Authenticator centralization and protection based on authenticator type and authentication policy

An authentication server for authenticating a user who is communicating with an enterprise via a network, comprising:

• a memory for receiving, via the network, authenticators for a user from a user device associated with the user, and storing the received authenticators;
• and
• a processor for:
• receiving, from the enterprise, a request to authenticate the user with an authentication policy for authenticating the user, wherein the request does not identify which of the stored authenticators is to be used for authenticating the user, wherein the authentication policy establishes a type of authenticator to be used for authenticating the user;
• determining a first authenticator from the stored authenticators to be used for authenticating the user based on the authentication policy received from the enterprise;
• transmitting an authentication request to the user device via the network requesting the first authenticator;
• in response to the authentication request, receiving from the first user device, an authenticator in response to the authentication request, and authenticating the user by comparing the received authenticator with the stored first authenticator.