Interoperable credential gathering and access modularity

• US 7,577,659 B2
• Filed: 10/24/2003
• Issued: 08/18/2009
• Est. Priority Date: 10/24/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Richards, Stefan, Stephens, John, Ilac, Cristian, Reasor, Sterling M., Flo, Eric, Schutz, Klaus U., Perlin, Eric C., Hutz, Benjamin A.
• Primary Examiner(s): Corrielus; Jean M
• Assistant Examiner(s): COLAN, GIOVANNA B
• Application Number:
  US10/693,585
• Publication Number:
  US 20050091213A1
• Time in Patent Office: 2,125 Days
• Field of Search: 713/201, 713/202, 713/185, 713/183, 713/155, 713/167, 726/10, 726/14, 709/225, 455/437, 707/10
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: Y10S 707/99938 Concurrency, e.g. lock management in shared database
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

A credential is translated with one of different credential provider modules each translating a corresponding different type of credential into a common protocol. The translated credential is communicated through an API to a logon UI module to an operating system (OS) of a local machine. An OS logon module is called by the logon UI module to authenticate the translated credential against a credential database. A user identified by the translated credential is logged on to access the local machine when the authentication is successful. The credential can also be used with a selection received from the logon UI module via a corresponding one of different pre-log access provider (PLAP) modules that each communicate with the API. The API establishes a network session with an access service specified by the selected PLAP module when the credential is authenticated with the credential database.

Claims

1. A method executed on a single local machine having a processor executing computer-executable instructions stored in a memory, the method comprising:

initializing, by a native operating system (OS) on the local machine, a logon user interface (UI);

initializing, with the logon UI on the single local machine, a plurality of different coexisting credential provider modules, each for translating respectively different types of credentials into a common credential protocol, the common credential protocol being compatible with the native OS of the local machine, each said credential provider module logging a user on with the native OS on the local machine via the logon UI to access the local machine using one of a plurality of corresponding different input devices in communication with the local machine;

receiving a first said credential from the user at a first one of said input devices in communication with the local machine;

translating the first credential with a first one of said credential provider modules corresponding to the first input device that is in communication with the local machine;

communicating the translated first credential having the common credential protocol through a credential provider Application Program Interface (API) to the logon UI of the native OS, wherein the credential provider API is configured to interface with each of the plurality of different coexisting credential provider modules;

passing the translated first credential having the common credential protocol to an OS logon module of the native OS from the logon UI;

calling the OS logon module for the native OS to authenticate the translated credential having the common credential protocol against a credential database; and

logging the user on with the native OS to access the local machine when the authentication is successful.

2. The method as defined in claim 1, wherein the logging on of the user further comprises logging the user on to the local machine after one or more additional said credentials have been received, translated by a respective said different coexisting credential provider module, and authenticated successfully, in addition to said first credential.

3. The method as defined in claim 1, wherein the user is not logged on to the local machine at the time when the translated credentials are authenticated.

4. The method as defined in claim 1, wherein the use of the OS logon module of the native OS to authenticate the translated first credential having the common credential protocol against the credential database further comprises:

communicating the translated credential to an LSA; and

determining the authentication with the LSA against the credential database that is selected from the group consisting of;

a SAM database;

a local database other than the SAM database;

a remote credential database;

a token protocol credential service;

a challenge and response protocol service; and

an AD and KDC at a domain remote from the local machine.

5. The method as defined in claim 1, further comprising:

initializing one or more pre-logon access provider (PLAP) modules at the local machine coexisting with said credential provider modules, each PLAP module operating with the OS of the local machine, so that the user selects a logon connection type out of a plurality of available logon connection types for establishing a network connection; and

establishing, by a selected one of said one or more PLAP modules, a network connection from the local machine to a domain using the translated first credential.

6. A computer-readable medium comprising instructions that, when executed by a computer, perform the method of claim 1.

7. A method executed on a single local machine having a processor executing computer-executable instructions stored in a memory. the method comprising:

initializing, by a native operating system (OS) on the local machine, a logon user interface (UI);

initializing, with the logon UI on the single local machine, a plurality of different coexisting credential provider modules, each said credential provider module configured to perform a translation of a respectively different type of credential received at a different type of input device in communication with the local machine for translating the respectively different types of credentials into a common credential protocol, the common credential protocol being compatible with the native OS of the local machine, wherein each said credential provider module logs a user on with the native OS on the local machine via the logon UI to access the local machine using one of a plurality of corresponding different input devices communication with the local machine;

receiving a first credential from the user at a first one of said input devices in communication with the local machine;

translating the first credential with a first one of said credential provider modules that corresponds to the first input device;

communicating the translated first credential having the common credential protocol through a credential provider interface to the logon UI of the native OS, wherein the credential provider interface is configured to interface with each of the plurality of coexisting different said credential provider modules;

passing the translated first credential having the common credential protocol to a logon routine of the native OS from the logon UI;

authenticating the translated first credential against a credential database with the logon routine of the native OS; and

logging the user on to access the local machine with the native OS when the authentication is successful.

8. The method as defined in claim 7, wherein the logging on of the user to access the local machine with the native OS further comprises deferring the logging on of the user to access the local machined until the receiving, the translating, the communicating, the passing, and the authenticating successfully have been repeated for at least one more additional said credentials in addition to said first credential.

9. The method as defined in claim 7, wherein the user is not logged on to access the local machine until after the translated first credential is authenticated against the credential database with the logon routine of the native OS.

10. The method as defined in claim 7, wherein the authenticating of the translated first credential against the credential database with the logon routine of the native OS further comprises:

communicating the translated credential to an LSA from the logon routine of the native OS; and

determining the authentication with the LSA against the credential database that is selected from the group consisting of;

a SAM database;

a local database other than the SAM database;

a remote credential database;

a token protocol credential service;

a challenge and response protocol service; and

an AD and KDC at a domain remote from the local machine.

