Cross domain authentication and security services using proxies for HTTP access
Two identity spaces form a federation by agreeing to use a secret key to facilitate secure access of resources between them. When one identity space receives a request for a resource from a user in the other identity space, the first identity space checks to see if the resource is protected. If the resource is protected, the first identity space requests that a mediator in the second identity space authenticate the external user. The mediator verifies the external user's authenticity. Once the external user is authenticated, the mediator securely informs the first identity space, using the secret key, that the external user is authenticated to access the resource. The identity space then grants the user access to the resource if the user is allowed access as per the access control policy of the identity space.
1. An apparatus in a computer system, comprising:
a reverse proxy;
a security module accessible from the reverse proxy; and
at least one access control rule loaded in the security module, the access control rule identifying a resource and a user,
where the security module is designed to permit loading the access control rule without involving an administrator and to use the access control rule if said user is not a member of a domain including the reverse proxy.
2. An apparatus according to claim 1 , wherein the access control rule further identifies a type of access to said resource by said user.
3. An apparatus according to claim 2 , wherein said type of access is a subset of a type of access granted to a second user responsible for the creation of the access control rule.
4. An apparatus according to claim 1 , wherein the access control rule includes a public certificate used to identify said user.
5. An apparatus according to claim 4 , wherein the security module is operative to receive said public certificate from a machine operated by said user.
6. An apparatus according to claim 5 , wherein the security module is operative to permit said user access to said resource if said public certificate received from said machine operated by said user matches said public certificate in the access control rule.
7. An apparatus according to claim 1 , wherein the reverse proxy is operative to route a request for access to said resource to the security module if an authentication of said user cannot be mediated or determined using a federation access policy.
8. An apparatus according to claim 1 , wherein the security module is operative to deny said user access to said resource if said user is not properly identified.
9. A method implemented in a computer system in a first domain, comprising:
receiving a request to access a resource by a user where the user is in a second domain;
accessing at least one access control rule in the first domain including the resource, the access control rule identifying the resource and the user, the first domain distinct from the second domain;
determining an identity of the user;
comparing the identity of the user with the access control rule; and
granting the user access to the resource if the identity of the user matches the user identified in the access control rule.
10. A method according to claim 9 , wherein granting the user access to the resource includes:
determining a type of access from the access control rule; and
granting the user access to the resource limited by the type of access.
11. A method according to claim 9 , wherein:
accessing at least one access control rule identifying the resource and the user includes accessing at least one access control rule identifying the resource and the user, the access control rule including a public certificate of the user; and
determining an identity of the user includes accessing a public certificate of the user from a machine operated by the user.
12. A method according to claim 9 , further comprising determining that the user cannot be authenticated by a mediator or a federation access policy.
13. A method according to claim 9 , further comprising denying the user access to said resource if the user is not properly identified.
14. A method according to claim 9 , further comprising receiving the access control rule from a second user in the first domain without involving an administrator.
15. A method according to claim 14 , wherein receiving the access control rule from a second user includes receiving the access control rule from a second user in the first domain, the access control rule including a type of access to the resource, the type of access a subset of a second type of access to the resource granted to the second user.