METHOD AND SYSTEM FOR ENFORCING PASSWORD POLICY FOR AN EXTERNAL BIND OPERATION IN A DISTRIBUTED DIRECTORY

• US 20090019533A1
• Filed: 07/11/2007
• Published: 01/15/2009
• Est. Priority Date: 07/11/2007
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Williams, Gary Dale, Hazlewood, Kristin Marie, Feng, Daw
• Granted Patent: US 8,230,455 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The invention describes techniques for enforcing password policy within a distributed directory environment that includes one or more distributed directory servers and a proxy server that acts as an intermediate agent between a client and the distributed directory environment. In one aspect, the proxy server is enhanced to support the passing (from the backend server to the client) of password policy controls. In particular, controls returned from a backend server are parsed and cached (for re-use) for the life of a given client connection. According to another aspect, the proxy server ensures that all compare operations for a single user'"'"'s password are directed to the same backend server in the distributed directory environment. This insures that a user'"'"'s most current password is used, and that failed operation counts, resets and operational attributes are up-to-date. According to still another aspect, the proxy server enforces password policy on bind plug-ins and, in particular, through a pair of pre-bind and post-bind extended operations. In particular, pre-bind processing includes checking if an account is locked. Post-bind processing includes checking for expired passwords, grace logins and updating failed/successful bind counters.

Claims

1. A proxy server for use to facilitate password policy enforcement in a distributed directory that includes a set of directory servers, comprising:

a processor;

a pre-operation bind plug-in for validating user credentials;

code executable in the processor and responsive to receipt of an external bind request from the pre-operation bind plug-in for initiating a call to a given directory server to perform a bind operation.

2. The proxy server as described in claim 1 wherein the external bind request is a pre-bind operation.

3. The proxy server as described in claim 2 wherein the pre-bind operation performs a check to determine whether a user'"'"'s account is locked.

4. The proxy server as described in claim 3 wherein the code executable in the processor is responsive to a response received from the given directory server for taking a given action.

5. The proxy server as described in claim 4 wherein the response indicates that the user'"'"'s account is not locked and the given action is providing the pre-operation bind plug-in a response to the external bind request, wherein the response to the external bind request indicates that an authentication should proceed.

6. The proxy server as described in claim 4 wherein the response indicates that the user'"'"'s account is locked and the given action is providing the pre-operation bind plug-in a response to the external bind request, wherein the response to the external bind request indicates that an authentication should not proceed.

7. The proxy server as described in claim 1 wherein the external bind request is a post-bind operation.

8. The proxy server as described in claim 7 wherein the post-bind operation performs a check to determine whether a password is expired.

9. The proxy server as described in claim 7 wherein the post-bind operation performs a check to determine whether a user'"'"'s password is expired and if any grace logins are remaining for the user.

10. The proxy server as described in claim 9 wherein the post-bind operation also updates a given access count associated with the user'"'"'s password.

11. The proxy server as described in claim 10 wherein the given access count is one of:

a success count, and a failure count

12. The proxy server as described in claim 7 wherein the code executable in the processor is responsive to a response received from the given directory server for taking a given action.

13. The proxy server as described in claim 12 wherein the response includes a return code and the given action is providing the pre-operation bind plug-in a response to the external bind request, wherein the response to the external bind request indicates that the external bind request succeeded.

14. The proxy server as described in claim 13 wherein the response to the external bind request is a password policy control.

15. The proxy server as described in claim 14 wherein the password policy control includes any error or warning provided by the given directory server.

16. A distributed directory, comprising:

a set of directory servers; and

a proxy server for enforcing at least one password policy, comprising;

a processor;

a bind plug-in for validating a user'"'"'s credentials;

code executable in the processor and responsive to receipt of an external bind request from the bind plug-in for initiating a call to a given directory server to perform a bind operation.

17. The distributed directory as described in claim 16 wherein the external bind request is one of:

a pre-bind operation, and a post-bind operation.

18. The distributed directory as described in claim 17 wherein the pre-bind operation performs a check to determine whether a user'"'"'s account is locked.

19. The distributed directory as described in claim 17 wherein the post-bind operation determines if a user'"'"'s password is expired and whether any grace logins remain associated with the user'"'"'s account.

20. The distributed directory as described in claim 17 wherein the code executable in the processor is responsive to receipt of a response from the given directory server for providing the given bind plug-in a response to the external bind request.

21. The distributed directory as described in claim 20 wherein the response to the external bind request is a password policy control.

22. The distributed directory as described in claim 21 wherein the password policy control includes any error or warning received from the given directory server.

23. The distributed directory as described in claim 16 wherein the distributed directory is an LDAP directory.

24. A method, operative at a proxy server, for enforcing password policy within a distributed directory that includes the proxy server and a set of directory servers, and wherein the proxy server supports at least one pre-operation bind plug-in, the method comprising:

in response to receipt from the pre-operation bind plug-in of an external bind request, calling a directory server to perform a bind operation;

routing the external bind request to the directory server;

receiving a response from the directory server; and

forwarding the response to the pre-operation bind plug-in.

25. The method as described in claim 24 wherein the bind operation is one of:

a pre-bind operation, and a post-bind operation.

26. The method as described in claim 24 wherein the pre-bind operation performs a check to determine whether a user'"'"'s account is locked.

27. The method as described in claim 24 wherein the post-bind operation determines if a user'"'"'s password is expired and whether any grace logins remain associated with the user'"'"'s account.

28. The method as described in claim 24 wherein the response from the directory server is a password policy control.

29. The method as described in claim 28 wherein the password policy control includes any error or warning received from the directory server.