Single Sign-On Method for Appliance Secure Shell

• US 20170099280A1
• Filed: 10/02/2015
• Published: 04/06/2017
• Est. Priority Date: 10/02/2015
• Status: Active Grant

• Current Assignee: Veritas Technologies, LLC (Whitehouse Group Ltd.)
• Original Assignee: Veritas Technologies, LLC (Whitehouse Group Ltd.)
• Inventors: Goel, Vikas, Koeten, Robert
• Granted Patent: US 9,923,888 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/025 for remote control or remote monitoring of applications
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
• CPC Class Codes: H04L 67/53 using third party service providers

Abstract

A system and method for efficiently establishing a secure shell connection for accessing Web resources. A user attempts to establish a secure Hypertext Transfer Protocol (HTTP) session between a client computing device and a remote storage device. The storage device redirects the Web browser of the client computing device to a single sign-on (SSO) third-party identity provider for authorizing the user. After successful authorization, the client computing device receives information to use to maintain a secure HTTP session. This information is stored on the storage device. The user attempts to establish a text-based secure shell session. The user is not prompted for login credentials. However, the user is authenticated using the previously stored information and a text-based secure shell session is established.

Claims

1. An authentication system comprising:

a third-party identity provider (IDP) configured to authenticate a plurality of users through a series of one or more Hypertext Transfer Protocol (HTTP) redirections;

a storage device hosting an application; and

a client device configured to;

send requests for establishing both a secure HTTP session and a secure shell (SSH) session with the storage device in order to access the application; and

send a given request to establish a SSH session, wherein the request comprises at least a first access token corresponding to a secure HTTP session previously established using the third-party IDP; and

wherein in response to receiving the given request, the storage device is configured to authorize the client device to establish the SSH session although the given request lacks a password, in further response to verifying the first access token corresponds to the previously established secure HTTP session.

2. The authentication system as recited in claim 1, wherein the storage device is further configured to send at least the first access token and a client device identifier (ID) to the client device responsive to receiving from the third-party IDP an indication of successful authentication for a given user of the plurality of users on the client device requesting to access the application through a secure HTTP session.

3. The authentication system as recited in claim 2, wherein the storage device is further configured to store each of the first access token and the client device ID to use for verifying subsequent accesses of the application from the client device via the secure HTTP session.

4. The authentication system as recited in claim 3, wherein the client device ID comprises one or more of a session cookie, an Internet Protocol (IP) address, and a media access control (MAC) address.

5. The authentication system as recited in claim 2, wherein the given request from the client device to establish the SSH session further comprises the client device ID.

6. The authentication system as recited in claim 3, wherein to authorize the client device to establish the SSH session, the storage device is further configured to determine whether at least the first access token and the client device ID in the request matches the stored first access token and the stored client device ID.

7. The authentication system as recited in claim 3, wherein to authorize the client device to establish the SSH session, the storage device is further configured to forego any HTTP redirections.

8. The authentication system as recited in claim 3, wherein to authorize the client device to establish the SSH session, the storage device is further configured to forego using the third-party IDP.

9. A method for executing on a processor, the method comprising:

authenticating with a third-party identity provider (IDP) a plurality of users through a series of one or more Hypertext Transfer Protocol (HTTP) redirections;

hosting an application on a storage device;

sending requests from a client device for establishing both a secure HTTP session and a secure shell (SSH) session with the storage device in order to access the application;

sending a given request from the client device to the storage device to establish a SSH session, wherein the given request comprises at least a first access token corresponding to a secure HTTP session previously established using the third-party IDP; and

authorizing the client device to establish the SSH session although the given request lacks a password, in response to verifying the first access token corresponds to the previously established secure HTTP session.

10. The method as recited in claim 9, further comprising sending at least the first access token and a client device identifier (ID) to the client device responsive to receiving from the third-party IDP an indication of successful authentication for a given user of the plurality of users on the client device requesting to access the application through a secure HTTP session.

11. The method as recited in claim 10, further comprising storing each of the first access token and the client device ID in the storage device to use for verifying subsequent accesses of the application from the client device via the secure HTTP session.

12. The method as recited in claim 11, wherein the client device ID comprises one or more of a session cookie, an Internet Protocol (IP) address, and a media access control (MAC) address.

13. The method as recited in claim 10, wherein the given request from the client device to establish the SSH session further comprises the client device ID.

14. The method as recited in claim 11, wherein to authorize the client device to establish the SSH session, the method further comprises determining whether at least the first access token and the client device ID in the request matches the stored first access token and the stored client device ID.

15. The method as recited in claim 11, wherein to authorize the client device to establish the SSH session, the method further comprises foregoing any HTTP redirections.

16. The method as recited in claim 11, wherein to authorize the client device to establish the SSH session, the method further comprises foregoing using the third-party IDP.

17. A storage device comprising:

a processor; and

a memory configured to;

store an application; and

store program instructions executable by the processor to;

send requests to a third-party identity provider (IDP) configured to authenticate a plurality of users through a series of one or more Hypertext Transfer Protocol (HTTP) redirections;

receive a given request from a client device to establish a secure shell (SSH) session, wherein the given request comprises at least a first access token corresponding to a secure HTTP session previously established for the client device using the third-party IDP; and

authorize the client device to establish the SSH session although the given request lacks a password, in further response to verifying the first access token corresponds to the previously established secure HTTP session.

18. The storage device as recited in claim 17, wherein the program instructions are further executable by the processor to send at least the first access token and a client device identifier (ID) to the client device responsive to receiving from the third-party IDP an indication of successful authentication for a given user of the plurality of users on the client device requesting to access the application through a secure HTTP session.

19. The storage device as recited in claim 18, wherein the given request from the client device to establish the SSH session further comprises the client device ID.

20. The storage device as recited in claim 18, wherein to authorize the client device to establish the SSH session, the program instructions are further executable to determine whether at least the first access token and the client device ID in the request matches stored values of the first access token and the stored client device ID.