Hi, I will try to explain my problem (sorry for my English)
 
There is a way to make a pre-authentication (user/apps) for incoming rules
(Inbound NAT), like the captive portal for traffic IN--> OUT. 
What I mean is something like the Checkpoint FW1. If I want use (i.E) RDP
from outside I need to login via http, then the rule is "active" for a
certain period.
 
let me know
thanks 
 
Moreno