User authorization for file level restoration from image level backups
Embodiments provide systems, methods, and computer program products for enabling user authorization to perform a file level recovery from an image level backup of a virtual machine without the need for access control by an administrator. Specifically, embodiments enable an access control mechanism for controlling access to stored image level backups of a virtual machine. In an embodiment, the virtual machine includes a backup application user interface that can be used to send a restoration request to a backup server. The restoration request can include a machine identifier and a user identifier of the user logged onto the virtual machine. The backup server includes a backup application that determines whether or not the machine identifier contained in the restoration request can be matched to a machine identifier of a virtual machine present in one of the virtual machine backups stored on the backup server.
1. A backup server, comprising:
a processor configured to execute a backup application; and
a storage configured to store a plurality of image level backups including a first image level backup of a machine located on a host system and a plurality of machine identifiers associated with the plurality of image level backups including a first machine identifier associated with the machine, and wherein the backup application, when executed by the processor, is configured to:
receive, from a user system, a restoration request from a backup application user interface executing on the machine, the restoration request including a requested machine identifier, wherein the restoration request is configured to request access to at least one image level backup;
determine a match between the requested machine identifier and the first machine identifier associated with the machine;
accept the restoration request based at least in part on the match between the requested machine identifier and the first machine identifier; and
transmit an acceptance response to the machine responsive to accepting the restoration request, wherein the acceptance response is configured to cause the backup application user interface to provide, to the user system, an interface for selecting an object for restoration from the at least one image level backup.
2. The backup server of claim 1 , wherein the backup application is further configured to deny the restoration request if the requested machine identifier does not match the first machine identifier.
3. The backup server of claim 1 , wherein the restoration request further includes a user identifier of a user currently logged onto the machine through the user system and wherein the backup application is further configured to:
determine whether the user identifier belongs to an access control group associated with the machine.
4. The backup server of claim 3 , wherein, responsive to determining that the user identifier does not belong to the access control group associated with the machine, the backup application is further configured to deny the restoration request.
5. The backup server of claim 3 , wherein the access control group is a local administrators group.
6. The backup server of claim 1 , wherein, responsive to determining the match between the requested machine identifier and the first machine identifier associated with the machine, the backup application is further configured to:
write a written authentication cookie to a location within a file system of the machine accessible to the user system initiating the restoration request.
7. The backup server of claim 6 , wherein the backup application is further configured to:
prompt the user system to provide the authentication cookie to the backup application;
deny the restoration request if no authentication cookie is received from the user system within a predetermined time interval; and
if the authentication cookie is received within the predetermined time interval from the user system;
accept the restoration request if the authentication cookie matches the written authentication cookie; and
deny the restoration request if the authentication cookie does not match the written authentication cookie.
8. The backup server of claim 6 , wherein the location within the file system of the machine is an administrator-only directory location on the machine.
9. The backup server of claim 6 , wherein the backup application utilizes an application programming interface provided by a hypervisor executing on the host system to write the written authentication cookie to the location within the file system.
10. A computer-implemented method, comprising:
storing a plurality of image level backups including a first image level backup of a machine located on a host system and a plurality of machine identifiers associated with the plurality of image level backups including a first machine identifier associated with the machine;
receiving, from a user system, a restoration request from a backup application user interface provided by a backup application executing on the machine, the restoration request including a requested machine identifier, wherein the restoration request is configured to request access to at least one image level backup;
determining a match between the requested machine identifier and the first machine identifier associated with the machine;
accepting the restoration request based at least in part on the match between the requested machine identifier and the first machine identifier; and
transmitting an acceptance response to the machine responsive to accepting the restoration request, wherein the acceptance response is configured to cause the backup application user interface to provide, to the user system, an interface for selecting an object for restoration from the at least one image level backup.
11. The computer-implemented method of claim 10 , wherein the backup application is further configured to deny the restoration request if the requested machine identifier does not match the first machine identifier.
12. The computer-implemented method of claim 10 , wherein the restoration request further includes a user identifier of a user currently logged onto the machine through the user system and wherein the method further comprises:
determining whether the user identifier belongs to an access control group associated with the machine.
13. The computer-implemented method of claim 12 , wherein, responsive to determining that the user identifier does not belong to the access control group associated with the machine, the backup application is further configured to deny the restoration request.
14. The computer-implemented method of claim 12 , wherein the access control group is a local administrators group.
15. The computer-implemented method of claim 10 , wherein, responsive to determining the match between the requested machine identifier and the first machine identifier associated with the machine, the backup application is further configured to:
write a written authentication cookie to a location within a file system of the machine accessible to the user system initiating the restoration request.
16. The computer-implemented method of claim 15 , wherein the backup application is further configured to:
prompt the user system to provide the authentication cookie to the backup application;
deny the restoration request if no authentication cookie is received from the user system within a predetermined time interval; and
if the authentication cookie is received within the predetermined time interval from the user system:
accept the restoration request responsive to the authentication cookie matching the written authentication cookie; and
deny the restoration request if the authentication cookie does not match the written authentication cookie.
17. The computer-implemented method of claim 15 , wherein the location within the file system of the machine is an administrator-only directory location on the machine.
18. The computer-implemented method of claim 15 , wherein the backup application utilizes an application programming interface provided by a hypervisor executing on the host system to write the written authentication cookie to the location within the file system.
19. A computer program product comprising a non-transitory computer readable medium including computer control logic stored therein, wherein the computer control logic, when executed by one or more processors, enables a method for user authorization for file level restoration from an image level backup, the method comprising:
storing a plurality of image level backups including a first image level backup of a machine located on a host system and a plurality of machine identifiers associated with the plurality of image level backups including a first machine identifier associated with the machine;
receiving, from a user system, a restoration request from a backup application user interface provided by a backup application executing on the machine, the restoration request including a requested machine identifier, wherein the restoration request is configured to request access to at least one image level backup;
determining a match between the requested machine identifier and the first machine identifier associated with the machine;
accepting the restoration request based at least in part on the match between the requested machine identifier and the first machine identifier; and
transmitting an acceptance response to the machine responsive to accepting the restoration request, wherein the acceptance response is configured to cause the backup application user interface to provide, to the user system, an interface for selecting an object for restoration from the at least one image level backup.
20. The computer program product of claim 19 , wherein the backup application is further configured to deny the restoration request if the requested machine identifier does not match the first machine identifier.