving, from the identity server, a second user identity from an access session record in response to the query, wherein the receiving comprises:
• determining a correlation between the first host identity and a second host identity associated with a second host in the access session record;
• determining a correlation between the application session time and an access session time in the access session record;
• associating the second user identity with the first user identity;
• receiving a forwarding policy based on the second user identity or the first user identity;
• and
• applying the forwarding policy to the application session.