Authentication in a multi-tenant environment
Techniques are described for enabling a Kerberos-based authentication system to provide a client with access to a plurality of unmodifiable components that require plain text passwords. Such an approach enables a user to sign into a distributed computer system using a single password, and access multiple components that require different passwords without the need to enter a second password. By using Kerberos based authentication, passwords are not unnecessarily sent throughout distributed computing system where they may be vulnerable. A proxy key distribution center can be used to manage passwords or other credentials on behalf of various clients, which can be used with various processes discussed herein.
1. A system, comprising:
one or more processors;
a memory device including instructions that, when executed by the one or more processors, cause the system to:
receive a login credential from a client device requesting to access a component;
authenticate the login credential to determine an associated user account;
determine a value based at least in part on the login credential and a timestamp associated with the request, the timestamp being encrypted with the login credential as an encryption key;
generate a plurality of keys for the user account, the plurality of keys respectively associated with providing access to a plurality of components, wherein the component is one of the plurality of components;
identify, based at least in part on the value, a key from the plurality of keys associated with providing access to the component;
generate a service ticket based at least in part on the key;
provide the key to the client device, the key used by the client device to establish access to the component; and
provide the service ticket to the client device to be used to establish access to the component.
2. The system of claim 1 , wherein the instructions, when executed by the one or more processors, further cause the system to:
receive, at a ticket granting service, the key from the client device; and
generate a session key for the client device and the component.
3. The system of claim 1 , wherein the key includes a ticket granting ticket (TGT) used in Kerberos authentication to obtain a Kerberos service ticket, and wherein the component accepts Kerberos service tickets for granting access.
4. The system of claim 1 , wherein the component is configured to authenticate login credentials for granting access and the key includes a second login credential for accessing the component.
5. The system of claim 4 , wherein the component does not accept Kerberos service tickets for granting access.
6. The system of claim 1 , wherein the plurality of keys includes at least one ticket granting ticket (TGT) used in Kerberos authentication for accessing a component configured for Kerberos authentication, and wherein the plurality of keys includes at least one login credential for accessing a component that is not configured for Kerberos authentication.
7. The system of claim 1 , wherein the instructions, when executed by the one or more processors, further cause the system to:
intercept a request from the client device to a Key Distribution Center (KDC), the KDC having password information associated with the user account for accessing only one component, wherein the key provided to the client device is sent to the KDC.
8. A computer-implemented method, comprising:
receiving a login credential from a client device requesting to access a component;
authenticating the login credential to determine an associated user account;
determining a value based at least in part on the login credential and a timestamp associated with the client device requesting to access the component, the timestamp being encrypted with the login credential as an encryption key;
generating a plurality of keys for the user account, the plurality of keys respectively associated with providing access to a plurality of components, wherein the component is one of the plurality of components;
identifying, based at least in part on the value, a key from the plurality of keys associated with providing access to the component;
generating a service ticket based at least in part on the key;
providing the key to the client device, the key used by the client device to establish access to the component; and
providing the service ticket to the client device to be used to establish access to the component.
9. The method of claim 8 , further comprising:
receiving, at a ticket granting service, the key from the client device; and
generating a session key for the client device and the component.
10. The method of claim 8 , wherein the key includes a ticket granting ticket (TGT) used in Kerberos authentication to obtain a Kerberos service ticket, and wherein the component accepts Kerberos service tickets for granting access.
11. The method of claim 8 , wherein the component is configured to authenticate login credentials for granting access and the key includes a second login credential for accessing the component.
12. The method of claim 11 , wherein the component does not accept Kerberos service tickets for granting access.
13. The method of claim 8 , wherein the plurality of keys includes at least one ticket granting ticket (TGT) used in Kerberos authentication for accessing a component configured for Kerberos authentication, and wherein the plurality of keys includes at least one login credential for accessing a component that is not configured for Kerberos authentication.
14. The method of claim 8 , further comprising
intercepting a request from the client device to a Key Distribution Center (KDC), the KDC having password information associated with the user account for accessing only one component, wherein the key provided to the client device is sent to the KDC.
15. A non-transitory computer-readable storage medium including instructions that, when executed by at least one processor of a computing system, cause the computing system to:
receive a login credential from a client device requesting to access a component;
authenticate the login credential to determine an associated user account;
determine a value based at least in part on the login credential and a timestamp associated with the client device requesting to access the component, the timestamp being encrypted with the login credential as an encryption key;
generate a plurality of keys for the user account, the plurality of keys respectively associated with providing access to a plurality of components, wherein the component is one of the plurality of components;
identify, based at least in part on the value, a key from the plurality of keys associated with providing access to the component;
generate a service ticket based at least in part on the key;
provide the key to the client device, the key used by the client device to establish access to the component; and
provide the service ticket to the client device to be used to establish access to the component.
16. The non-transitory computer-readable storage medium of claim 15 , wherein the instructions when executed further cause the system to:
receive, at a ticket granting service, the key from the client device; and
generate a session key for the client device and the component.
17. The non-transitory computer-readable storage medium of claim 15 , wherein the key includes a ticket granting ticket (TGT) used in Kerberos authentication to obtain a Kerberos service ticket, and wherein the component accepts Kerberos service tickets for granting access.
18. The non-transitory computer-readable storage medium of claim 15 , wherein the component is configured to authenticate login credentials for granting access and the key includes a second login credential for accessing the component.
19. The non-transitory computer-readable storage medium of claim 15 , wherein the plurality of keys includes at least one ticket granting ticket (TGT) used in Kerberos authentication for accessing a component configured for Kerberos authentication, and wherein the plurality of keys includes at least one login credential for accessing a component that is not configured for Kerberos authentication.
20. The non-transitory computer-readable storage medium of claim 15 , wherein the instructions when executed further cause the system to:
intercept a request from the client device to a Key Distribution Center (KDC), the KDC having password information associated with the user account for accessing only one component, wherein the key provided to the client device is sent to the KDC.