Method and system for performing backup operations using access tokens via command line interface (CLI)

Patent metadata

Field	Value
Publication number	US-10057246-B1
Application number	US-201514840685-A
Country	US
Kind code	B1
Filing date	Aug 31, 2015
Priority date	Aug 31, 2015
Publication date	Aug 21, 2018
Grant date	Aug 21, 2018

Abstract

A first request is received to execute a batch of a plurality of tasks from a user via a command-line interface (CLI). A predetermined storage location is accessed to determine whether there is an access token associated with the user. If not, the user is prompted via the CLI interface for login credentials. The login credentials are transmitted to an authentication and authorization (AUTH) request to a remote AUTH server to allow the AUTH server to authenticate and authorize the user. An access token associated with the user is received from the AUTH server containing authorization information of the user for accessing resources of one or more cloud servers. The access token is stored in the predetermined storage location. One or more of the cloud servers are accessed using the access token to perform the tasks of the batch without having to log in multiple times.

First claim

What is claimed is:

1. A computer-implemented method for authenticating and authorizing via a command line interface (CLI), the method comprising:
receiving, by a CLI command processing module executed by a processor of a client device, a first request to execute a script having a batch of a plurality of tasks from a user via a command-line interface (CLI);
in response to the first request, accessing, by the CLI command processing module, a predetermined storage location of a persistent storage device of the client device to determine whether there is an access token associated with the user;
in response to determining that the predetermined storage location of the persistent storage device does not contain an access token associated with the user,
prompting, by a CLI login module executed by the processor of the client device, the user via the CLI interface to receive user login credentials,
transmitting, by the CLI login module, the user login credentials to an authentication and authorization (AUTH) request to a remote AUTH server to allow the AUTH server to authenticate and authorize the user,
receiving, by the CLI login module, an access token associated with the user from the AUTH server, wherein the access token contains authorization information of the user for accessing resources of one or more cloud servers, and
storing, by the CLI login module, the received access token in the predetermined storage location of the persistent storage device; and

accessing, by the CLI command processing module, one or more of the cloud servers using the access token to perform the tasks of the batch without having to log in multiple times;
wherein accessing one or more of the cloud servers using the access token comprises:
for each of the tasks in the batch, determining a resource to be accessed, a tenant associated with the resource, and a cloud server maintaining the resource; and
transmitting a second request and the access token to the cloud server to access the resource of the tenant, without having to log in again between executing the tasks of the batch.

2. The method of claim 1 , wherein storing the received access token comprises encrypting the access token using an encryption key that is only known to the CLI login module.

3. The method of claim 2 , wherein the predetermined storage location is a secure storage location only accessible by the CLI login module.

4. The method of claim 2 , wherein accessing the predetermined storage location is performed by invoking the CLI login module to determine whether the access token has been stored therein.

5. The method of claim 1 , wherein the second request includes a user identifier (ID) identifying the user, a resource ID identifying the resource, and a tenant ID identifying the tenant.

6. The method of claim 1 , wherein the cloud server is to communicate with the AUTH server to verify the access token prior to allowing access of the requested resource of the tenant.

7. A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor, cause the processor to perform operations for authenticating and authorizing users in a multi-tenant environment, the operations comprising:
receiving, by a CLI command processing module executed by a processor of a client device, a first request to execute a script having a batch of a plurality of tasks from a user via a command-line interface (CLI);
in response to the first request, accessing, by the CLI command processing module, a predetermined storage location of a persistent storage device of the client device to determine whether there is an access token associated with the user;
in response to determining that the predetermined storage location of the persistent storage device does not contain an access token associated with the user,
prompting, by a CLI login module executed by the processor of the client device, the user via the CLI interface to receive user login credentials,
transmitting, by the CLI login module, the user login credentials to an authentication and authorization (AUTH) request to a remote AUTH server to allow the AUTH server to authenticate and authorize the user,
receiving, by the CLI login module, an access token associated with the user from the AUTH server, wherein the access token contains authorization information of the user for accessing resources of one or more cloud servers, and
storing, by the CLI login module, the received access token in the predetermined storage location of the persistent storage device; and

accessing, by the CLI command processing module, one or more of the cloud servers using the access token to perform the tasks of the batch without having to log in multiple times;
wherein accessing one or more of the cloud servers using the access token comprises:
for each of the tasks in the batch, determining a resource to be accessed, a tenant associated with the resource, and a cloud server maintaining the resource; and
transmitting a second request and the access token to the cloud server to access the resource of the tenant, without having to log in again between executing the tasks of the batch.

8. The non-transitory machine-readable medium of claim 7 , wherein storing the received access token comprises encrypting the access token using an encryption key that is only known to the CLI login module.

9. The non-transitory machine-readable medium of claim 8 , wherein the predetermined storage location is a secure storage location only accessible by the CLI login module.

10. The non-transitory machine-readable medium of claim 8 , wherein accessing the predetermined storage location is performed by invoking the CLI login module to determine whether the access token has been stored therein.

11. The non-transitory machine-readable medium of claim 7 , wherein the second request includes a user identifier (ID) identifying the user, a resource ID identifying the resource, and a tenant ID identifying the tenant.

12. The non-transitory machine-readable medium of claim 7 , wherein the cloud server is to communicate with the AUTH server to verify the access token prior to allowing access of the requested resource of the tenant.

13. A data processing system, comprising:
a processor; and
a memory coupled to the processor for storing instructions, which when executed from the memory, cause the processor to perform operations, the operations including:
receiving, by a CLI command processing module executed by the processor of a client device, a first request to execute a script having a batch of a plurality of tasks from a user via a command-line interface (CLI),
in response to the first request, accessing, by the CLI command processing module, a predetermined storage location of a persistent storage device of the client device to determine whether there is an access token associated with the user,
in response to determining that the predetermined storage location of the persistent storage device does not contain an access token associated with the user,
prompting, by a CLI login module executed by the processor of the client device, the user via the CLI interface to receive user login credentials,
transmitting, by the CLI login module, the user login credentials to an authentication and authorization (AUTH) request to a remote AUTH server to allow the AUTH server to authenticate and authorize the user,
receiving, by the CLI login module, an access token associated with the user from the AUTH server, wherein the access token contains authorization information of the user for accessing resources of one or more cloud servers, and
storing, by the CLI login module, the rece

Assignees

• Emc Corp
• Emc Ip Holding Co Llc

Inventors

• Drozd Michal J
• Roche michael g
• Shtop Aliaksandr

Classifications

• H04L63/105

  Multiple levels of security · CPC title

• H04L63/0892

  by using authentication-authorization-accounting [AAA] servers or protocols · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• G06F11/1402

  Saving, restoring, recovering or retrying · CPC title

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title