Shared authentication via DNS request routing
Methods, systems, and apparatuses are described herein for management of a Domain Name System (DNS) system. The system comprises numerous improvements, many related to CNAME records of the DNS. A computing device may manage authentication for a DNS using shared authentication credentials of a first authentication framework. In this manner, a wide variety of users might authenticate themselves using a first framework and use authentication credentials for a second framework to access a DNS. The computing device may further protect DNS servers from Denial of Service (DOS) attacks by bifurcating read and write requests to a DNS to different servers, such that attacks on read requests do not affect all of the DNS. The computing device may further validate DNS requests using, for example, natural language processing to avoid typographical errors inadvertently creating DNS zones.
1. A computing device configured to manage authentication for a Domain Name System (DNS) using shared authentication credentials of a first authentication framework, the computing device comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the computing device to:
receive, via an Application Programming Interface (API), a first DNS request comprising:
first authentication credentials for a first user; and
a first requested change to a first DNS Canonical Name (CNAME) record;
query a first authentication database corresponding to the first authentication framework to determine whether the first authentication credentials are associated with one or more existing authentication tokens;
based on determining that the first authentication credentials are not associated with the one or more existing authentication tokens, determine, by querying a second authentication database corresponding to a second authentication framework different from the first authentication framework, whether the first authentication credentials are valid by comparing the first authentication credentials to a blocklist;
based on a determination that the first authentication credentials are valid, generate a modified DNS request comprising:
the first requested change to the first DNS CNAME record; and
the shared authentication credentials of the first authentication framework; and
transmit the modified DNS request to a DNS server.
2. The computing device of claim 1 , wherein the instructions, when executed by the one or more processors, cause the computing device to:
receive, via the API, a second DNS request comprising:
second authentication credentials for a second user; and
a second requested change to a second DNS CNAME record;
query the first authentication database corresponding to the first authentication framework to determine whether the second authentication credentials are associated with the one or more existing authentication tokens;
based on a determination that the second authentication credentials are associated with a first authentication token of the one or more existing authentication tokens:
determine, based on the first authentication token, a secret key;
generate a second modified DNS request comprising:
the second requested change to the second DNS CNAME record;
the first authentication token; and
the secret key; and
transmit the second modified DNS request to the DNS server.
3. The computing device of claim 1 , wherein the instructions, when executed by the one or more processors, cause the computing device to:
receive, via the API, a second DNS request comprising:
second authentication credentials for a second user; and
a second requested change to a second DNS CNAME record;
query the first authentication database corresponding to the first authentication framework to determine whether the second authentication credentials are associated with the one or more existing authentication tokens; and
based on determining that the second authentication credentials are not associated with the one or more existing authentication tokens, and based on determining that the second authentication credentials are valid, cause output of a notification that the second DNS request is denied.
4. The computing device of claim 1 , wherein the instructions, when executed by the one or more processors, cause the computing device to:
receive, from the DNS server, a response to the modified DNS request;
modify the response to the modified DNS request by removing, from the response, one or more indications of the shared authentication credentials; and
send the modified response to a user device.
5. The computing device of claim 1 , wherein the first requested change to the first DNS CNAME record comprises a request to create a CNAME record.
6. The computing device of claim 1 , wherein the one or more existing authentication tokens are generated in accordance with the first authentication framework upon successful authentication of one or more users.
7. A method configured to manage authentication for a Domain Name System (DNS) using shared authentication credentials of a first authentication framework, the method comprising:
receiving, via an Application Programming Interface (API), a first DNS request comprising:
first authentication credentials for a first user; and
a first requested change to a first DNS Canonical Name (CNAME) record;
querying a first authentication database corresponding to the first authentication framework to determine whether the first authentication credentials are associated with one or more existing authentication tokens;
based on determining that the first authentication credentials are not associated with the one or more existing authentication tokens, determining, by querying a second authentication database corresponding to a second authentication framework different from the first authentication framework, whether the first authentication credentials are valid by comparing the first authentication credentials to a blocklist;
based on a determination that the first authentication credentials are valid, generating a modified DNS request comprising:
the first requested change to the first DNS CNAME record; and
the shared authentication credentials of the first authentication framework; and
transmitting the modified DNS request to a DNS server.
