Web client authentication and authorization
Systems, methods, and apparatus for authenticating and authorizing clients. A client certificate is used to authenticate and authorize a client (or user). When the client certificate is received, the certificate is authenticated. If the certificate is valid, a username included in the certificate is used to authorize the client. This may be done based on privileges or permissions associated with the user name. Once the client or user is authenticated and authorized, operations requested by the client can be performed as long as permitted by the privileges or permissions.
1. A method for accessing a data protection system, the method comprising:
receiving a request from a client, wherein the request includes a client certificate;
authenticating the client based on the client certificate;
extracting a username from the client certificate after the client is authenticated;
determining a role of the client based on the username, wherein the role maps the username to permissions associated with the data protection system that determine how the client uses the data protection system;
determining whether the client is authorized to perform an operation in the data protection system based on the mapping of the username to the permissions;
performing the operation based on the role of the client and on the permissions associated with the role of the client when the client is authorized; and
managing the client's access to perform operations in the data protection system by changing the role of the client or a policy associated with the client certificate, and based on the changed role or the changed policy, an outdated authentication or authorization token is prevented from granting unauthorized access to the client.
2. The method of claim 1 , further comprising obtaining the client certificate from an object associated with the request.
3. The method of claim 1 , further comprising, authenticating the client based on the client certificate and a CA certificate.
4. The method of claim 1 , further comprising determining whether the username is a valid username in the data protection system.
5. The method of claim 1 , further comprising constructing an error message if the client certificate is not valid or if the client is not valid.
6. The method of claim 1 , further comprising obtaining the role based on the username, wherein the username is associated with the role and wherein the role defines privileges or the permissions of the client.
7. The method of claim 1 , further comprising determining whether the operation associated with the request is allowed by the role of the client.
8. The method of claim 1 , further comprising controlling certificate policies using a certificate revocation list.
9. The method of claim 1 , further comprising authorizing the operation in accordance with the role of the client and the permissions associations associated with the role.
10. The method of claim 1 , further comprising revoking the client certificate such that the client is neither authenticated nor authorized in the data protection system.
11. The method of claim 1 , wherein the client certificate is not valid when the client certificate does not include the username.
12. The method of claim 1 , further comprising controlling and maintaining the permissions and policies of the data protection system at least in part using a certificate revocation list.
13. The method of claim 12 , further comprising controlling an ability of the client to access data by changing the policy or the role of the client.
14. A non-transitory computer readable medium comprising computer executable instructions configured for execution by a processor to implement a method for accessing a data protection system, the method comprising:
receiving a request from a client, wherein the request includes a client certificate;
authenticating the client based on the client certificate;
extracting a username from the client certificate after the client is authenticated;
determining a role of the client based on the username extracted from the client certificate, wherein the role maps the username to permissions associated with the data protection system that determine how the client uses the data protection system;
determining whether the client is authorized to perform an operation in the data protection system based on the mapping of the username to the permissions;
performing the operation based on the role of the client and on the permissions associated with the role of the client when the client is authorized; and
managing the client's access to perform operations in the data protection system by changing the role of the client or a policy associated with the client certificate, and based on the changed role or the changed policy, an outdated authentication or authorization token is prevented from granting unauthorized access to the client.
15. The non-transitory computer readable medium of claim 14 , the method further comprising obtaining the client certificate from an object associated with the request and authenticating the client based on the client certificate and a CA certificate.
16. The non-transitory computer readable medium of claim 14 , further comprising determining whether the username is a valid username in the data protection system and constructing an error message if the client certificate is not valid or if the client is not valid.
17. The non-transitory computer readable medium of claim 14 , further comprising obtaining the role based on the username, wherein the username is associated with the role and wherein the role defines privileges or the permissions of the client and determining whether the operation associated with the request is allowed by the role of the client.
18. The non-transitory computer readable medium of claim 14 , further comprising:
controlling policies using a certificate revocation list;
authorizing the operation in accordance with the role of the client and the permissions associations associated with the role when the client certificate is not revoked; and
revoking the client certificate such that the client is neither authenticated nor authorized in the data protection system, wherein the client certificate is not valid when the client certificate does not include the username.
19. The non-transitory computer readable medium of claim 18 , further comprising:
controlling and maintaining the permissions and policies of the data protection system at least in part using the certificate revocation list; and
comprising controlling an ability of the client to access data by changing the policies or the role of the client.