Network authentication for a storage system
A method of operating a storage system is provided. The method includes establishing a security context between a client and the storage system, the security context comprising a single ticket for multiple nodes within the storage system. The method includes distributing a first request to a first blade within the storage system and distributing a second request to a second blade within the storage system. The distributing the first request and the second request includes determining a node for handling the first request and the second request based on data within the single ticket.
1. A method, comprising:
establishing a security context between a client and a storage system, the security context comprising a ticket for multiple nodes within the storage system, the establishing triggered by a remote procedure call received by the storage system;
distributing a first request to a first blade within the storage system, the distributing comprising transmitting a message to an authority owning the first request, the authority one of a plurality of authorities within the storage system; and
distributing a second request from the first blade to a second blade within the storage system, wherein the distributing the first request and the second request comprises:
determining, by the first blade, a node for handling the first request and a node for handling the second request based on data within the ticket.
2. The method of claim 1 , wherein establishing the security context includes authentication through third party authorization.
3. The method of claim 1 , wherein the security context is incremented for each remote procedure call.
4. The method of claim 1 , wherein the storage system comprises multiple chassis and wherein the ticket includes a session key and a storage system key.
5. The method of claim 1 , wherein the multiple nodes of the storage system are projected as a single node.
6. The method of claim 1 , wherein the establishing comprises:
issuing a ticket through third party authorization.
7. The method of claim 1 , comprising:
caching a client principal name across all nodes.
8. The method of claim 1 , wherein the ticket is encrypted.
9. The method of claim 1 wherein the method operations are embodied as non-transitory computer readable media.
10. A storage system, comprising:
a plurality of storage nodes configured to communicate together as a storage cluster;
each of the plurality of storage nodes having nonvolatile solid-state memory for data storage; and
the plurality of storage nodes configured to distribute the data and metadata associated with the data throughout the plurality of storage nodes, the plurality of storage nodes configurable to:
establish a security context between a client and the plurality of storage nodes, the security context comprising a ticket for the plurality of storage nodes, establishment of the security context triggered by a remote procedure call received by the storage system;
distributing a first request to a first node within the storage system, the distributing comprising transmitting a message to an authority owning the first request, the authority one of a plurality of authorities within the storage system; and
distributing a second request from the first node to a second node within the storage system, wherein the distributing the first request and the second request comprises:
determining, by the first node, a further node for handling the first request and the second request based on data within the ticket.
11. The system of claim 10 , wherein establishing the security context includes authentication through third party authorization.
12. The system of claim 10 , wherein the security context is incremented for each remote procedure call.
13. The system of claim 10 , wherein the storage system comprises multiple chassis and wherein the ticket includes a session key and a storage system key.
14. The system of claim 10 , wherein the plurality of nodes of the storage system are projected as a single node.
15. The system of claim 10 , wherein the establishing comprises:
issuing a ticket through third party authorization.
16. The system of claim 10 , comprising:
caching a client principal name across each of the plurality of nodes.
17. The system of claim 10 , wherein the ticket is encrypted.
18. The system of claim 10 wherein method operations of the plurality of storage nodes configurable are embodied as non-transitory computer readable media.