System and method for safely relaying and filtering Kerberos authentication and authorization requests across network boundaries
A system and method for providing secure access to an organization's internal resources by an application running on an external network. An agent accepts queries from the application which are passed to a relay with a dynamic filter. The relay establishes a secure connection with a connector through the organization's firewall and passes requests from the application to an authentication service running on the internal network to confirm that a user of the application is authorized and issue an authentication ticket which is returned to the application. The application then sends a request to access a specific internal resource based on the authentication ticket, which is passed to a ticket granting service running on the internal network, to verify that said user is authorized to access the specific internal resource, and, if so, issue a service ticket to grant access the application for that resource.
1. A system for providing secure access to an organization's internal server resources on an internal network by an application running on an external network comprising:
an agent configured to accept queries from the application running on said external network and pass said queries to a relay with a dynamic filter running on said external network;
said relay configured to i) establish a secure connection with a local connector through a firewall to protect said organization's internal server resources running on said internal network, and ii) pass requests from said application via said agent to a cloud authentication service running on said external network, said cloud authentication service to confirm that a user of said application is authorized to access said internal network and if authorized, issue an authentication ticket,
a cloud connector running on said external network configured to receive said issued authentication ticket and pass said issued authentication ticket via said relay for receipt by said application via said agent;
said relay further configured to receive from said application via said agent a request to access a specific internal server resource based on said issued authentication ticket, and pass said request through said secure connection to said connector if said user is authenticated, said connector further configured to pass said request to a ticket granting service running on said internal network, said ticket granting service to verify that said user is authorized to access the specific internal server, and if authorized to issue a service ticket provided to said connector to pass said service ticket via said relay and said agent to said application, wherein said application, based on said service ticket, is granted access to said specific internal server.
2. The system defined by claim 1 wherein said ticket granting service verifies that said user is authorized to access the specific internal server by checking a database on said internal network to check if said user exists in said database and is allowed access to the local resource, or said request received by said ticket granting service originates from a trusted realm.
3. The system defined by claim 1 wherein said dynamic filter uses rules wherein at least a username of said user and a realm from which said queries originate are checked.
4. The system defined by claim 1 wherein said relay routes to said connector based on a realm from which said queries originate.
5. A method for providing secure access to an organization's internal server resources on an internal network by an application running on an external network comprising:
accepting by an agent queries from the application running on said external network and passing said queries to a relay with a dynamic filter running on said external network;
establishing by said relay a secure connection with a local connector through a firewall to protect said organization's internal server resources running on said internal network, and ii) passing requests from said application via said agent to a cloud authentication service running on said external network;
confirming by said cloud authentication service that a user of said application is authorized to access said internal network and if authorized, issuing an authentication ticket, receiving by a cloud connector running on said external network said issued authentication ticket and passing said issued authentication ticket via said relay for receipt by said application via said agent;
said relay further receiving from said application via said agent a request to access a specific internal server resource based on said issued authentication ticket, and passing said request through said secure connection to said connector if said user is authenticated, said connector passing said request to a ticket granting service running on said internal network, verifying by said ticket granting service that said user is authorized to access the specific internal server, and if authorized issuing a service ticket provided to said connector to pass said service ticket via said relay and said agent to said application, granting access by said application based on said service ticket to said specific internal server.