8. The method of claim 7 , further comprising:
receiving, via the API, a second DNS request comprising:
second authentication credentials for a second user; and
a second requested change to a second DNS CNAME record;
querying the first authentication database corresponding to the first authentication framework to determine whether the second authentication credentials are associated with the one or more existing authentication tokens;
based on a determination that the second authentication credentials are associated with a first authentication token of the one or more existing authentication tokens:
determining, based on the first authentication token, a secret key;
generating a second modified DNS request comprising:
the second requested change to the second DNS CNAME record;
the first authentication token; and
the secret key; and
transmitting the second modified DNS request to the DNS server.
9. The method of claim 7 , further comprising:
receiving, via the API, a second DNS request comprising:
second authentication credentials for a second user; and
a second requested change to a second DNS CNAME record;
querying the first authentication database corresponding to the first authentication framework to determine whether the second authentication credentials are associated with the one or more existing authentication tokens; and
based on determining that the second authentication credentials are not associated with the one or more existing authentication tokens, and based on determining that the second authentication credentials are valid, causing output of a notification that the second DNS request is denied.
10. The method of claim 7 , further comprising:
receiving, from the DNS server, a response to the modified DNS request;
modifying the response to the modified DNS request by removing, from the response, one or more indications of the shared authentication credentials; and
sending the modified response to a user device.
11. The method of claim 7 , wherein the first requested change to the first DNS CNAME record comprises a request to create a CNAME record.
12. The method of claim 7 , wherein the one or more existing authentication tokens are generated in accordance with the first authentication framework upon successful authentication of one or more users.
13. One or more non-transitory computer-readable media storing instructions configured to manage authentication for a Domain Name System (DNS) using shared authentication credentials of a first authentication framework, wherein the instructions, when executed by one or more processors, cause a computing device to:
receive, via an Application Programming Interface (API), a first DNS request comprising:
first authentication credentials for a first user; and
a first requested change to a first DNS Canonical Name (CNAME) record;
query a first authentication database corresponding to the first authentication framework to determine whether the first authentication credentials are associated with one or more existing authentication tokens;
based on determining that the first authentication credentials are not associated with the one or more existing authentication tokens, determine, by querying a second authentication database corresponding to a second authentication framework different from the first authentication framework, whether the first authentication credentials are valid by comparing the first authentication credentials to a blocklist;
based on a determination that the first authentication credentials are valid, generate a modified DNS request comprising:
the first requested change to the first DNS CNAME record; and
the shared authentication credentials of the first authentication framework; and
transmit the modified DNS request to a DNS server.
14. The one or more non-transitory computer-readable media of claim 13 , wherein the instructions, when executed by the one or more processors, cause the computing device to:
receive, via the API, a second DNS request comprising:
second authentication credentials for a second user; and
a second requested change to a second DNS CNAME record;
query the first authentication database corresponding to the first authentication framework to determine whether the second authentication credentials are associated with the one or more existing authentication tokens;
based on a determination that the second authentication credentials are associated with a first authentication token of the one or more existing authentication tokens:
determine, based on the first authentication token, a secret key;
generate a second modified DNS request comprising:
the second requested change to the second DNS CNAME record;
the first authentication token; and
the secret key; and
transmit the second modified DNS request to the DNS server.
15. The one or more non-transitory computer-readable media of claim 13 , wherein the instructions, when executed by the one or more processors, cause the computing device to:
receive, via the API, a second DNS request comprising:
second authentication credentials for a second user; and
a second requested change to a second DNS CNAME record;
query the first authentication database corresponding to the first authentication framework to determine whether the second authentication credentials are associated with the one or more existing authentication tokens; and
based on determining that the second authentication credentials are not associated with the one or more existing authentication tokens, and based on determining that the second authentication credentials are valid, cause output of a notification that the second DNS request is denied.
16. The one or more non-transitory computer-readable media of claim 13 , wherein the instructions, when executed by the one or more processors, cause the computing device to:
receive, from the DNS server, a response to the modified DNS request;
modify the response to the modified DNS request by removing, from the response, one or more indications of the shared authentication credentials; and
send the modified response to a user device.
17. The one or more non-transitory computer-readable media of claim 13 , wherein the first requested change to the first DNS CNAME record comprises a request to create a CNAME record.