System and method for authentication in a computing system
A system and method for efficiently accessing Web resources. A directory service and an authentication service may be used to determine whether a login session attempt on a deployed device is successful. At least one deployed device in a system receives credentials from a user during a login request and requests authorization using the received credentials for both a login session and for accessing Web resources. The device sends the authorization request to Web services on a server hosting the Web resources. The Web services interact with an authentication service to verify authentication for the user. The device receives an access token upon verification for authorization for the given user and securely stores it. When a client program executing on the device requests access to the Web resources, the device sends an access request with a copy of the stored access token to the server hosting the Web resources.
1. An authentication system comprising:
a storage device comprising a first set of resources; and
a web server comprising a second set of resources, wherein the first set of resources comprises at least one Web-based application which requests access to the second set of resources when executed;
wherein in response to receiving, from a user computing device, at the storage device a single request to establish a first session with the storage device with no request for access to the second set of resources by the user computing device, the request including credentials from a user, the storage device is configured to:
send a single authorization request with the credentials to the web server requesting a single authorization for establishing both the requested first session with the storage device and a second session with the web server despite there being no detection of a request for access to the second set of resources by the user computing device,
wherein the single authorization request is sent before the first session with the storage device is established to allow for the first set of resources to request access to the second set of resources;
verify, by the storage device, an existence of the user on the storage device prior to sending said authorization request to the web server;
send, by the web server, the credentials to an authentication service;
verify, by the authentication service, that the user is authorized to access resources of each of the storage device and the web server;
send, by the web server, said single authorization to the storage device allowing the user to establish both the first session and the second session, in response to receiving an indication that the user is authorized to access the first set of resources of the storage device and an indication that the user is authorized to access the second set of resources of the web server;
wherein said single authorization comprises a single session token;
receive the single authorization for the user to access both the first set of resources and the second set of resources; and
establish, using said received single authorization, without generating another authorization, both the second session with the web server and the first session with the storage device based on the single authorization request.
2. The authentication system as recited in claim 1 , wherein in response to receiving the session token, the storage device is further configured to store the session token for use by client programs on the storage device.
3. The authentication system as recited in claim 1 , wherein in response to receiving a request by a client program associated with the second session that requests access to web resources of the web server, the storage device is configured to send a corresponding request to the web server, wherein the corresponding request includes an indication of said single authorization.
4. A device comprising:
a processor;
a memory configured to store instructions of a pluggable authentication management (PAM) module; and
wherein in response to receiving, from a user computing device, a single request with credentials from a user to establish a single session with no request for access to the second set of resources by the user computing device, wherein the single session is a first session on the device comprising a first set of resources, the instructions of the PAM module are executable by the processor to:
send a single authorization request with the credentials to the web server requesting a single authorization for establishing both the requested first session with the device and a second session with a web server despite there being no detection of a request for access to the second set of resources by the user computing device,
wherein the single authorization request is sent before the first session with the device is established to allow for the first set of resources to request access to a second set of resources,
wherein the web server comprises the second set of resources, and wherein the first set of resources comprises at least one Web-based application which requests access to the second set of resources when executed;
verify, by the device, an existence of the user on the device prior to sending said authorization request to the web server;
receive, from the web server, said single authorization to the device allowing the user to establish both the first session and the second session, wherein said single authorization indicates the web server received an indication that the user is authorized to access the first set of resources of the device and an indication that the user is authorized to access the second set of resources of the web server;
wherein said single authorization comprises a single session token;
establish, using said received single authorization, without generating another authorization, both the second session with the web server and the first session with the storage device based on the single authorization request.
5. The device as recited in claim 4 , wherein the memory is further configured to store instructions of a name switch service (NSS) module, wherein the instructions of the NSS module are executable by the processor to send an identifier associated with the user to a directory service to verify an existence of the user on the device prior to sending said authorization request to the web server.
6. The device as recited in claim 4 , wherein in response to receiving the session token, the instructions of the PAM module are further executable by the processor to store the session token for use by client programs on the device.
7. The device as recited in claim 4 , wherein the memory is further configured to store instructions of an operating system, wherein in response to receiving a request by a client program associated with the second session that requests access to web resources of the web server, the instructions of the operating system are further executable by the processor to send a corresponding request to the web server, wherein the corresponding request includes an indication of said single authorization.
8. A method for executing on a processor, the method comprising:
wherein in response to receiving, from a user computing device, a single request with credentials from a user to establish a single session with no request for access to the second set of resources by the user computing device, wherein the single session is a first session on a storage device comprising a first set of resources:
sending a single authorization request with the credentials to a web server requesting a single authorization for establishing both the requested first session with the storage device and a second session with a web server despite there being no detection of a request for access to the second set of resources by the user computing device, wherein the single authorization request is sent before the first session with the storage device is established to allow for the first set of resources to request access to a second set of resources, wherein the web server comprises the second set of resources, and wherein the first set of resources comprises at least one Web-based application which requests access to the second set of resources when executed;
verifying, by the storage device, an existence of the user on the storage device prior to sending said authorization request to the web server;
receiving, from the web server, said single authorization to the storage device allowing the user to establish both the first session and the second session, wherein said single authorization indicates the web server received an indication that the user is authorized to access the first set of resources of the storage device and an indication that the user is authorized to access the second set of resources of the web server;
wherein said single authorization comprises a single session token;
establishing, using said received single authorization, without generating another authorization, both the second session with the web server and the first session with the storage device based on the single authorization request.
9. The method as recited in claim 8 , wherein in response to receiving the session token, the method further comprises storing the session token for use by client programs on the user computing device.
10. The method as recited in claim 8 , wherein in response to receiving a request by a client program associated with the second session that requests access to web resources of the web server, the method further comprises sending a corresponding request to the web server, wherein the corresponding request includes an indication of said single authorization.