Apparatus, systems and methods to provide authentication services to a legacy application

• US RE45,327 E1
• Filed: 03/07/2013
• Issued: 01/06/2015
• Est. Priority Date: 12/19/2005
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: Dell Software, Inc. (Dell Technologies Inc.)
• Inventors: Bowers, John Joseph, Peterson, Matthew T
• Primary Examiner(s): LEWIS, LISA C
• Application Number:
  US13/789,529
• Time in Patent Office: 670 Days
• Field of Search: None
• US Class Current: 726/10
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity

Abstract

Authentication credentials from legacy applications are translated to Kerberos authentication requests. Authentication credentials from the legacy application are directed to an authentication proxy module. The authentication proxy module acts as a credential translator for the application by receiving a set of credentials such as a user name and password, then managing the process of authenticating to a Kerberos server and obtaining services from one or more Kerberized applications, including Kerberos session encryption. A credential binding module associates a user corresponding to authentication credentials from a legacy authentication protocol with one or more Kerberos credentials. Anonymous authentication credentials may be translated to authentication requests for a network directory services object, such as a computer object or service object.

Claims

1. A system to provide authentication services to legacy applications, the system comprising:

one or more legacy applications executing on an application server and configured to authenticate a user based on one or more user credentials received from a client using a legacy authentication protocol, wherein the one or more legacy applications are not configured to authenticate using a Kerberos authentication protocol;

an authentication proxy module executing on a computing device and configured to receive legacy authentication credentials from the one or more legacy applications corresponding to the legacy authentication protocol, wherein the legacy authentication credentials are associated with the one or more user credentials; and

a credential binding module in communication with the authentication proxy module and configured to associated the legacy authentication credentials with a cached Kerberos credential,

and wherein the authentication proxy module is further configured to;

(i) authenticate the user corresponding to the legacy authentication credentials using a Kerberos authentication protocol by invoking a Kerberos authentication request to a Kerberos server, and (ii) use the cached Kerberos credential received from the credential binding module to authenticate the user when the Kerberos server is temporarily unavailable.

2. The system of claim 1, A system to provide authentication services to legacy applications, the system comprising:

one or more legacy applications executing on an application server and configured to authenticate a user based on one or more user credentials received from a client, wherein the one or more legacy applications are not configured to authenticate using a Kerberos authentication protocol;

an authentication proxy module executing on a computing device and configured to receive legacy authentication credentials from the one or more legacy applications, wherein the legacy authentication credentials are associated with the one or more user credentials; and

a credential binding module in communication with the authentication proxy module and configured to associate the legacy authentication credentials with a cached Kerberos credential,

wherein the authentication proxy module is further configured to;

(i) authenticate the user corresponding to the legacy authentication credentials using a Kerberos authentication protocol by invoking a Kerberos authentication request to a Kerberos server, and (ii) use the cached Kerberos credential received from the credential binding module to authenticate the user when the Kerberos server is temporarily unavailable;

wherein the cached Kerberos credential comprises a previously-generated Kerberos credential, and wherein the authentication proxy module is further configured to use the previously-generated Kerberos credential to authenticate a user that has not previously been authenticated by the one or more legacy applications, when the Kerberos server is temporarily unavailable.

3. The system of claim 1, A system to provide authentication services to legacy applications, the system comprising:

one or more legacy applications executing on an application server and configured to authenticate a user based on one or more user credentials received from a client using a legacy authentication protocol, wherein the one or more legacy applications are not configured to authenticate using a Kerberos authentication protocol;

an authentication proxy module executing on a computing device and configured to receive legacy authentication credentials from the one or more legacy applications corresponding to the legacy authentication protocol, wherein the legacy authentication credentials are associated with the one or more user credentials; and

a credential binding module in communication with the authentication proxy module and configured to associate the legacy authentication credentials with a cached Kerberos credential,

wherein the authentication proxy module is further configured to;

(i) authenticate the user corresponding to the legacy authentication credentials using a Kerberos authentication protocol by invoking a Kerberos authentication request to a Kerberos server, and (ii) use the cached Kerberos credential received from the credential binding module to authenticate the user when the Kerberos server is temporarily unavailable;

and wherein the authentication proxy module is further configured to eliminate anonymous binds by authenticating as a network directory services object as a proxy for an anonymous user.

