Apparatus system and method to provide authentication services to legacy applications

• US 20070143836A1
• Filed: 12/19/2005
• Published: 06/21/2007
• Est. Priority Date: 12/19/2005
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: Quest Software, Inc.
• Inventors: Peterson, Matthew, Bowers, John
• Granted Patent: US 7,904,949 B2
• Time in Patent Office: Days
• US Class Current: 726/10
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity

Abstract

Authentication credentials from legacy applications are translated to Kerberos authentication requests. Authentication credentials from the legacy application are directed to an authentication proxy module. The authentication proxy module acts as a credential translator for the application by receiving a set of credentials such as a user name and password, then managing the process of authenticating to a Kerberos server and obtaining services from one or more Kerberized applications, including Kerberos session encryption. A credential binding module associates a user corresponding to authentication credentials from a legacy authentication protocol with one or more Kerberos credentials. Anonymous authentication credentials may be translated to authentication requests for a network directory services object, such as a computer object or service object.

Claims

1. A system to provide authentication services to legacy applications, the system comprising:

a client configured to authenticate using a legacy authentication protocol;

an authentication proxy module configured to receive legacy authentication credentials corresponding to the legacy authentication protocol; and

the authentication proxy module further configured to authenticate the user corresponding to the legacy authentication credentials using the Kerberos authentication protocol.

2. The system of claim 1, further comprising a Kerberos server.

3. The system of claim 1, further comprising a credential binding module configured to associate the legacy authentication credential with a Kerberos credential.

4. The system of claim 3, wherein the authentication proxy module is further configured to use the Kerberos credential to authenticate users if the Kerberos server is temporarily unavailable.

5. The system of claim 4, wherein the authentication proxy module is further configured to use a previously-generated Kerberos credential to authenticate a user that has not previously authenticated, if the Kerberos server is temporarily unavailable.

6. The system of claim 1, wherein the authentication proxy module is further configured to eliminate anonymous binds by authenticating as a network directory services object as a proxy for an anonymous user.

7. The system of claim 1, wherein the legacy authentication credentials comprise a user name and password.

8. The system of claim 1, wherein the legacy authentication credentials comprise a biometric.

9. The system of claim 1, wherein the legacy authentication protocol is selected from the group consisting of RADIUS, TACACS, ftp, LDAP, SQL and ODBC.

10. The system of claim 1, further comprising an application server configured to provide a Kerberos-secured service.

11. An apparatus to provide authentication services to legacy applications, the apparatus comprising:

an authentication proxy module configured to receive legacy authentication credentials corresponding to a legacy authentication protocol; and

the authentication proxy module further configured to authenticate a user corresponding to the legacy authentication credentials using the Kerberos authentication protocol.

12. The apparatus of claim 11, further comprising a credential binding module configured to associate the legacy authentication credential with a Kerberos credential.

13. The apparatus of claim 12, wherein the authentication proxy module is further configured to use the Kerberos credential to authenticate users if Kerberos authentication services are temporarily unavailable.

14. The apparatus of claim 13, wherein the authentication proxy module is further configured to use a previously-generated Kerberos credential to authenticate a user that has not previously authenticated, if Kerberos authentication services are temporarily unavailable.

15. The apparatus of claim 11, wherein the authentication proxy module is further configured to eliminate anonymous binds by authenticating an anonymous user as a network directory services object.

16. The apparatus of claim 11, wherein the legacy authentication credentials comprise a user name and password.

17. The apparatus of claim 11, wherein the legacy authentication credentials comprise a biometric.

18. The apparatus of claim 11, wherein the legacy authentication protocol is selected from the group consisting of RADIUS, TACACS, ftp, LDAP, SQL and ODBC.

19. A method for providing authentication services to legacy applications, the method comprising:

directing legacy authentication credentials corresponding to a legacy authentication protocol to a local authentication process;

receiving the legacy authentication credentials with the local authentication process; and

authenticating a user corresponding to the legacy authentication credentials using the Kerberos authentication protocol in response to receiving the authentication credentials.

20. The method of claim 19, further comprising associating the legacy authentication credentials with a Kerberos credential.

21. The method of claim 20, further comprising using the Kerberos credential to authenticate users while Kerberos authentication services are temporarily unavailable.

22. The method of claim 19, further comprising eliminating anonymous binds by authenticating an anonymous user as a network directory services object.

23. A computer readable storage medium comprising computer readable program code configured to carry out a method to providing authentication services to legacy applications, the method comprising:

directing legacy authentication credentials corresponding to a legacy authentication protocol to a local authentication process;

receiving the legacy authentication credentials with the local authentication process; and

authenticating a user corresponding to the legacy authentication credentials using the Kerberos authentication protocol in response to receiving the authentication credentials.

24. The computer readable storage medium of claim 23, wherein the method further comprises using the Kerberos credential to authenticate users while Kerberos authentication services are temporarily unavailable.

25. The computer readable storage medium of claim 23, wherein the method further comprises eliminating anonymous binds by authenticating an anonymous user as a network directory services object.