11. A computer-readable medium comprising instructions that, when executed by a computer, perform the method of claim 7.

12. A computer-readable medium comprising a plurality of different coexisting credential provider modules initialized with a logon user interface (UI) by a native operating system (OS) on a single local machine, each including instructions that, when executed by the local machine, receive and translate a credential into a common credential protocol so as to be compatible for authentication by an authentication component of the native OS against a credential database for logging a user identified by the credential on with the native OS to access the local machine when the authentication is successful, wherein:

the translated credential is received via a credential provider Application Programming Interface (API) of the authentication component of the native OS;

the credential provider API of the authentication component of the native OS is compatible for receiving each of a plurality of said credentials from a corresponding plurality of different coexisting credential provider modules; and

each said different coexisting credential provider module is configured to;

receive a respective different type of said credential from a respective input device, each respective input device coupling to the local machine, wherein the user selects one or more of the input devices for logging on with the native OS to access the local machine; and

translate each said different type of said credential into the credential protocol so as to be compatible for authentication by the authentication component of the native OS against the credential database.

13. The computer-readable medium as defined in claim 12, wherein the authentication component of the native OS comprises:

the logon UI;

an OS logon module for receiving Remote Procedure Call (RPC) calls from the logon UI module; and

an LSA for determining the authentication, and in communication with, the credential database that is selected from the group consisting of;

a SAM database;

a local database other than the SAM database;

a remote credential database;

a token protocol credential service;

a challenge and response protocol service; and

an AD and KDC at a domain remote from the local machine.

14. A method executed on a single local machine having a processor executing computer-executable instructions stored in a memory, the method comprising:

initializing, by a native operating system (OS) on the local machine, a logon user interface (UI);

initializing, with the logon UI on the single local machine, a plurality of different coexisting credential provider modules, each said credential provider module performing a translation of a respectively different type of credential received at one of a plurality of different types of input devices in communication with the local machine for translating the respectively different types of credentials into a common credential protocol, the common credential protocol being compatible with the native OS of the local machine, wherein each said credential provider module logs a user on with the native OS on the local machine via the logon UI to access the local machine using one of the plurality of corresponding different input devices in communication with the local machine;

receiving a first credential from the user at a first said input device in communication with the local machine;

receiving a second credential from the user at a second said input device in communication with the local machine;

translating the first credential into the common credential protocol using a first one of the credential provider modules corresponding to the first input device that is in communication with the local machine;

translating the second credential into the common credential protocol using a second one of the credential provider modules corresponding to the second input device that is in communication with the local machine;

using a component of the OS to authenticate the translated first credential and second credential having the common credential protocol against a credential database; and

logging the user on with the OS to access the local machine when the authentication of both the first credential and the second credential is successful.

15. A method executed on a single local machine having a processor executing computer-executable instructions stored in a memory. the method comprising:

initializing, by a native operating system (OS) on the local machine, a logon user interface (UI);

initializing with the logon UI on the single local machine a plurality of different coexisting credential provider modules, each for translating respectively different types of credentials into a common credential protocol, the common credential protocol being compatible with the native OS of the local machine, each said credential provider module logging a user on with the native OS on the local machine via the logon UI to access the local machine using one of a plurality of corresponding different input devices in communication with the local machine;

initializing one or more pre-logon access provider (PLAP) modules at the local machine coexisting with said credential provider modules, each PLAP module operating with the OS of the local machine so that the user selects a logon connection type out of a plurality of logon connection types for establishing a network connection;

receiving a first said credential from the user at a first one of said input devices in communication with the local machine;

translating the first credential with a first one of said credential provider modules corresponding to the first input device that is in communication with the local machine;

establishing, by a selected one of said PLAP modules, a network connection from the local machine to a domain using the translated first credential;

communicating the translated first credential having the common credential protocol through a credential provider interface to the logon UI of the native OS, wherein the credential provider interface is configured to interface with each of the plurality of coexisting different said credential provider modules;

passing the translated first credential having the common credential protocol to a logon routine of the native OS from the logon UI;

authenticating the translated first credential against a credential database with the logon routine of the native OS; and

logging the user on to access the local machine with the native OS when the authentication is successful.

16. A method executed on a single local machine having a processor executing computer-executable instructions stored in a memory, the method comprising:

initializing, by a native operating system (OS) on a local machine, a logon user interface (UI);

initializing, with the logon UI on the single local machine, a plurality of different coexisting credential provider modules, each said credential provider module configured to perform a translation of a respectively different type of credential received at a different type of input device in communication with the local machine for translating the respectively different types of credentials into a common credential protocol, the common credential protocol being compatible with the native OS of the local machine, wherein each said credential provider module logs a user on with the native OS on the local machine via the logon UI to access the local machine using one of a plurality of available corresponding different input devices in communication with the local machine;

choosing, by a user, one or more of said plurality of different types of input devices for logging on from among the plurality of available different input devices;

receiving a first credential from the user via a chosen first one of said input devices in communication with the local machine;

translating the first credential into the common credential protocol compatible with the native OS of the local machine with a first one of said credential provider modules that corresponds to the chosen first input device;

communicating the translated first credential having the common credential protocol through a credential provider interface to the logon UI of the native OS, wherein the credential provider interface is configured to interface with each of the plurality of coexisting different said credential provider modules;

passing the translated first credential having the common credential protocol to a logon routine of the native OS from the logon UI;

authenticating the translated first credential against a credential database with the logon routine of the native OS; and

logging the user on to access the local machine with the native OS when the authentication is successful.