Distributed authentication
A method can include receiving a request from a requestor to a given resource, which requestor is registered to access a set of one or more resources. The request includes a ticket that includes signature data generated by an authenticating entity in response to authenticating the requestor. The signature data may be decrypted to provide a decrypted signature. The ticket may be validated in response to the request based on evaluating the decrypted signature. A response can be provided to the requestor based on the validation, and the response can grant the requestor access to the given resource if the validation determines the ticket to be authentic and authorized for the given resource or the response can deny the requestor access to the given resource if the validation determines to reject the ticket.
1. A system comprising:
a cloud-based authenticator programmed to:
receive an authentication request from a requestor, the authentication request specifying credentials for the requestor,
authenticate the requestor based on the credentials for the requestor, and
provide a response to the requestor, the response comprising a ticket redeemable for accessing resources operating in a hybrid system, the ticket including payload data and a signature encrypted based on a private key generated by the authenticator, and
a ticket evaluator associated with a given resource of the resources, the ticket evaluator being programmed to:
select a public key for the authenticator based on a key identifier specified in the payload data of the ticket,
decrypt the signature of the ticket by applying the public key to the ticket to provide a decrypted signature,
validate the ticket provided in a request from the requestor to access the given resource according to validation parameters stored in the payload data, and
grant the requestor access to the given resource in response to validating the ticket.
2. The system of claim 1 , wherein the resources comprise at least one premise-based resource and at least one cloud-based resource.
3. The system of claim 1 , wherein the ticket evaluator is at least partially cloud-based.
4. The system of claim 1 , wherein the cloud-based authenticator further comprises:
an authenticator API to receive the authentication request from the requestor, the authentication request including the credentials of the requestor;
a credential evaluator to evaluate the credentials of the requestor to determine if the requestor is authorized to operate in the hybrid system; and
a ticket generator to generate the ticket in response to the credential evaluator determining that the requestor is authorized to operate in the hybrid system.
5. The system of claim 4 , wherein the ticket generator employs key data to identify the public key for the ticket, wherein the identity of the public key is provided in the payload data.
6. The system of claim 1 , wherein the ticket is a transparent ticket that does not allow the resources access to sensitive data on a premise system.
7. The system of claim 1 , further comprising another ticket evaluator associated with another resource of the resources, wherein the other ticket evaluator is programmed to receive from the requestor another request to access the other resource, the other request comprising the ticket, the other ticket evaluator to grant or deny the requestor access to the other resource based on validating the ticket by the other resource in response to the other request.
8. The system of claim 7 , wherein the other resource comprises a bootstrapper service and the other request comprises a location request for a location of the given resource, the bootstrapper service providing the location of the given resource in a response to the requestor in response to the other ticket evaluator determining that the validating the ticket to grant the requestor access to the bootstrapper service, the requestor providing the request to the location of the given resource that is provided in the response from the bootstrapper service.
9. A method comprising,
receiving, at a cloud-based authenticator, an authentication request from a requestor, the authentication request specifying credentials for the requestor,
authenticating, at the cloud-based authenticator, the requestor based on the credentials for the requestor, and
providing, at the cloud-based authenticator, a response to the requestor, the response comprising a ticket redeemable for accessing resources operating in a hybrid system, the ticket including payload data and a signature encrypted based on a private key generated by the authenticator,
wherein the ticket is used to authenticate the requestor for access to one or more resources operating in the hybrid system, and
wherein the resources operating in the hybrid system comprise both premise-based resources and cloud-based resources.
10. The method of claim 9 , wherein the ticket is a transparent ticket that does not allow the resources access to sensitive data on a premise system.
11. A method comprising:
receiving, at a cloud-based authenticator, an authentication request from a requestor, the authentication request specifying credentials for the requestor;
authenticating, at the cloud-based authenticator, the requestor based on the credentials for the requestor;
providing, at the cloud-based authenticator, a response to the requestor, the response comprising a ticket redeemable for accessing resources operating in a hybrid system, the ticket including payload data and a signature encrypted based on a private key generated by the authenticator,
wherein the ticket is used to authenticate the requestor for access to one or more resources operating in the hybrid system;
receiving, by a ticket evaluator associated with a given resource of the resources, a request for the requestor to access the given resource, wherein the request comprises the ticket;
validating, by the ticket evaluator, the ticket based on parameters stored in payload data of the ticket,
wherein the parameters stored in the payload data comprise a key identifier that is used to select a public key to match with the public key of the ticket; and
granting, by the ticket evaluator, the requestor access to the given resource in response to validating the ticket.
12. The method of claim 11 , wherein the validating further comprises:
selecting, by the ticket evaluator, the public key based on the key identifier, and
decrypting, by the ticket evaluator, the signature by applying the public key to the ticket.
13. The method of claim 11 , wherein the ticket evaluator is at least partially cloud-based.
14. A method comprising
receiving, at a cloud-based authenticator, an authentication request from a requestor, the authentication request specifying credentials for the requestor;
authenticating, at the cloud-based authenticator, the requestor based on the credentials for the requestor;
providing, at the cloud-based authenticator, a response to the requestor, the response comprising a ticket redeemable for accessing resources operating in a hybrid system, the ticket including payload data and a signature encrypted based on a private key generated by the authenticator,
wherein the ticket is used to authenticate the requestor for access to one or more resources operating in the hybrid system;
receiving, by a ticket evaluator associated with a given resource of the resources, a request for the requestor to access the given resource, wherein the request comprises the ticket;
receiving, by another ticket evaluator associated with another resource of the resources, a request for the requestor to access the other resource, wherein the request comprises the ticket; and
granting, by the other ticket evaluator, the requestor access to the other resource in response to validating the ticket,
wherein the other resource comprises a bootstrapper service and the other request comprises a location request for a location of the given resource, the bootstrapper service providing the location of the given resource in a response to the requestor in response to the other ticket evaluator determining that the validating the ticket to grant the requestor access to the bootstrapper service.
15. The method of claim 14 , wherein the requestor providing the request to the location of the given resource that is provided in the response from the bootstrapper service.
16. The method of claim 14 , wherein the resources operating in the hybrid system comprise at least one premise-based resource and at least one cloud-based resource.