Authentication cache and authentication on demand in a distributed network environment

• US 7,707,416 B2
• Filed: 02/07/2008
• Issued: 04/27/2010
• Est. Priority Date: 02/01/2002
• Status: Expired due to Term

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Crabb, Lynn Wells, Fritch, Daniel Gene, Nyland, James Duane Jr., Isaacson, Scott Alan, Henderson, Larry Hal
• Primary Examiner(s): Henning; Matthew T
• Application Number:
  US12/027,953
• Publication Number:
  US 20080133914A1
• Time in Patent Office: 810 Days
• Field of Search: 713167-168, 380/255, 380/259
• US Class Current: 713/168
• CPC Class Codes: G06F 21/31 User authentication

Abstract

A computer receives a request for authentication from a client. The computer forwards the authentication request to an authentication source. Once the authentication source has validated the authentication request, the computer requests authentication and cache control information from the authentication source. The computer uses the authentication and cache control information to populate a user object stored in a container hierarchy and enable the computer to authenticate an authentication request without forwarding the authentication request to the authentication source.

Claims

1. An apparatus to store authentication information, comprising:

a first computer storing a first container hierarchy and a second container hierarchy, the first container hierarchy including at least a first container and a second container, the second container stored in the first container, and the second container hierarchy including at least a third container and a fourth container, the third container stored in the fourth container;

a user object creator to create a user object in one of the first container and the second container in the first container hierarchy using an administration policy to set access rights associated with the user object;

an authentication source separate from the first computer for authenticating a first authentication request;

a receiver/transmitter to receive the first authentication request from a second computer separate from the first computer and to forward the first authentication request to the authentication source;

a user object updater for updating the user object with authentication information including a user name and at least one of an encrypted password and an unencrypted password;

a permanent user object updater operative to store the user object in the second container hierarchy if the authentication source validates the first authentication request; and

an authenticator to compare subsequent authentication requests to the authentication information in the user object in the second container hierarchy.

2. An apparatus according to claim 1, wherein:

the authentication source includes an encryption module for encrypting the authentication information for transmission to the first computer; and

the first computer includes a decryption module for decrypting the encrypted authentication information.

3. An apparatus according to claim 1, further comprising means for deleting the user object in the first container hierarchy after the user object is stored in the second container hierarchy.

4. An apparatus according to claim 1, wherein the receiver/transmitter is operative to receive group membership information for the user object from the authentication source, the group membership information specifying in which of the third container and the fourth container the user object is to be stored.

5. An apparatus according to claim 1, wherein the receiver/transmitter is operative to query the authentication source for the authentication information and wherein the authentication information includes the user name and the unencrypted password.

6. An apparatus according to claim 1, wherein the receiver/transmitter is operative to query the authentication source for cache control information and wherein the cache control information includes an order policy specifying how subsequent authentications are to be performed.

7. An apparatus according to claim 1, wherein the receiver/transmitter is operative to query the authentication source for cache control information and wherein the cache control information includes a password change policy.

8. An apparatus according to claim 1, wherein the user object updater is configured to update the user object with authentication information including the user name and the encrypted password and wherein the username and the encrypted password are received from the second computer.

9. An apparatus according to claim 1, wherein the user object creator is configured to create the user object using the administration policy to set access rights associated with the user object independent of access rights of a corresponding user object in the authentication source.

10. A method for caching authentication information, comprising:

receiving a first authentication request at a computer, the authentication request including authentication information comprising a username and an encrypted password;

storing the authentication information in a temporary user object in the computer;

storing the temporary user object in one of a first container and a second container, the first container residing in the second container in a first container hierarchy on the computer;

authenticating the first authentication request using an authentication source separate from the computer; and

if the first authentication request is successful;

storing a permanent user object in one of a third container and a fourth container, the third container residing in the fourth container in a second container hierarchy on the computer;

querying the authentication source for an unencrypted password corresponding to the username;

updating the permanent user object with the unencrypted password; and

authenticating subsequent authentication requests using at least one of the encrypted password and the unencrypted password.

11. A method according to claim 10, wherein authenticating the first authentication request includes:

forwarding the first authentication request to the authentication source;

receiving a challenge from the authentication source;

forwarding the challenge to a client associated with the first authentication request;

receiving a credential from the client;

forwarding the credential to the authentication source;

receiving a response from the authentication source;

storing the credential in the permanent user object for authenticating the subsequent authentication requests; and

forwarding the response to the client.