4. The system of claim 1, wherein the legacy authentication credentials comprise a user name and password.

5. The system of claim 1, A system to provide authentication services to legacy applications, the system comprising:

one or more legacy applications executing on an application server and configured to authenticate a user based on one or more user credentials received from a client using a legacy authentication protocol wherein the one or more legacy applications are not configured to authenticate using a Kerberos authentication protocol;

an authentication proxy module executing on a computing device and configured to receive legacy authentication credentials from the one or more legacy applications corresponding to the legacy authentication protocol, wherein the legacy authentication credentials are associated with the one or more user credentials; and

a credential binding module in communication with the authentication proxy module and configured to associate the legacy authentication credentials with a cached Kerberos credential,

wherein the authentication proxy module is further configured to;

(i) authenticate the user corresponding to the legacy authentication credentials using a Kerberos authentication protocol by invoking a Kerberos authentication request to a Kerberos server, and (ii) use the cached Kerberos credential received from the credential binding module to authenticate the user when the Kerberos server is temporarily unavailable;

and wherein the legacy authentication credentials comprise a biometric.

6. The system of claim 1, wherein the legacy authentication protocol is selected from the group consisting of RADIUS, TACACS, ftp, LDAP, SQL and ODBC.

7. The system of claim 1, wherein the application server comprises the computing device.

8. The system of claim 1, wherein the cached Kerberos credential comprises a Kerberos ticket.

9. The system of claim 1, wherein the authentication proxy module is further configured to determine availability of the Kerberos server.

10. An apparatus to provide authentication services to legacy applications, the apparatus comprising:

an authentication proxy module executing on a computing device and configured to receive from one or more legacy applications executing on an application server legacy authentication credentials corresponding to a legacy authentication protocol, wherein the one or more legacy applications are not configured to use a Kerberos authentication protocol to authenticate a user; and

a credential binding module in communication with the authentication proxy module and configured to associate the legacy authentication credentials with a Kerberos credential,

and wherein the authentication proxy module is further configured to;

(i) authenticate a user corresponding to the legacy authentication credentials using a Kerberos authentication protocol by invoking a Kerberos authentication request to a Kerberos server, and (ii) use the Kerberos credential received from the credential binding module to authenticate the user when the Kerberos server is temporarily unavailable.

11. The apparatus of claim 10, An apparatus to provide authentication services to legacy applications, the apparatus comprising:

one or more legacy applications executing on an application server and configured to authenticate a user based on one or more user credentials received from a client using a legacy authentication protocol, wherein the one or more legacy applications are not configured to authenticate using a Kerberos authentication protocol;

an authentication proxy module executing on a computing device and configured to receive legacy authentication credentials from the one or more legacy applications corresponding to the legacy authentication protocol, wherein the legacy authentication credentials are associated with the one or more user credentials; and

a credential binding module in communication with the authentication proxy module and configured to associate the legacy authentication credentials with a cached Kerberos credential,

wherein the authentication proxy module is further configured to;

(i) authenticate the user corresponding to the legacy authentication credentials using a Kerberos authentication protocol by invoking a Kerberos authentication request to a Kerberos server, and (ii) use the cached Kerberos credential received from the credential binding module to authenticate the user when the Kerberos server is temporarily unavailable;

wherein the Kerberos credential comprises a previously-generated Kerberos credential, and wherein the authentication proxy module is further configured to use the previously-generated Kerberos credential to authenticate a user that has not previously been authenticated by the one or more legacy applications, when Kerberos authentication services are temporarily unavailable.

12. The apparatus of claim 10, An apparatus to provide authentication services to legacy applications, the apparatus comprising:

one or more legacy applications executing on an application server and configured to authenticate a user based on one or more user credentials received from a client using a legacy authentication protocol, wherein the one or more legacy applications are not configured to authenticate using a Kerberos authentication protocol;

an authentication proxy module executing on a computing device and configured to receive legacy authentication credentials from the one or more legacy applications corresponding to the legacy authentication protocol, wherein the legacy authentication credentials are associated with the one or more user credentials; and

a credential binding module in communication with the authentication proxy module and configured to associate the legacy authentication credentials with a cached Kerberos credential,

wherein the authentication proxy module is further configured to;

(i) authenticate the user corresponding to the legacy authentication credentials using a Kerberos authentication protocol by invoking a Kerberos authentication request to a Kerberos server, and (ii) use the cached Kerberos credential received from the credential binding module to authenticate the user when the Kerberos server is temporarily unavailable;

and wherein the authentication proxy module is further configured to eliminate anonymous binds by authenticating an anonymous user as a network directory services object.

