Automatic creation and management of credentials in a distributed environment

Patent metadata

Field	Value
Publication number	US-10237252-B2
Application number	US-201314033199-A
Country	US
Kind code	B2
Filing date	Sep 20, 2013
Priority date	Sep 20, 2013
Publication date	Mar 19, 2019
Grant date	Mar 19, 2019

Abstract

A multi-node cluster is configured for credential management. A method commences by retrieving a super-user credential from a credential record stored in a location accessible to the cluster, then propagating the super-user credential to a set of nodes in the multi-node cluster. A credential creating processes is invoked on at least some of the set of nodes. Application-level credential access can be implemented in a multi-cluster environment by carrying-out an exchange that passes credentials between a first cluster and a second cluster over a secure channel. A protocol is observed whereby one or more applications running on the first cluster receive new credentials for accessing the second cluster from the credential serving process after the credential creating process creates the new credential.

First claim

What is claimed is:

1. A computer implemented method for credential management in a multi-node cluster, the method comprising:
distributing a super-user credential providing root privileges of a super-user to a plurality of nodes in a client computing environment;
storing the super-user credential on the plurality of nodes, wherein the super-user credential is encrypted and authorizes the plurality of nodes to create application credentials that authorize access requests for a plurality of users on the plurality of nodes to access remote computing resources located on a remote node, and wherein the remote node is located in a server computing environment that is connected to the client computing environment via one or more network components;
authenticating an identity of a user on at least one node of the plurality of nodes by using at least a login credential received from the user on the at least one node;
validating whether an access request from the user is authorized for the user on the at least one node to access a remote computing resource located on the remote node;
in response to a successful validation of the access request, determining whether an application credential exists for authorizing the access request for the user on the at least one node of the plurality of nodes to access the remote computing resource located on the remote node; and
when the application credential for authorizing the access request for the user is determined not to exist to authorize the access request for the user, authorizing the user to access the remote resource at least by:
generating, by a proxy located on the at least one node, a credential creation request for the user by using at least the super-user credential;
authenticating, on the remote node, the credential creation request;
creating, at a credential serving entity on the remote node that functions in tandem with at least one microprocessor of the remote node, the application credential that is exclusively accessible by the user of the plurality of users on the plurality of nodes to access the remote computing resource in response to the credential creation request by using at least the super-user credential for the user to fulfill the access request;
establishing a secure connection between the at least one node and the credential serving entity on the remote node by using at least the super-user credential, the secure connection being established to transmit the application credential from the credential serving entity on the remote node to the at least one node via the secure connection;
storing the application credential which is exclusively accessible by the user, locally at the at least one node and on a central repository, wherein the central repository is accessible by the plurality of nodes; and
authorizing the access request with at least the application credential, which is exclusively accessible by the user, to allow the user to access the remote computing resource.

2. The method of claim 1 , further comprising:
identifying the secure connection established by the proxy that is located on the at least one node to the credential serving entity on the remote node;
authenticating, at the remote node, the proxy by using the super-user credential distributed to the at least one node;
authorizing, at the remote node, the credential creation request generated by the proxy; and
receiving, at the credential serving entity, the credential creation request from the proxy via the secure connection.

3. The method of claim 2 , wherein the authenticating the proxy further uses a challenge protocol service.

4. The method of claim 1 , wherein the authenticating the identity of the user comprising:
contacting the credential serving entity on behalf of the user by using the super-user credential that authorizes a thread of execution to communicate with the credential serving entity on the remote node.

5. The method of claim 4 , further comprising:
populating the super-user credential into an operating system accessible credentials file by using at least the root privileges of the super-user, the root privileges authorizing an access to the operating system accessible credentials file;
requesting, by an authentication engine on the at least one node, a credential creation engine on the at least one node to create the application credential for the access request to access the remote computing resource for the user, wherein both the authentication engine and the credential creation engine have the root privileges provided by the super-user credential;
authenticating, at the credential creation engine, the user of the access request by using the super-user credential; and
contacting, by the credential creation engine, the credential serving entity to create the application credential for the user by using the super-user credential.

6. The method of claim 5 , further comprising:
upon determining that a process does not initially have a credential for the multi-node cluster, receiving a new credential for the multi-node cluster after the credential serving entity creates the new credential;
configuring a secure channel such that the secure channel includes at least one first connection point at the multi-node cluster and at least one second connection point at the process that does not initially have the credential for the multi-node cluster; and
communicating the new credential over the secure channel.

7. The method of claim 5 , wherein the multi-node cluster is a storage cluster.

8. The method of claim 5 , wherein the process that does not initially have a credential for the multi-node cluster is running in a client computing environment.

9. The method of claim 8 , further comprising storing the new credential in a credential file accessible to the client computing environment.

10. A computer program product embodied in a non-transitory computer readable medium, the computer readable medium having stored thereon a sequence of instructions which, when executed by a processor causes the processor to execute a set of acts for credential management in a multi-node cluster, the set of acts comprising:
distributing a super-user credential providing root privileges of a super-user to a plurality of nodes in a client computing environment;
storing the super-user credential, wherein the super-user credential is encrypted and authorizes the plurality of nodes to create application credentials that authorize access requests for a plurality of users on the plurality of nodes to access remote computing resources located on a remote node, and the remote node is located in a server computing environment that is connected to the client computing environment via one or more network components;
authenticating an identity of a user on at least one node of the plurality of nodes by using at least a login credential received from the user on the at least one node;
validating whether an access request from the user is authorized for the user on the at least one node to access a remote computing resource located on the remote node;
in response to a successful validation of the access request, determining whether an application credential exists for authorizing the access request for the user on the at least one node of the plurality of nodes to access the remote computing resource located on the remote node; and
when the application credential for authorizing the access request for the user is determined not to exist to authorize the access request for the user, authorizing the user to access the remote resource at least by:
generating, by a proxy located on the at least one node, a credential creation request for the user by using at least the super-user credentia

Assignees

• Oracle Int Corp

Inventors

• Nandyala Harish
• Bagal Prasad V
• Joshi Sameer Arun

Classifications

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F15/16

  Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs {(coordinating program control therefor G06F9/52; in regulating and control system G05B)} · CPC title