12. A method according to claim 10, further comprising deleting the temporary user object in the first container hierarchy after storing the permanent user object in the second container hierarchy.

13. A method according to claim 10, further comprising, if the first authentication request is successful:

querying the authentication source for cache control information; and

storing the cache control information in a cache, the cache control information including an order policy specifying how subsequent authentications are to be performed.

14. A method according to claim 10, further comprising, if the first authentication request is successful:

querying the authentication source for cache control information; and

storing the cache control information in a cache, the cache control information including a password change policy.

15. One or more computer-readable media containing a program to store authentication information for a user, comprising:

software to receive a first authentication request at a computer, the authentication request including authentication information comprising a username and an encrypted password;

software to store the authentication information in a temporary user object in the computer;

software to store a temporary user object in one of a first container and a second container, the first container residing in the second container in a first container hierarchy;

software to authenticate the first authentication request using an authentication source separate from the computer; and

software to store a permanent user object in one of a third container and a fourth container, the third container residing in the fourth container in a second container hierarchy, if the first authentication request is successful and to;

query the authentication source for an unencrypted password corresponding to the username;

update the permanent user object with the unencrypted password; and

authenticate subsequent authentication requests using at least one of the encrypted password and the unencrypted password.

16. One or more computer-readable media containing a program according to claim 15, further comprising software to delete the temporary user object in the first container hierarchy after the permanent user object is stored in the second container hierarchy.

17. One or more computer-readable media containing a program according to claim 15, further comprising software to query the authentication source for cache control information and store the cache control information in a cache, the cache control information including an order policy specifying how subsequent authentications are to be performed.

18. One or more computer-readable media containing a program according to claim 15, further comprising software to query the authentication source for cache control information and store the cache control information in a cache, the cache control information including a password change policy.

19. A system comprising:

a first computer;

a first container hierarchy stored in the first computer, the first container hierarchy including a first container and a second container, the second container stored in the first container;

a second container hierarchy stored in the first computer, the second container hierarchy including a third container and a fourth container;

a temporary user object stored in one of the first container and the second container;

a second computer in communication with the first computer for generating an authentication request, the authentication request including a user name and an encrypted password;

means in the first computer for placing the authentication information in the temporary user object;

an authentication source separate from the first computer and the second computer, in communication with the first computer for responding to the authentication request from the second computer; and

means in the first computer for placing the authentication information in a permanent user object in a second container hierarchy on the computer, if the authentication source successfully validates the authentication request and to;

query the authentication source for an unencrypted password corresponding to the username;

update the permanent user object with the unencrypted password; and

authenticate subsequent authentication requests using at least one of the encrypted password and the unencrypted password.

20. A system according to claim 19, further comprising means in the first computer for deleting the temporary user object in the first container hierarchy after the permanent user object is stored in the second container hierarchy.

21. A system according to claim 19, further comprising means in the first computer for querying the authentication source for cache control information and storing the cache control information in a cache, the cache control information including one or more of a classification level for the authentication information, an order policy, and a password change policy.

22. A method for caching authentication information for a user, comprising:

receiving a first authentication request at a computer from a client, the first authentication request including authentication information comprising a username and an encrypted password;

populating a temporary user object stored in the computer with the authentication information for the user, the temporary user object stored in one of a first container and a second container, the first container stored in the second container in a first container hierarchy;

forwarding the first authentication request to an authentication source separate from the computer;

receiving a response at the computer from the authentication source; and

if the response from the authentication source indicates that the first authentication request succeeded;

populating a permanent user object with the authentication information, wherein the authentication information includes a user name and a password;

storing the permanent user object in one of a third container and a fourth container, the third container stored in the fourth container in a second container hierarchy;

returning to the client a code validating the first authentication request

querying the authentication source for an unencrypted password corresponding to the username;

updating the permanent user object with the unencrypted password; and

authenticating subsequent authentication requests using at least one of the encrypted password and the unencrypted password.

23. A method according to claim 22, further comprising, if the response from the authentication source indicates that the first authentication request failed, returning to the client a code failing the first authentication request.

24. A method according to claim 22, wherein if the response from the authentication source indicates that the first authentication request succeeded, further comprising deleting the temporary user object in the first container hierarchy.

25. A method according to claim 22, wherein if the response from the authentication source indicates that the first authentication request succeeded, further comprising querying the authentication source for cache control information and storing the cache control information in a cache, the cache control information including one or more of a classification level for the authentication information, an order policy, and a password change policy.