trasa

You are correct. The solution presented is not a BeyondCorp but rather an SSO implementation that adds authentication to the internal application. For BeyondCorp, it essentially: * Must be Layer 7 protocol, access privilege aware (achieved by an identity-aware access proxy). * Promotes authorization as opposed to authentication only. * Should be able to enforce security policies (time, location, context, 2fa). * Must be aware of the security state of the user device. Shameless plug: Check out our zero trust service access project TRASA (https://github.com/seknox/trasa). It's free and opensource and addresses many of the requirements outlined by BeyondCorp.

Since you mentioned you're a contributor to a similar project, I invite you to check our recently released zero trust service access control solution: https://github.com/seknox/trasa It's a BeyondCorp like a user identity and layer 7 aware access proxy for RDP, SSH, Web, and Database protocols with privileged access management, native two-factor auth agents, and device trust policies. Disclaimer: I am a core maintainer of this project.