user identity secure network 160 includes an identity server 570 identity server 570 includes access session record 164 of access session 162 during which user 120 accesses application session 182 security gateway 150 queries identity server 570 security gateway 150 sends host identity 134 and application session time 186 to identity server 570 identity server 570 receives host identity 134 and application session time 186 identity server 570 matches host identity 134 and application session time 186 against access session record 164 identity server 570 determines that host identity 134 matches host identity of access session record 164 identity server 570 further determines that application session time 186 matches access session time 166 of access session record 164 as application session time 186 is between the starting time and the ending time of access session record 164 identity server 570 sends private user identity 124 of access session record 164 to security gateway 150 as a response to the query security gateway 150 receives private user identity 124 from identity server 570 and stores private user identity 124 in application session record 184 in one embodiment security gateway 150 stores public user identity 127 in application session record 184 after recognizing a log on approval indication for the public user identity 127 from public application 180 in one embodiment security gateway 150 queries identity server 570 immediately after determining public user identity 127 in one embodiment security gateway 150 queries identity server 570 after application session 182 ends in one embodiment security gateway 150 queries identity server 570 by sending a plurality of host identities in a bulk request and receives a plurality of private user identities in a bulk response in one embodiment application session record 184 includes.