Authentication offload in virtualized computing environments

1. A method for a host including virtualization software to perform authentication offload in a virtualized computing environment that includes the host and a destination server, wherein the method comprises:

detecting, by the virtualization software, a packet from a virtualized computing instance and destined for the destination server at a virtual network interface controller (VNIC) associated with the virtualized computing instance, wherein the virtualized computing instance is one of multiple virtualized computing instances supported by the host, and the virtualization software maintains a mapping between underlying hardware resources of the host and virtual resources allocated to the virtualized computing instance;

in response to determination that the detected packet is an authentication request generated by a client application supported by the virtualized computing instance,

obtaining, by the virtualization software from the virtualized computing instance, metadata associated with the client application for which authentication is requested, wherein the obtaining comprises

based on header data of the authentication request, requesting the metadata from a guest operating system (OS) associated with the virtualized computing instance, and

invoking a call supported by a guest enhancement toolkit installed on the guest OS, wherein the call identifies a source port number included in the authentication request, and the guest enhancement toolkit uses the source port number to identify the client application; and

sending, by the virtualization software the authentication request and the metadata to the destination server to cause the destination server to authenticate the client application based on the metadata; and

in response to determination that the detected packet is not the authentication request, sending the detected packet to the destination server.

2. The method of claim 1 , wherein obtaining the metadata comprises:

receiving, from the guest enhancement toolkit, the metadata that includes one or more of the following: a hash value associated with the client application and a digital signature associated with the client application.

3. The method of claim 1 , wherein detecting the packet comprises:

performing packet snooping at the virtual network interface controller (VNIC) associated with the virtualized computing instance.

4. The method of claim 1 , wherein the method further comprises:

establishing a trust channel between an authentication agent supported by the host and the destination server, wherein the trust channel is subsequently used by the authentication agent to send the authentication request and the metadata to the destination server.

5. The method of claim 1 , wherein the method further comprises:

in response to receiving, from the destination server, an authentication token indicating that the authentication request is successful, sending the authentication token to the virtualized computing instance for subsequent communication between the client application and a server application supported by the destination server.

6. A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a processor of a host, cause the host including virtualization software to perform an authentication offload in a virtualized computing environment that includes the host and a destination server, comprising:

detecting, by the virtualization software, a packet from a virtualized computing instance and destined for the destination server at a virtual network interface controller (VNIC) associated with the virtualized computing instance, wherein the virtualized computing instance is one of multiple virtualized computing instances supported by the host, and the virtualization software maintains a mapping between underlying hardware resources of the host and virtual resources allocated to the virtualized computing instance;

in response to determination that the detected packet is an authentication request generated by a client application supported by the virtualized computing instance,

obtaining, by the virtualization software from the virtualized computing instance, metadata associated with the client application for which authentication is requested, wherein the obtaining comprises

based on header data of the authentication request, requesting the metadata from a guest operating system (OS) associated with the virtualized computing instance, and

invoking a call supported by a guest enhancement toolkit installed on the guest OS, wherein the call identifies a source port number included in the authentication request, and the guest enhancement toolkit uses the source port number to identify the client application; and

sending, by the virtualization software, the authentication request and the metadata to the destination server to cause the destination server to authenticate the client application based on the metadata; and

in response to determination that the detected packet is not the authentication request, sending the detected packet to the destination server.

7. The non-transitory computer-readable storage medium of claim 6 , wherein obtaining the metadata comprises:

receiving, from the guest enhancement toolkit, the metadata that includes one or more of the following: a hash value associated with the client application and a digital signature associated with the client application.

8. The non-transitory computer-readable storage medium of claim 6 , wherein detecting the packet comprises:

performing packet snooping at the virtual network interface controller (VNIC) associated with the virtualized computing instance.

9. The non-transitory computer-readable storage medium of claim 6 , including additional instructions which, in response to execution by the processor of the host, cause the host to perform:

establishing a trust channel between an authentication agent supported by the host and the destination server, wherein the trust channel is subsequently used by the authentication agent to send the authentication request and the metadata to the destination server.

10. The non-transitory computer-readable storage medium of claim 6 , including additional instructions which, in response to execution by the processor of the host, cause the host to perform:

in response to receiving, from the destination server, an authentication token indicating that the authentication request is successful, sending the authentication token to the virtualized computing instance for subsequent communication between the client application and a server application supported by the destination server.

11. A host including virtualization software configured to perform authentication offload in a virtualized computing environment that includes the host and a destination server, wherein the host comprises:

a processor; and

a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to:

detect, by the virtualization software, a packet from a virtualized computing instance and destined for the destination server at a virtual network interface controller (VNIC) associated with the virtualized computing instance, wherein the virtualized computing instance is one of multiple virtualized computing instances supported by the host, and the virtualization software maintains a mapping between underlying hardware resources of the host and virtual resources allocated to the virtualized computing instance;

in response to determination that the detected packet is an authentication request generated by a client application supported by the virtualized computing instance,

obtain, by the virtualization software from the virtualized computing instance, metadata associated with the client application for which authentication is requested, wherein the instructions for obtaining the metadata cause the processor to

based on header data of the authentication request, request the metadata from a guest operating system (OS) associated with the virtualized computing instance, and

invoke a call supported by a guest enhancement toolkit installed on the guest OS, wherein the call identifies a source port number included in the authentication request, and the guest enhancement toolkit uses the source port number to identify the client application; and

send, by the virtualization software the authentication request and the metadata to the destination server to cause the destination server to authenticate the client application based on the metadata; and

in response to determination that the detected packet is not the authentication request, sending the detected packet to the destination server.

12. The host of claim 11 , wherein the instructions for obtaining the metadata cause the processor to:

receive, from the guest enhancement toolkit, the metadata that includes one or more of the following: a hash value associated with the client application and a digital signature associated with the client application.

13. The host of claim 11 , wherein the instructions for detecting the packet cause the processor to:

perform packet snooping at the virtual network interface controller (VNIC) associated with the virtualized computing instance.

14. The host of claim 11 , wherein the instructions further cause the processor to:

establish a trust channel between an authentication agent supported by the host and the destination server, wherein the trust channel is subsequently used by the authentication agent to send the authentication request and the metadata to the destination server.

15. The host of claim 11 , wherein the instructions further cause the processor to:

in response to receiving, from the destination server, an authentication token indicating that the authentication request is successful, send the authentication token to the virtualized computing instance for subsequent communication between the client application and a server application supported by the destination server.