Method and system for user authentication offload in a transparent database load balancer
Roughly described, a database accelerator is installed in a network between database client and server systems. Connection requests from a client system are received and authenticated by the accelerator itself, which is pre-configured with user authentication information, by emulating the authentication process on behalf of the server. An authenticated connection from the accelerator to a database server is established only if and when needed. Involving the server for authentication can be avoided for example if the accelerator maintains a pool of such authenticated server connections for re-use as needed, and/or if the accelerator maintains a cache of query responses previously received and can respond to new queries from the cache. By installing the accelerator transparently in the network, no modification of software in either the client application or the database servers is required in order to add authentication offload functionality to an existing client/server database arrangement.
1. A database authentication method, for use by an accelerator in a network having a set of at least one client system each running an application which makes database queries via a network to a particular IP address and port combination, and a set of at least one database server each having access to at least a portion of a database, the method comprising the accelerator:
receiving, through a network port at the accelerator, a first client-side connection request made by a first one of the client systems and directed to the particular IP address and port combination, the first client-side connection request including a username for the database;
authenticating the first client-side connection request at a database authentication level, using first database level authentication credentials pre-configured accessibly to the accelerator, thereby establishing a first client-side authenticated connection to the accelerator;
using the first database level authentication credentials, forming a first server-side authenticated connection between the accelerator and a first one of the database servers;
receiving a first database query on the first client-side authenticated connection; and
forwarding the first database query toward one of the database servers on the first server-side authenticated connection.
2. A method according to claim 1 , wherein the step of forming a first server-side authenticated connection is performed in response to the step of receiving a first database query on the first client-side authenticated connection.
3. A method according to claim 1 , wherein the step of forming a first server-side authenticated connection is performed prior to the step of receiving a first database query on the first client-side authenticated connection.
4. A method according to claim 3 , wherein the step of forming a first server-side authenticated connection is performed prior to the step of receiving the first client-side connection request.
5. A method according to claim 1 , further comprising the step of the accelerator forwarding, on the first client-side authenticated connection, first response data received on the first server-side authenticated connection in response to the first database query.
6. A method according to claim 5 , further comprising the steps of the accelerator:
retaining the first server-side authenticated connection in a pool of server-side authenticated connections;
subsequently receiving a second database query on a client-side authenticated connection and forwarding the second database query on the first server-side authenticated connection.
7. A method according to claim 6 , wherein the client-side authenticated connection on which the second database query is received by the accelerator is different from the first client-side authenticated connection.
8. A method according to claim 5 , further comprising the steps of the accelerator:
storing the first response data in a cache accessible to the accelerator;
subsequently receiving a second database query on a client-side authenticated connection;
determining that the second database query matches the first database query; and
forwarding the first response data from the cache on the client-side authenticated connection on which the accelerator received the second database query.
9. A method according to claim 8 , wherein the client-side authenticated connection on which the second database query is received by the accelerator is different from the first client-side authenticated connection.
10. A method according to claim 1 , further comprising the steps of the accelerator:
retaining the first server-side authenticated connection in a pool of server-side authenticated connections; and
subsequently receiving a second database query on a second client-side authenticated connection and forwarding the second database query on the first server-side authenticated connection,
wherein the second client-side authenticated connection is different from the first client-side authenticated connection.
11. A method according to claim 1 , wherein the database has a name, and wherein first client-side connection request further includes the database name.
12. A database accelerator, for use in a network having a set of at least one client system each running an application which makes database queries via a network to a particular IP address and port combination, and a set of at least one database server each having access to at least a portion of a database, the database accelerator comprising:
a memory; and
a data processor coupled to the memory, the data processor configured to:
receive, through a network port at the accelerator, a first client-side connection request made by a first one of the client systems and directed to the particular IP address and port combination, the first client-side connection request including a username for the database;
authenticate the first client-side connection request at a database authentication level, using first database level authentication credentials pre-configured accessibly to the accelerator, thereby establishing a first client-side authenticated connection to the accelerator;
using the first database level authentication credentials, form a first server-side authenticated connection between the accelerator and a first one of the database servers;
receive a first database query on the first client-side authenticated connection; and
forward the first database query toward one of the database servers on the first server-side authenticated connection.
13. An accelerator according to claim 12 , wherein the the data processor configured to form the first server-side authenticated connection in response to the receiving of the first database query on the first client-side authenticated connection.
14. An accelerator according to claim 12 , wherein the the data processor configured to form the first server-side authenticated connection prior to the receiving of the first database query on the first client-side authenticated connection.
15. An accelerator according to claim 14 , wherein the the data processor configured to form the first server-side authenticated connection prior to the receiving of the first client-side connection request.
16. An accelerator according to claim 12 , wherein the data processor is configured further to forward, on the first client-side authenticated connection, first response data received on the first server-side authenticated connection in response to the first database query.
17. An accelerator according to claim 16 , wherein the data processor is configured further to:
retain the first server-side authenticated connection in a pool of server-side authenticated connections; and
for a subsequently received second database query on a client-side authenticated connection, forward the second database query on the first server-side authenticated connection.
18. An accelerator according to claim 17 , wherein the client-side authenticated connection on which the second database query is received by the accelerator is different from the first client-side authenticated connection.
19. An accelerator according to claim 16 , wherein the data processor is configured further to:
store the first response data in a cache accessible to the accelerator;
for a subsequently received second database query on a client-side authenticated connection, determine that the second database query matches the first database query; and
forward the first response data from the cache on the client-side authenticated connection on which the accelerator received the second database query.
20. An accelerator according to claim 19 , wherein the client-side authenticated connection on which the second database query is received by the accelerator is different from the first client-side authenticated connection.
21. An accelerator according to claim 12 , wherein the data processor configured to:
retain the first server-side authenticated connection in a pool of server-side authenticated connections; and
forward on the first server-side authenticated connection a second database query received on a second client-side authenticated connection,
wherein the second client-side authenticated connection is different from the first client-side authenticated connection.
22. An accelerator according to claim 12 , wherein the database has a name, and wherein first client-side connection request further includes the database name.