13. The apparatus of claim 10, wherein the legacy authentication credentials comprise a user name and password.

14. The apparatus of claim 10, An apparatus to provide authentication services to legacy applications, the apparatus comprising:

one or more legacy applications executing on an application server and configured to authenticate a user based on one or more user credentials received from a client using a legacy authentication protocol, wherein the one or more legacy applications are not configured to authenticate using a Kerberos authentication protocol;

an authentication proxy module executing on a computing device and configured to receive legacy authentication credentials from the one or more legacy applications corresponding to the legacy authentication protocol, wherein the legacy authentication credentials are associated with the one or more user credentials; and

a credential binding module in communication with the authentication proxy module and configured to associate the legacy authentication credentials with a cached Kerberos credential,

wherein the authentication proxy module is further configured to;

(i) authenticate the user corresponding to the legacy authentication credentials using a Kerberos authentication protocol by invoking a Kerberos authentication request to a Kerberos server, and (ii) use the cached Kerberos credential received from the credential binding module to authenticate the user when the Kerberos server is temporarily unavailable;

and wherein the legacy authentication credentials comprise a biometric.

15. The apparatus of claim 10, wherein the legacy authentication protocol is selected from the group consisting of RADIUS, TACACS, ftp, LDAP, SQL and ODBC.

16. A method of providing authentication services to legacy applications, the method comprising:

directing from one or more legacy applications executing on an application server legacy authentication credentials corresponding to a legacy authentication protocol to a local authentication process executing on a computing device, wherein the one or more legacy applications are not configured to use a Kerberos authentication protocol to authenticate a user;

receiving the legacy authentication credentials with the local authentication process;

associating with a binding module the legacy authentication credentials with a Kerberos credential; and

with the local authorization process;

(i) when a Kerberos server coupled to the computing device is available, authenticating a user corresponding to the legacy authentication credentials using a Kerberos authentication protocol in response to receiving the authentication credentials by invoking a Kerberos authentication request to the Kerberos server, and (ii) using the Kerberos credential received from the binding module to authenticate the user when the Kerberos server is unavailable.

17. The method of claim 16, further comprising A method of providing authentication services to legacy applications, the method comprising:

directing from one or more legacy applications executing on an application server legacy authentication credentials corresponding to a legacy authentication protocol to a local authentication process executing on a computing device, wherein the one or more legacy applications are not configured to use a Kerberos authentication protocol to authenticate a user;

receiving the legacy authentication credentials with the local authentication process;

associating with a binding module the legacy authentication credentials with a Kerberos credential;

with the local authorization process;

(i) when a Kerberos server coupled to the computing device is available, authenticating a user corresponding to the legacy authentication credentials using a Kerberos authentication protocol in response to receiving the authentication credentials by invoking a Kerberos authentication request to the Kerberos server, and (ii) using the Kerberos credential received from the binding module to authenticate the user when the Kerberos server is unavailable; and

eliminating anonymous binds by authenticating an anonymous user as a network directory services object.

18. The method of claim 16, wherein the Kerberos credential comprises a Kerberos identity.

19. The method of claim 16, wherein the Kerberos credential comprises a Kerberos ticket.

20. The method of claim 19, wherein using the Kerberos credential received from the binding module to authenticate the user comprises decrypting the Kerberos ticket using user-submitted credentials associated with the legacy authentication credentials.

21. The method of claim 20, further comprising A method of providing authentication services to legacy applications, the method comprising:

directing from one or more legacy applications executing on an application server legacy authentication credentials corresponding to a legacy authentication protocol to a local authentication process executing on a computing device, wherein the one or more legacy applications are not configured to use a Kerberos authentication protocol to authenticate a user;

receiving the legacy authentication credentials with the local authentication process;

associating with a binding module the legacy authentication credentials with a Kerberos credential that comprises a Kerberos ticket;

with the local authorization process;

(i) when a Kerberos server coupled to the computing device is available, authenticating a user corresponding to the legacy authentication credentials using a Kerberos authentication protocol in response to receiving the authentication credentials by invoking a Kerberos authentication request to the Kerberos server, and (ii) using the Kerberos credential received from the binding module to authenticate the user when the Kerberos server is unavailable; and

using the Kerberos ticket received from the binding module to authenticate the user following expiration of the Kerberos ticket, wherein using the Kerberos credential received from the binding module to authenticate the user comprises decrypting the Kerberos ticket using user-submitted credentials associated with the legacy authentication credentials.

22. The method of claim 16, further comprising determining with the local authorization process when the Kerberos server is unavailable.

