Okta Access Gateway

Anyone deployed this solution? OAG seems to like a reverse proxy that does authentication proxy.

It is being marketed as a Zero Trust VPNless solution for internal applications. But it seems like it's making the internal application public facing and rely on authentication as security. Or maybe OAG is the only thing that is public facing and the user won't be able access application at all until OAG as authenticated the user.

True that the user no longer needs a VPN to access the internal app, but making an internal application public accessible and relaying on authentication seems wrong to me.

There are other solutions like Zscaler Private Access and Azure App Proxy that does something similar without making the application publicly accessible.

Thoughts?