Directory authentication method for policy driven web filtering
View Patent ↗Enabling web filtering by authenticated group membership, role, or user identity is provided by embedding a uniform resource identifier into an electronic document requested by a client. A client browser will provide directory credentials to a trusted web filter apparatus enabling a policy controlled access to resources external to the trusted network. An apparatus comprises circuits for transmitting a uniform resource identifier to a client, receiving a request comprising authentication credentials, querying a policy database and determining a customized policy for access to an externally sourced electronic document or application. A computer-implemented technique to simplify web filter administrator tasks by removing a need to set each browsers settings or install additional software on each user terminal.
1. A method for operation of a policy controlled web filter on an authenticated user of a client workstation in a trusted network comprising:
receiving at the policy controlled web filter an electronic document, from a target site external to the trusted network, which was requested by the client workstation within the trusted network;
determining an authenticated group, role, and identity of a user requesting said electronic document by exchanging directory access credentials between said client and a policy database server;
categorizing the content of the electronic document;
determining according to a policy database server, based on the directory access credentials of the authenticated user and the categorized content of the electronic document;
if the authenticated user is not authorized, providing a block message into a document frame so as to withhold the requested document; and
if the authenticated user is authorized, fulfilling the request by providing the requested electronic document into the document frame;
wherein, determining an authenticated group, role, and identity of a user has three steps,
firstly, injecting by the policy controlled web filter a pixel into the document frame for obtaining the requested electronic document;
secondly, transmitting said document frame to the requesting client wherein the pixel comprises a uniform resource identifier (uri) to a resource at a policy database server in the trusted network known to a directory access service,
thirdly, exchanging among said client and said policy database server, directory access credentials as a result of the client requesting the resource at the policy database server, whereby policy based access to web documents are controlled according to user identity.