23. A computer readable storage medium comprising computer readable program code configured to execute on a processor to carry out a method to providing authentication services to legacy applications, the method comprising:

directing from one or more legacy applications on an application server legacy authentication credentials corresponding to a legacy authentication protocol to a local authentication process executing on a computing device, wherein the one or more legacy applications are not configured to use a Kerberos authentication protocol to authenticate a user;

receiving the legacy authentication credentials with the local authentication process;

associating with a binding module the legacy authentication credentials with a Kerberos credential; and

with the local authorization process;

(i) when a Kerberos server coupled to the computing device is available, authenticating a user corresponding to the legacy authentication credentials using a Kerberos authentication protocol in response to receiving the authentication credentials by invoking a Kerberos authentication request to the Kerberos server, and (ii) using the Kerberos credential received from the binding module to authenticate the user when the Kerberos server is unavailable.

24. The computer readable storage medium of claim 23, wherein the method further comprises A computer readable storage device comprising computer readable program code configured to execute on a processor to carry out a method to providing authentication services to legacy applications, the method comprising:

directing, from one or more legacy applications on an application server, legacy authentication credentials corresponding to a legacy authentication protocol, to a local authentication process executing on a computing device, wherein the one or more legacy applications are not configured to use a Kerberos authentication protocol to authenticate a user;

receiving the legacy authentication credentials with the local authentication process;

associating with a binding module the legacy authentication credentials with a Kerberos credential;

with the local authorization process;

(i) when a Kerberos server coupled to the computing device is available, authenticating a user corresponding to the legacy authentication credentials using a Kerberos authentication protocol in response to receiving the authentication credentials by invoking a Kerberos authentication request to the Kerberos server, and (ii) using the Kerberos credential received from the binding module to authenticate the user when the Kerberos server is unavailable; and

eliminating anonymous binds by authenticating an anonymous user as a network directory services object.

25. A system to provide authentication services to legacy applications, the system comprising:

an application server comprising computer hardware including at least one computer processor and executing one or more legacy applications configured to authenticate a user based on one or more user credentials received from a client using a legacy authentication protocol selected from the group consisting of RADIUS, TACACS, LDAP, SQL and ODBC, wherein the one or more legacy applications are not configured to authenticate using a Kerberos authentication protocol;

at least one computing device comprising computer hardware, including at least one computer processor, that;

executes an authentication proxy module stored in computer memory, thereby causing the computer hardware to receive legacy authentication credentials from the one or more legacy applications corresponding to the legacy authentication protocol, wherein the legacy authentication credentials are associated with the one or more user credentials; and

executes a credential binding module stored in computer memory and in communication with the authentication proxy module, thereby causing the computer hardware to associate the legacy authentication credentials with a cached Kerberos credential;

and wherein execution of the authentication proxy module further causes the computer hardware to;

(i) authenticate the user corresponding to the legacy authentication credentials using a Kerberos authentication protocol by invoking a Kerberos authentication request to a Kerberos server, and (ii) use the cached Kerberos credential received from the credential binding module to authenticate the user when the Kerberos server is temporarily unavailable.

26. The system of claim 25, wherein the legacy authentication protocol is RADIUS.

27. The system of claim 25, wherein the legacy authentication protocol is TACACS.

28. The system of claim 25, wherein the legacy authentication protocol is LDAP.

29. The system of claim 25, wherein the legacy authentication protocol is SQL.

30. The system of claim 25, wherein the legacy authentication protocol is ODBC.

31. An apparatus to provide authentication services to legacy applications, the apparatus comprising:

at least one computing device comprising computer hardware, including at least one computer processor, that;

executes an authentication proxy module stored in computer memory, thereby causing the computer hardware to receive, from one or more legacy applications executing on an application server, legacy authentication credentials corresponding to a legacy authentication protocol selected from the group consisting of RADIUS, TACACS, LDAP, SQL and ODBC, wherein the one or more legacy applications are not configured to use a Kerberos authentication protocol to authenticate a user; and

executes a credential binding module stored in computer memory and in communication with the authentication proxy module, thereby causing the computer hardware to associate the legacy authentication credentials with a Kerberos credential;

and wherein execution of the authentication proxy module by the computing device further causes the computer hardware to;

(i) authenticate a user corresponding to the legacy authentication credentials using a Kerberos authentication protocol by invoking a Kerberos authentication request to a Kerberos server, and (ii) use the Kerberos credential received from the credential binding module to authenticate the user when the Kerberos server is temporarily unavailable.

32. The apparatus of claim 31, wherein the legacy authentication protocol is RADIUS.

33. The apparatus of claim 31, wherein the legacy authentication protocol is TACACS.

34. The apparatus of claim 31, wherein the legacy authentication protocol is LDAP.

35. The apparatus of claim 31, wherein the legacy authentication protocol is SQL.

36. The apparatus of claim 31, wherein the legacy authentication protocol is ODBC.