Enhanced N-layer SSO controlled authentication for enterprise devices
A system, method, and computer-readable storage medium provide single sign-on (SSO) in a nested virtualization environment by routing authentication tokens received from an authentication server through the hierarchy of virtual machines (VMs) using secure data communications tunnels between each hypervisor and its respective VMs. A key store stores SSO authentication tokens for users of the nested VMs, and a key controller ensures that each login by a user to a separate VM is associated with its own token. Each login request is uniquely tagged to identify the particular VM requesting credentials, so that the responsive authentication token can be properly routed through the hierarchy. Moreover, session preferences may be associated with each user and/or each VM, enabling a rules evaluator to determine, for each login request, whether SSO functionality should be provided or whether the user should be required instead to provide new login credentials.
1. A system for providing single sign-on (SSO), using an authentication server, to a plurality of nested virtual machines executing on a host computer, the system comprising:
a preference database operable for storing preferences, of each of a plurality of users, for accessing the plurality of nested virtual machines;
a rules evaluator operable for (a) determining, in response to receiving a request from a virtual machine in the plurality of nested virtual machines to authenticate a user in the plurality of users, whether to provide SSO authentication according to preferences of the user stored in the preference database, and (b) when SSO authentication should not be provided, requiring the user to provide login credentials;
a key store operable for storing SSO authentication tokens for the plurality of users; and
a key controller operable, when SSO authentication should be provided, for:
determining whether the key store contains an SSO authentication token for the user according to a key identifying the virtual machine,
if the key store does not contain such a token, obtaining an SSO authentication token from the authentication server and storing the token in the key store using the key, and
transmitting the token to the virtual machine by routing the token through the plurality of nested virtual machines according to a destination that identifies the virtual machine, thereby authenticating the user to the virtual machine.
2. The system according to claim 1 , wherein the preference database stores preferences comprising one or more of: a number of concurrent virtual machines accessible by the user in a single session, and an idle session termination interval.
3. The system according to claim 1 , wherein the preference database stores preferences in association with one or more of the virtual machines in the plurality of nested virtual machines.
4. The system according to claim 1 , wherein the key controller is operable to index the key store using a key that identifies one or more of: the host computer, a level at which the virtual machine is nested in the plurality of nested virtual machines, a maximum number of concurrent sessions for the virtual machine, a maximum number of excess authentication attempts, and a user session count.
5. The system according to claim 1 , wherein obtaining the SSO authentication token from the authentication server comprises the key controller providing a domain key to the authentication server.
6. A method of providing single sign-on (SSO), using an authentication server, to a plurality of nested virtual machines executing on a host computer, the method comprising:
storing preferences, of each of a plurality of users, for accessing the plurality of nested virtual machines;
determining, in response to receiving a request from a virtual machine in the plurality of nested virtual machines to authenticate a user in the plurality of users, whether to provide SSO authentication according to stored preferences of the user;
when SSO authentication should not be provided, requiring the user to provide login credentials; and
when SSO authentication should be provided:
determining whether a key store contains an SSO authentication token for the user according to a key identifying the virtual machine,
if the key store does not contain such a token, obtaining an SSO authentication token from the authentication server and storing the token in the key store using the key, and
transmitting the token to the virtual machine by routing the token through the plurality of nested virtual machines according to a destination that identifies the virtual machine, thereby authenticating the user to the virtual machine.
7. The method according to claim 6 , wherein storing preferences comprises storing one or more of: a number of concurrent virtual machines accessible by the user in a single session, and an idle session termination interval.
8. The method according to claim 6 , wherein storing preferences comprises storing in association with one or more of the virtual machines in the plurality of nested virtual machines.
9. The method according to claim 6 , wherein the key store is indexed using a key that identifies one or more of: the host computer, a level at which the virtual machine is nested in the plurality of nested virtual machines, a maximum number of concurrent sessions for the virtual machine, a maximum number of excess authentication attempts, and a user session count.
10. The method according to claim 6 , wherein obtaining the SSO authentication token from the authentication server comprises providing a domain key to the authentication server.
11. The method according to claim 6 , further comprising analyzing keys in the key store for each user as an audit trail of authentication activities of the user within the plurality of nested virtual machines.
12. A tangible, computer-readable storage medium, in which is non-transitorily stored computer program code for performing a method of providing single sign-on (SSO), using an authentication server, to a plurality of nested virtual machines executing on a host computer, the method comprising:
storing preferences, of each of a plurality of users, for accessing the plurality of nested virtual machines;
determining, in response to receiving a request from a virtual machine in the plurality of nested virtual machines to authenticate a user in the plurality of users, whether to provide SSO authentication according to stored preferences of the user;
when SSO authentication should not be provided, requiring the user to provide login credentials; and
when SSO authentication should be provided:
determining whether a key store contains an SSO authentication token for the user according to a key identifying the virtual machine,
if the key store does not contain such a token, obtaining an SSO authentication token from the authentication server and storing the token in the key store using the key, and
transmitting the token to the virtual machine by routing the token through the plurality of nested virtual machines according to a destination that identifies the virtual machine, thereby authenticating the user to the virtual machine.
13. The storage medium according to claim 12 , wherein storing preferences comprises storing one or more of: a number of concurrent virtual machines accessible by the user in a single session, and an idle session termination interval.
14. The storage medium according to claim 12 , wherein storing preferences comprises storing in association with one or more of the virtual machines in the plurality of nested virtual machines.
15. The storage medium according to claim 12 , wherein the key store is indexed using a key that identifies one or more of: the host computer, a level at which the virtual machine is nested in the plurality of nested virtual machines, a maximum number of concurrent sessions for the virtual machine, a maximum number of excess authentication attempts, and a user session count.
16. The storage medium according to claim 12 , wherein obtaining the SSO authentication token from the authentication server comprises providing a domain key to the authentication server.
17. The storage medium according to claim 12 , further comprising analyzing keys in the key store for each user as an audit trail of authentication activities of the user within the plurality of nested virtual machines.