1. A method for applying a security policy to an application session, comprising: determining, by a security gateway, a first user identity and a second user identity from a data packet for an application session; obtaining, by the security gateway, a security policy for the application session based on the first user identity or the second user identity; and applying the security policy to the application session by the security gateway.