Identity-Aware Proxy (IAP)

An IAP decouples authentication from the application itself. It intercepts all requests and redirects unauthenticated users to a centralized Identity Provider (IdP) using standards like OAuth 2.0 and OpenID Connect (OIDC). After successful authentication, the IAP evaluates the user's identity and attributes against a fine-grained Attribute-Based Access Control (ABAC) policy engine before forwarding the request to the backend application. This ensures that no unauthenticated traffic ever reaches the application code.

The foundational security model that eliminates implicit trust. ZTA mandates continuous verification of every access request regardless of origin—whether inside or outside the traditional network perimeter. IAP serves as a critical enforcement component within ZTA by brokering application-level access based on identity and device context rather than network location. Core principles include least privilege access, micro-segmentation, and the assumption that no user or device is inherently trustworthy.

The architectural brain of a zero-trust network. The PDP evaluates access requests against attribute-based policies and issues allow/deny decisions. When a user attempts to reach an application through IAP, the proxy queries the PDP to determine authorization. The PDP examines:

• User identity and group membership
• Device posture and compliance status
• Contextual signals like geolocation and time
• Resource sensitivity classification This separation of decision-making from enforcement is fundamental to scalable zero-trust deployments.

Unlike traditional VPNs that authenticate once at session establishment, IAP implements ongoing re-authentication and re-authorization throughout the user's session. If a device's security posture degrades—such as disabling encryption or installing unauthorized software—access is immediately revoked. This eliminates the risk of session hijacking and ensures that compromised credentials alone cannot maintain persistent access. Continuous verification transforms authentication from a single gate into a persistent security signal.

IAP enriches access decisions with real-time contextual attributes beyond simple identity verification. Context signals evaluated include:

• Geolocation: Restrict access to specific countries or regions
• Device security posture: Require disk encryption, screen lock, or OS patch levels
• Network origin: Differentiate between corporate and public networks
• Time of day: Enforce access windows for sensitive applications
• Risk score: Integrate with UEBA systems to detect anomalous behavior This granularity enables adaptive authentication that tightens or relaxes requirements based on perceived risk.

Google's pioneering zero-trust implementation that inspired modern IAP architectures. BeyondCorp shifted access controls from the network perimeter to individual devices and users, enabling employees to work securely from untrusted networks without a VPN. Key components include:

• Device inventory service with continuous health monitoring
• Access control engine evaluating real-time trust levels
• Unprivileged network where all clients are treated as external IAP is the direct commercial evolution of BeyondCorp's access proxy, making this architecture accessible to enterprises.

A security framework that creates dynamically provisioned, one-to-one connections between users and resources. SDP makes infrastructure invisible to unauthorized parties by:

• Cloaking applications behind a controller that rejects all unauthenticated packets
• Single Packet Authorization (SPA) to establish trust before connection
• Dynamic firewall rules that open only for authenticated sessions IAP implements SDP principles at the application layer, ensuring that protected resources are invisible to network scanners and cannot be discovered by unauthorized users.