ADOPTING POLICY OBJECTS FOR HOST-BASED ACCESS CONTROL

• US 20150172318A1
• Filed: 12/12/2013
• Published: 06/18/2015
• Est. Priority Date: 12/12/2013
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Elley, Yassir, Gallagher, Stephen
• Granted Patent: US 9,680,871 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A policy manager running on a client device receives policy data from a domain controller comprising a directory server and a file server. The client device runs an operating system that does not natively support policy retrieval from the directory server and file server. The policy manager identifies a policy type of the received policy data and identifies a policy processing plug-in associated with the identified policy type. The policy processing plug-in is connected to the operating system on the client device through a plug-in interface. The policy manager provides the received policy data to the identified policy processing plug-in for processing.

Claims

1. A method comprising:

receiving, at a client device, policy data from a domain controller comprising a directory server and a file server, the client device running an operating system that does not natively support policy retrieval from the directory server and file server;

identifying a policy type of the received policy data;

identifying, by a processing device, a policy processing plug-in associated with the identified policy type, wherein the policy processing plug-in is connected to the operating system on the client device through a plug-in interface; and

providing the received policy data to the identified policy processing plug-in for processing.

2. The method of claim 1, wherein the received policy comprises an access control policy for the client device.

3. The method of claim 2, further comprising:

receiving a request from a user to access the client device;

determining whether the user is authenticated;

if the user is authenticated, determining whether the user is authorized to access the client device using the plug-in; and

if the user is authorized to access the client device, granting the user access to the client device.

4. The method of claim 3, wherein determining whether the user is authorized further comprises:

sending a lightweight directory access protocol (LDAP) request to the directory server for a policy associated with the client device;

receiving metadata for the policy associated with the client device in response to the request; and

sending a file transfer request to the filer server in the domain controller for the policy data associated with the client device.

5. The method of claim 3, wherein determining whether the user is authorized further comprises:

determining, by the plug-in, whether the user satisfies a condition of the received access control policy; and

if the user satisfies the condition of the received access control policy, determining that the user is authorized.

6. The method of claim 1, further comprising:

caching, at the client device, the received policy data from the domain controller.

7. The method of claim 1, further comprising:

if no processing plug-in associated with the identified policy type is available through the plug-in interface, discarding the received policy data.

8. A system comprising:

a processing device; and

a memory coupled to the processing device; and

a policy manager, executable by the processing device from the memory, to;

receive, at a client device, policy data from a domain controller comprising a directory server and a file server, the client device running an operating system that does not natively support policy retrieval from the directory server and file server;

identify a policy type of the received policy data;

identify a policy processing plug-in associated with the identified policy type, wherein the policy processing plug-in is connected to the operating system on the client device through a plug-in interface; and

provide the received policy data to the identified policy processing plug-in for processing.

9. The system of claim 8, wherein the received policy comprises an access control policy for the client device.

10. The system of claim 9, wherein the policy manager further to:

receive a request from a user to access the client device;

determine whether the user is authenticated;

if the user is authenticated, determine whether the user is authorized to access the client device by processing the received policy data; and

if the user is authorized to access the client device, grant the user access to the client device.

11. The system of claim 10, wherein to determine whether the user is authorized, the policy manager further to:

send a lightweight directory access protocol (LDAP) request to the directory server for a policy associated with the client device;

receive metadata for the policy associated with the client device in response to the request; and

send a file transfer request to the file server in the domain controller for the policy data associated with the client device.

12. The system of claim 10, wherein to determine whether the user is authorized, the policy manager further to:

determine whether the user satisfies a condition of the received access control policy; and

if the user satisfies the condition of the received access control policy, determine that the user is authorized.

13. The system of claim 8, wherein the policy manager further to:

cache, at the client device, the received policy data from the domain controller.

14. The system of claim 8, wherein the policy manager further to:

if no processing plug-in associated with the identified policy type is available through the plug-in interface, discard the received policy data.

15. A non-transitory machine-readable storage medium storing instructions which, when executed, cause a processing device to perform operations comprising:

receiving, at a client device, policy data from a domain controller comprising a directory server and a file server, the client device running an operating system that does not natively support policy retrieval from the directory server and file server;

identifying a policy type of the received policy data;

identifying, by the processing device, a policy processing plug-in associated with the identified policy type, wherein the policy processing plug-in is connected to the operating system on the client device through a plug-in interface; and

providing the received policy data to the identified policy processing plug-in for processing.

16. The non-transitory machine-readable storage medium of claim 15, wherein the received policy comprises an access control policy for the client device.

17. The non-transitory machine-readable storage medium of claim 16, wherein the operations further comprise:

receiving a request from a user to access the client device;

determining whether the user is authenticated;

if the user is authenticated, determining whether the user is authorized to access the client device by processing the received policy data; and

if the user is authorized to access the client device, granting the user access to the client device.

18. The non-transitory machine-readable storage medium of claim 17, wherein determining whether the user is authorized further comprises:

sending a lightweight directory access protocol (LDAP) request to the directory server for a policy associated with the client device;

receiving metadata for the policy associated with the client device in response to the request; and

sending a file transfer request to the file server in the domain controller for the policy data associated with the client device.

19. The non-transitory machine-readable storage medium of claim 17, wherein determining whether the user is authorized further comprises:

determining whether the user satisfies a condition of the received access control policy; and

if the user satisfies the condition of the received access control policy, determining that the user is authorized.

20. The non-transitory machine-readable storage medium of claim 15, wherein the operations further comprise:

caching, at the client device, the received policy data from the domain controller.