Apparatus system and method for real-time migration of data related to authentication

• US 20070083917A1
• Filed: 10/07/2005
• Published: 04/12/2007
• Est. Priority Date: 10/07/2005
• Status: Abandoned Application

• Current Assignee: Quest Software, Inc.
• Original Assignee: Quest Software, Inc.
• Inventors: Peterson, Matthew, Shaw, Jackson
• Application Number:
  US11/246,496
• Publication Number:
  US 20070083917A1
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

The present invention facilitates deploying a new authentication protocol in an established application environment. In one embodiment, an authentication credential is intercepted by a migration module that determines whether data associated with the specified account needs to be migrated from an established server to a target authentication server. A binding module may redirect authentication credentials intended for the established server to the migration module. In one embodiment, new user accounts may be added on the target authentication server, if specified by configuration options. Data associated with user accounts such as titles, telephone numbers, addresses, or the like may be migrated from the established server to the target server with the authentication data.

Claims

1. An apparatus for real-time migration of data related to authentication, the apparatus:

comprising;

a migration module configured to receive an authentication credential and submit the authentication credential to a first and a second authentication server;

a binding module configured to redirect an authentication credential intended for the first authentication server to the migration module; and

the migration module further configured to automatically migrate data corresponding to the authentication credential from the first authentication server to the second authentication server.

2. The apparatus of claim 1, wherein the authentication credential comprises a user name and password.

3. The apparatus of claim 1, wherein the authentication credential comprises clear text.

4. The apparatus of claim 1, wherein the binding module is further configured to specify settings related to authentication for the first and second servers.

5. The apparatus of claim 1, wherein the binding module is further configured to specify settings related to creating or modifying user objects on the second server.

6. The apparatus of claim 1, wherein the binding module is further configured to specify settings related to assigning passwords on the second server.

7. The apparatus of claim 1, wherein the second server is an Active Directory server.

8. The apparatus of claim 1, wherein data related to authentication is encrypted.

9. The apparatus of claim 8, wherein the data related to authentication is encrypted using Kerberos.

10. A method for real-time migration of data related to authentication, the method comprising:

redirecting authentication credentials intended for a first authentication server to a migration module;

receiving an authentication credential and submitting the authentication credential to the first authentication server and a second authentication server; and

migrating data corresponding to the authentication credential from the first authentication server to the second authentication server.

11. The method of claim 10, further comprising authenticating the particular user on the second server previous to migrating data related to authentication.

12. The method of claim 10, wherein migrating authentication data comprises failing to authenticate the user on the second server prior to migrating authentication data from the first server.

13. The method of claim 10, wherein redirecting authentication credentials comprises intercepting remote procedure calls intended for the first authentication server.

14. The method of claim 10, wherein redirecting authentication credentials comprises referencing the local authentication process in a binding module.

15. The method of claim 10, wherein receiving a redirected authentication credential comprises receiving parameters via an authentication protocol used on the first authentication server.

16. The method of claim 10, wherein receiving a redirected authentication credential comprises receiving parameters from an application.

17. The method of claim 10, wherein receiving a redirected authentication credential comprises receiving parameters from a local application.

18. The method of claim 10, wherein migrating authentication data comprises creating a user on the second server corresponding to the particular user.

19. The method of claim 10, wherein migrating authentication data comprises changing a user password on the second server.

20. The method of claim 10, wherein migrating authentication data comprises creating or modifying data fields associated with a user object on the second server.

21. The method of claim 10, wherein migrating authentication data comprises creating user objects on the second server duplicating user objects on the first server.

22. The method of claim 20, wherein migrating authentication data further comprises assigning default passwords to user objects on the second server.

23. An apparatus for real-time migration of data related to authentication, the apparatus comprising:

means for redirecting authentication credentials intended for a first authentication server to a migration module;

means for receiving an authentication credential relating to a particular user with the migration module; and

means for migrating data corresponding to the authentication credential from the first authentication server to a second authentication server.

24. A system for real-time migration of data related to authentication, the system comprising:

a first server configured to authenticate users by receiving an authentication credential;

a second server configured to authenticate users by receiving an authentication credential;

a migration module configured to receive an authentication credential and submit the authentication credential to the first and second servers;

a binding module configured to redirect an authentication credential intended for the first authentication server to the migration module; and

the migration module further configured to automatically migrate data corresponding to the authentication credential from the first authentication server to the second authentication server.

25. The system of claim 24, further comprising an application configured to receive authentication credentials.

26. The system of claim 25, wherein the migration module is further configured to receive authentication credentials from the application.

27. The system of claim 25, wherein the application is configured to run on an application server.

28. The system of claim 27, wherein the application server is configured to host the migration module.

29. The system of claim 24, wherein the second server is an Active Directory server.

30. A computer readable medium comprising computer readable program code comprising operations for real-time migration of data related to authentication, the operations comprising:

receiving an authentication credential and submitting the authentication credential to a first and a second authentication server;

redirecting authentication credentials intended for the first authentication server to a migration module; and

migrating data corresponding to the authentication credential from the first authentication server to the second authentication server.

31. The computer readable medium of claim 30, wherein the operations further comprise authenticating the particular user on the second server previous to migrating data related to authentication.