I have a legacy non-commercial (in-house) application that is distributed over several workstations on a private VLAN. I have to make it conform to some cybersecurity standards, but can barely modify it. For most of the needs, I can add a WAF.

My problem is that this application does not manage user accounts. Is there some existing solution as a WAF module to cover this need?

  • 2
    You could use an authenticating reverse proxy in front of the application to control access to the application in general for authenticated users. More granular control to specific actions or resources inside the application might also be possible, but depend a lot on the inner workings of the specific application. Details depend on specific requirements, like standalone user management vs. integration into some existing IAM, granularity of access control, ... . Commented Apr 25 at 11:15
  • 1
    @SteffenUllrich But that proxy would need to be added to each client to connect to an authentication system that appears to not exist. It looks like an entire identity and authentication system needs to be bolted onto this binary or, as the OP suggests, somehow wedged into the WAF.
    – schroeder
    Commented Apr 25 at 14:45


You must log in to answer this question.

Browse other questions tagged .