Techniques for controlling authentication

A system, comprising:

• a processing device configured with an authentication control agent that resides and is implemented as executable instructions within a non-transitory computer-readable storage medium that executes on the processing device as a transparent proxy within an enterprise processing environment;
• and
• another processing device or the processing device configured with an authentication audit manager that resides and is implemented within a non-transitory computer-readable storage medium that executes on one of the processing devices;
• the authentication control agent configured to intercept an access request to an external resource made by a principal and configured to identify a third-party authentication provider for the external resource and provide credentials on behalf of the principal for the principal to be authenticated to the external resource for an authenticated session, the principal unaware of the credentials, and the authentication audit manager is configured to proxy the authenticated session from within the enterprise processing environment and monitor actions of the principal during the authenticated session, wherein the authenticated session is proxied by the enterprise processing environment for interactions between the principal and the external resource during the authenticated session, where a device accessed by the principal is not preconfigured to access the transparent proxy, and wherein the principal is to authenticated to the enterprise processing environment using local credentials that do not leave control of the enterprise environment, and wherein the credentials are different from the local credentials and the credentials are unknown to the principal, the principal is unaware of the credentials, the principal never supplied the credentials, and the principal never have the credentials made available to principal, and wherein the authentication control agent is further configured, when the principal is authenticated to the enterprise processing environment, to:
• ensure that the principal has a valid session with an agent of the enterprise processing environment that includes an authentication token representing domain-based authentication of a desktop for the principal.