Apparatus, systems and methods to provide authentication services to a legacy application
View Patent ↗Authentication credentials from legacy applications are translated to Kerberos authentication requests. Authentication credentials from the legacy application are directed to an authentication proxy module. The authentication proxy module acts as a credential translator for the application by receiving a set of credentials such as a user name and password, then managing the process of authenticating to a Kerberos server and obtaining services from one or more Kerberized applications, including Kerberos session encryption. A credential binding module associates a user corresponding to authentication credentials from a legacy authentication protocol with one or more Kerberos credentials. Anonymous authentication credentials may be translated to authentication requests for a network directory services object, such as a computer object or service object.
1. A system to provide authentication services to legacy applications, the system comprising:
one or more legacy applications executing on an application server and configured to authenticate a user based on one or more user credentials received from a client using a legacy authentication protocol, wherein the one or more legacy applications are not configured to authenticate using a Kerberos authentication protocol;
an authentication proxy module executing on a computing device and configured to receive legacy authentication credentials from the one or more legacy applications corresponding to the legacy authentication protocol, wherein the legacy authentication credentials are associated with the one or more user credentials; and
a credential binding module in communication with the authentication proxy module and configured to associate the legacy authentication credentials with a cached Kerberos credential,
and wherein the authentication proxy module is further configured to: (i) authenticate the user corresponding to the legacy authentication credentials using a Kerberos authentication protocol by invoking a Kerberos authentication request to a Kerberos server, and (ii) use the cached Kerberos credential received from the credential binding module to authenticate the user when the Kerberos server is temporarily unavailable.
2. The system of claim 1 , wherein the cached Kerberos credential comprises a previously-generated Kerberos credential, and wherein the authentication proxy module is further configured to use the previously-generated Kerberos credential to authenticate a user that has not previously been authenticated by the one or more legacy applications, when the Kerberos server is temporarily unavailable.
3. The system of claim 1 , wherein the authentication proxy module is further configured to eliminate anonymous binds by authenticating as a network directory services object as a proxy for an anonymous user.
4. The system of claim 1 , wherein the legacy authentication credentials comprise a user name and password.
5. The system of claim 1 , wherein the legacy authentication credentials comprise a biometric.
6. The system of claim 1 , wherein the legacy authentication protocol is selected from the group consisting of RADIUS, TACACS, ftp, LDAP, SQL and ODBC.
7. The system of claim 1 , wherein the application server comprises the computing device.
8. The system of claim 1 , wherein the cached Kerberos credential comprises a Kerberos ticket.
9. The system of claim 1 , wherein the authentication proxy module is further configured to determine availability of the Kerberos server.
10. An apparatus to provide authentication services to legacy applications, the apparatus comprising:
an authentication proxy module executing on a computing device and configured to receive from one or more legacy applications executing on an application server legacy authentication credentials corresponding to a legacy authentication protocol, wherein the one or more legacy applications are not configured to use a Kerberos authentication protocol to authenticate a user; and
a credential binding module in communication with the authentication proxy module and configured to associate the legacy authentication credentials with a Kerberos credential,
and wherein the authentication proxy module is further configured to: (i) authenticate a user corresponding to the legacy authentication credentials using a Kerberos authentication protocol by invoking a Kerberos authentication request to a Kerberos server, and (ii) use the Kerberos credential received from the credential binding module to authenticate the user when the Kerberos server is temporarily unavailable.
11. The apparatus of claim 10 , wherein the Kerberos credential comprises a previously-generated Kerberos credential, and wherein the authentication proxy module is further configured to use the previously-generated Kerberos credential to authenticate a user that has not previously been authenticated by the one or more legacy applications, when Kerberos authentication services are temporarily unavailable.
12. The apparatus of claim 10 , wherein the authentication proxy module is further configured to eliminate anonymous binds by authenticating an anonymous user as a network directory services object.
13. The apparatus of claim 10 , wherein the legacy authentication credentials comprise a user name and password.
14. The apparatus of claim 10 , wherein the legacy authentication credentials comprise a biometric.
15. The apparatus of claim 10 , wherein the legacy authentication protocol is selected from the group consisting of RADIUS, TACACS, ftp, LDAP, SQL and ODBC.
16. A method of providing authentication services to legacy applications, the method comprising:
directing from one or more legacy applications executing on an application server legacy authentication credentials corresponding to a legacy authentication protocol to a local authentication process executing on a computing device, wherein the one or more legacy applications are not configured to use a Kerberos authentication protocol to authenticate a user;
receiving the legacy authentication credentials with the local authentication process;
associating with a binding module the legacy authentication credentials with a Kerberos credential; and
with the local authorization process: (i) when a Kerberos server coupled to the computing device is available, authenticating a user corresponding to the legacy authentication credentials using a Kerberos authentication protocol in response to receiving the authentication credentials by invoking a Kerberos authentication request to the Kerberos server, and (ii) using the Kerberos credential received from the binding module to authenticate the user when the Kerberos server is unavailable.
17. The method of claim 16 , further comprising eliminating anonymous binds by authenticating an anonymous user as a network directory services object.
18. The method of claim 16 , wherein the Kerberos credential comprises a Kerberos identity.
19. The method of claim 16 , wherein the Kerberos credential comprises a Kerberos ticket.
20. The method of claim 19 , wherein using the Kerberos credential received from the binding module to authenticate the user comprises decrypting the Kerberos ticket using user-submitted credentials associated with the legacy authentication credentials.
21. The method of claim 20 , further comprising using the Kerberos ticket received from the binding module to authenticate the user following expiration of the Kerberos ticket.
22. The method of claim 16 , further comprising determining with the local authorization process when the Kerberos server is unavailable.
23. A computer readable storage medium comprising computer readable program code configured to execute on a processor to carry out a method to providing authentication services to legacy applications, the method comprising:
directing from one or more legacy applications on an application server legacy authentication credentials corresponding to a legacy authentication protocol to a local authentication process executing on a computing device, wherein the one or more legacy applications are not configured to use a Kerberos authentication protocol to authenticate a user;
receiving the legacy authentication credentials with the local authentication process;
associating with a binding module the legacy authentication credentials with a Kerberos credential; and
with the local authorization process: (i) when a Kerberos server coupled to the computing device is available, authenticating a user corresponding to the legacy authentication credentials using a Kerberos authentication protocol in response to receiving the authentication credentials by invoking a Kerberos authentication request to the Kerberos server, and (ii) using the Kerberos credential received from the binding module to authenticate the user when the Kerberos server is unavailable.
24. The computer readable storage medium of claim 23 , wherein the method further comprises eliminating anonymous binds by authenticating an anonymous user as a network directory services object.