System and method for application session monitoring and control

A proxy application system comprising:

• at least one memory configured to store program logic for application access and monitoring;
• and
• at least one processor configured to access the memory and to execute the program logic, the program logic comprising:
• communication logic configured to:
• receive an encrypted response for an authentication request made on behalf of a user for access to an application;
• receive and transmit first session communications with a user device, the first session communications being associated with a session with the application;
• and
• receive and transmit second session communications with the application, the second session communications being associated with the session with the application;
• authentication logic configured to:
• authenticate user access to the application on behalf of the user based on the received encrypted response;
• and
• session monitoring logic configured to:
• monitor the first session communications and the second session communications.

An identity and access management (IAM) system comprising:

• at least one memory configured to store program logic for application access and identity authentication;
• and
• at least one processor configured to access the memory and to execute the program logic, the program logic comprising:
• risk assessment logic configured to:
• determine whether a session that is requested to be established and that is associated with an authentication request should be checked for session monitoring;
• identity provider (IdP) logic configured to:
• receive the authentication request on behalf of a user who is attempting to access an application;
• generate an authentication response to grant access to the application for the user;
• and
• based on a determination that the session should be checked for session monitoring, encrypt and provide the authentication response and metadata to a session monitoring decision system that is remote to the application to determine whether the session should be monitored.