Pass-thru for client authentication
This disclosure pertains generally to client authentication. One aspect of the disclosure relates to a first server for presenting evidence to a Domain Controller (DC) of a first authentication context being submitted from a client to the first server to obtain a delegable credential, wherein the credential can be used to request a second authentication context from that client to a second server. Another aspect relates to the first server providing a pass-thru with evidence to a DC. The evidence relates to a first authentication context being submitted from a client to the first server that it obtained a delegable credential. The pass-thru is used in combination with the credential to request a second authentication context from the client to a second server.
1. A method implemented by an authentication server, the method comprising:
receiving, at the authentication server and from a web server, credential information associated with a user of a client;
generating, by the authentication server, first verification information indicating that the authentication server validated the credential information;
transmitting, by the authentication server and to the web server, the first verification information;
receiving, at the authentication server and from the web server, the credential information and the first verification information;
generating, by the authentication server, second verification information indicating that the authentication server validated the credential information and the first verification information;
transmitting, by the authentication server and to the web server, the second verification information, the transmitting the second verification information to the web server enabling the web server to transmit the second verification information to a Structured Query Language (SQL) data depository server that contains data that is being sought by the user of the client; and
transmitting, by the web server and to the SQL data depository server, the second verification information, the transmitting the second verification information to the SQL data depository server enabling the SQL data depository server to access, on behalf of the client, the data that is being sought by the user.
2. The method of claim 1 , further comprising receiving, at the web server and from the client, the credential information prior to the receiving of the credential information at the authentication server.
3. The method of claim 1 , wherein the first verification information and the second verification information each comprise Kerberos tickets.
4. The method of claim 1 , wherein the generating the first verification information comprises generating a first ticket using a Kerberos protocol.
5. The method of claim 1 , wherein the generating the second verification information comprises generating a second ticket using a Kerberos protocol.
6. The method of claim 1 , wherein the credential information comprises at least one of a certificate, key pair, or digital identity.
7. A system comprising:
one or more hardware processors; and
memory storing instructions that, when executed, configure the one or more hardware processors to:
receive, at an authentication server and from a web server, credential information associated with a user of a client;
generate, by the authentication server, first verification information indicating that the authentication server validated the credential information;
transmit, by the authentication server and to the web server, the first verification information;
receive, at the authentication server and from the web server, the credential information and the first verification information;
generate, by the authentication server, second verification information indicating that the authentication server validated the credential information and the first verification information;
transmit, by the authentication server and to the web server, the second verification information, the transmitting the second verification information to the web server enabling the web server to transmit the second verification information to a Structured Query Language (SQL) data depository server that contains data that is being sought by the user of the client; and
transmitting, by the web server and to the SQL data depository server, the second verification information, the transmitting the second verification information to the SQL data depository server enabling the SQL data depository server to access, on behalf the client, the data that is being sought by the user.
8. The system of claim 7 , the memory further storing instructions that, when executed, configure the one or more hardware processors to receive, at the web server and from the client, the credential information prior to the receiving of the credential information at the authentication server.
9. The system of claim 7 , wherein the first verification information and the second verification information each comprise Kerberos tickets.
10. The system of claim 7 , wherein the generating the first verification information comprises generating a first ticket using a Kerberos protocol.
11. The system of claim 7 , wherein the generating the second verification information comprises generating a second ticket using a Kerberos protocol.
12. The system of claim 7 , wherein the credential information comprises at least one of a certificate, key pair, or digital identity.
13. A computer-readable storage device encoded with instructions that, based on execution by a hardware processor, configure the hardware processor to:
receive, at an authentication server and from a web server, credential information associated with a user of a client;
generate, by the authentication server, first verification information indicating that the authentication server validated the credential information;
transmit, by the authentication server and to the web server, the first verification information;
receive, at the authentication server and from the web server, the credential information and the first verification information;
generate, by the authentication server, second verification information indicating that the authentication server validated the credential information and the first verification information;
transmit, by the authentication server and to the web server, the second verification information, the transmitting the second verification information to the web server enabling the web server to transmit the second verification information to a Structured Query Language (SQL) data depository server that contains data that is being sought by the user of the client; and
transmitting, by the web server and to the SQL data depository server, the second verification information, the transmitting the second verification information to the SQL data depository server enabling the SQL data depository server to access, on behalf the client, the data that is being sought by the user.
14. The computer-readable storage device of claim 13 , the hardware processor to further receive, at the web server and from the client, the credential information prior to the receiving of the credential information at the authentication server.
15. The computer-readable storage device of claim 13 , wherein the first verification information and the second verification information each comprise Kerberos tickets.
16. The computer-readable storage device of claim 13 , wherein the generating the first verification information comprises generating a first ticket using a Kerberos protocol.
17. The computer-readable storage device of claim 13 , wherein the generating the second verification information comprises generating a second ticket using a Kerberos protocol.