Method and apparatus for transmitting additional authorization data via GSSAPI
View Patent ↗A system and method for using a GSSAPI security token to transport additional non-GSSAPI data that includes authorization data used by third-party software. The system includes a hook that intercepts a client process's interactions with the GSSAPI. When a client process requests a security context from the GSSAPI, the hook intercepts the security token the GSSAPI provides for the client process. The hook checks to see if there is additional authorization data to transport, adds the additional data to the security token, then gives the token to the client process. The client process sends the security token to the server process, which submits the token to the GSSAPI for evaluation. A hook on this computer intercepts the security token, removes additional data added earlier, gives the added authorization data to a version of the third-party authorization software, then passes the now-unaltered security token to the server process which uses the security token to finish establishing a security context with the client process.
1. A system for enabling a third party authorization process to provide extended authorization for a security context for a client-server connection for a first computer comprising:
a generic security service application program interface (GSSAPI) and a client process running on said first computer, said GSSAPI configured to create a security token for said client process to send to a second computer;
a module running on said first computer configured to intercept the security token created by said GSSAPI, accept non-operating-system authorization data from said third party authorization process to be added to said security token and return said security token with said added data to said client process;
said client process configured to request a security context using said security token with said added data from a server process running on a second computer, said second computer including a module configured to intercept said security token received from said first computer, remove any non-operating-system authorization data added to said security token by said first computer, pass said non-operating-system authorization data to a third party authorization process running on said second computer, and pass said security token without said non-operating-system authorization data to a GSSAPI running on said second computer, said server process configured to send said security token to said first computer after said GSSAPI running on said second computer has confirmed authentication and authorization for a security context based on said security token.
2. The system defined by claim 1 wherein said first computer is a Windows computer and said GSSAPI running on said first computer is a security support provider interface (SSPI) which includes a set of security protocol modules and is part of a Windows operating system Local Security Authority (LSA).
3. The system defined by claim 2 wherein the module configured to intercept the security token is part of an LSA module which receives the requests from the client process for said security context, and sends said requests to a security protocol module that returns said security context.
4. The system defined by claim 1 wherein the module running on the first computer configured to intercept the security token receives information from the third party authorization process running on the first computer, and a role-granting process of said third party authorization process running on the first computer informs the module when the third party authorization process running on the first computer has granted a user role authorization.
5. The system defined by claim 3 wherein said security protocol module creates said security context credentials by establishing said authentication and authorization with said Windows operating system.
6. A system for enabling a third party authorization process to provide extended authorization for use by a first computer through a security context established through a client-server connection comprising:
a generic security service application program interface (GSSAPI) and a server process running on a second computer, said GSSAPI configured to submit credentials from security tokens received by said server process from said first computer and confirm authentication and authorization for a security context based on said security token for said server process to send to said first computer;
a module running on said second computer configured to intercept a security token received from said first computer, remove any non-operating-system authorization data added to said security token by said first computer, pass said non-operating-system authorization data to a third party authorization process running on said second computer, and pass said security token without said non-operating-system authorization data to said GSSAPI;
said GSSAPI further configured to use said passed security token for authentication and authorization and confirm said authentication and authorization for said server process;
said authorization process running on said first computer configured to provide extended authorization for said security context based on said removed non-operating-system authorization data, said first computer including a generic security service application program interface (GSSAPI) and a client process, said GSSAPI running on said first computer configured to create a security token for said client process to send to said second computer, said first computer further including a module configured to intercept the security token created by said GSSAPI running on said first computer, accept non-operating-system authorization data from a third party authorization process running on said first computer to be added to said security token and return said security token with said added data to said client process.
7. A method for enabling a third party authorization process to provide extended authorization for a security context for a client-server connection for a first computer comprising:
requesting a security token for a server process running on a second computer via a generic security service application program interface (GSSAPI) running on said first computer, said GSSAPI creating a security token for a client process running on said first computer to send to said server process;
intercepting the security token created by said GSSAPI,
querying an authorization process running on said first computer for non-operating-system authorization data from said third party authorization process to be added to said security token
returning said security token with said added data to said client process;
requesting a security context using said security token with said added data from said server process running on said second computer.
8. A method for enabling a third party authorization process to provide extended authorization for use by a first computer through a security context established through a client-server connection comprising:
receiving by a server process running on a first computer a security context request including security tokens from said first computer;
said server process submitting said received security token for authentication and authorization;
intercepting said security token;
removing any non-operating-system authorization data added to said security token by said first computer;
passing said non-operating-system authorization data to an authorization process running on said second computer;
passing said security token without said non-operating-system authorization data to a generic security service application program interface (GSSAPI) running on said second computer;
said GSSAPI submitting said passed security token for authentication and authorization and confirming said authentication and authorization for said server process;
said third party authorization process providing extended authorization for said security context based on said removed non-operating-system authorization data.