Credential delegation using identity assertion

• US 7,765,585 B2
• Filed: 04/17/2008
• Issued: 07/27/2010
• Est. Priority Date: 10/31/2002
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Reddy, Ajay, Venkataramappa, Vishwanath, Chao, Ching-Yun, Chung, Hyen Vui
• Primary Examiner(s): Moorthy; Aravind K
• Application Number:
  US12/105,257
• Publication Number:
  US 20080196097A1
• Time in Patent Office: 831 Days
• Field of Search: 726/5, 726/1, 726/8, 726/12, 726/14, 713/153, 713/161, 713/179, 713/183, 717/102, 717/108, 717/118
• US Class Current: 726/5
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

Run-as credentials delegation using identity assertion is presented. A server receives a request from a client that includes the client'"'"'s user identifier and password. The server authenticates the client and stores the client'"'"'s user identifier without the corresponding password in a client credential storage area. The server determines if a run-as command is specified to communicate with a downstream server. If a run-as command is specified, the server retrieves a corresponding run-as identity which identifies whether a client credential type, a server credential type, or a specific identifier credential type should be used in the run-as command. The server retrieves an identified credential corresponding to the identified credential type, and sends the identified credential in an identity assertion token to a downstream server.

Claims

1. An information handling system comprising:

one or more processors;

a memory accessible by the processors;

one or more nonvolatile storage devices accessible by the processors;

a network security tool to handle network security, the network security tool including;

means for receiving, at a first server, a client request from a client, wherein the client request includes a user identifier and a password;

means for authenticating the client request using a security service, wherein the security service is different than the first server;

in response to authenticating the client request, means for sending an authentication token from the security service to the first server;

in response to receiving the authentication token at the first server, means for storing the user identifier without the password in a client credential located in one of the nonvolatile storage devices located at the first server, wherein the client credential corresponds to a client credential type;

after receiving the authentication token from the security service, means for determining that a run-as command is specified that allows the first server to send an identity assertion token to a downstream server using a different identity, wherein the different identity is based upon a credential type that is selected from the group consisting of the client credential type, a server credential type, and a specific identifier credential type;

in response to determining that the run-as command is specified, means for selecting, at the first server, one of the credential types;

means for determining whether an enterprise Java bean has been invoked;

in response to determining that the enterprise Java bean has been invoked, means for generating the identity assertion token using an identified credential which corresponds to the selected credential type; and

means for sending the identity assertion token from the first server directly to the downstream server.

2. The information handling system as described in claim 1 further comprising:

means for selecting the client credential as the identified credential.

3. The information handling system as described in claim 1 wherein the identity assertion token includes the identified credential and a server credential.

4. A computer program product stored on a computer readable medium, the computer readable medium containing instructions for execution by a computer, which, when executed by the computer, cause the computer to implement a method comprising:

receiving, at a first server, a client request from a client, wherein the client request includes a user identifier and a password;

authenticating the client request using a security service, wherein the security service is different than the first server;

in response to authenticating the client request, sending an authentication token from the security service to the first server;

in response to receiving the authentication token at the first server, storing the user identifier without the password in a client credential at the first server, wherein the client credential corresponds to a client credential type;

after receiving the authentication token from the security service, determining that a run-as command is specified that allows the first server to send an identity assertion token to a downstream server using a different identity, wherein the different identity is based upon a credential type that is selected from the group consisting of the client credential type, a server credential type, and a specific identifier credential type;

in response to determining that the run-as command is specified, selecting, at the first server, one of the credential types;

determining whether an enterprise Java bean has been invoked;

in response to determining that the enterprise Java bean has been invoked, generating the identity assertion token using an identified credential which corresponds to the selected credential type; and

sending the identity assertion token from the first server directly to the downstream server.

5. The computer program product as described in claim 4 wherein the method further comprises:

selecting the client credential as the identified credential.

6. The computer program product as described in claim 4 wherein the identity assertion token includes the identified credential and a server credential.