System and method for a sidecar authentication mechanism
View Patent ↗A system and method for authenticating an unauthenticated file level protocol using a sidecar authentication mechanism. A client transmits an authentication ticket, UID and list of network addresses to an authentication daemon of a storage system. The authentication daemon verifies the user identity and generates a file system credential that is stored in a cache indexed by an authentication tuple. Received data access operations from a client are compared to authentication tuples by UID and network address and the file system utilizes the stored credential for processing the data access operation.
1. A method for authenticating a file level protocol, the method comprising:
receiving a data access request using the file level protocol;
utilizing an authentication tuple to locate a file system credential;
processing the received data access request utilizing the file system credential;
generating the file system credential in response to a user executing a command on a client to transmit an authentication ticket and first UID to an authentication daemon executing within a server, the authentication ticket and first UID being transmitted over a protocol differing from the file level protocol.
2. The method of claim 1 , further comprising:
implementing the command using a multipurpose protocol protected with a multi-purpose security protocol.
3. The method of claim 2 , further comprising:
using a hypertext transfer protocol (HTTP) as the multipurpose protocol.
4. The method of claim 2 , further comprising:
using a secure sockets layer (SSL) protocol as the multipurpose security protocol.
5. The method of claim 2 , further comprising:
using a transport layer security (TLS) protocol as the multipurpose security protocol.
6. The method of claim 2 , further comprising:
including a client side agent, the client side agent including a graphical user interface in the multipurpose protocol.
7. The method of claim 6 , further comprising:
displaying the graphical user interface in a world wide web browser.
8. The method of claim 2 , further comprising:
including a client side agent in the multipurpose protocol, the client side agent including a text based interface.
9. The method of claim 8 , further comprising:
displaying the text based interface in a world wide web browser.
10. The method of claim 2 , further comprising:
including a second user identifier (UID) and a password in the authentic ticket, the second UID and password being encrypted via the multipurpose security protocol.
11. The method of claim 1 , further comprising:
implementing the command within a command line interface.
12. The method of claim 1 , further comprising:
including a Kerberos ticket in the authentic ticket.
13. The method of claim 1 , further comprising:
associating a first user with the authentication ticket and associating the first UID with a second user.