Authenticating a user to access a data intake and query system

Patent metadata

Field	Value
Publication number	US-11327992-B1
Application number	US-201916512899-A
Country	US
Kind code	B1
Filing date	Jul 16, 2019
Priority date	Apr 30, 2018
Publication date	May 10, 2022
Grant date	May 10, 2022

Abstract

Systems and methods are disclosed for authenticating a user to use one or more components of a data intake and query system. The data intake and query system enables the generation or searching of events that include raw machine data associated with a timestamp. The data intake and query system receives a request for access via an application programming interface (API). Based on the request, the data intake and query system authenticates the user. The data intake and query system can receive a second request via the API for a component of the data intake and query system. Based on a determination that the user is authenticated, the data intake and query system can communicate the request to the component.

First claim

What is claimed is:

1. A method, comprising:
receiving, from a computing device associated with a user, a first request, via a first application programming interface (API), to access a data intake and query system,
wherein the first API enables interactions with the data intake and query system,
wherein the data intake and query system enables at least one of generating or searching events, each event including a portion of raw machine data associated with a timestamp, and
wherein the raw machine data reflects activity in an information technology environment;

performing a first authentication of the user by verifying that the user is authorized to access the data intake and query system, wherein performing the first authentication comprises communicating credentials of the user to an external authentication system;
receiving, from the computing device associated with the user, a second request, via the first API, for a component of the data intake and query system;
based at least in part on a determination that the user is authorized to access the data intake and query system, translating the second request based on a second API, wherein the second API enables interactions with the component of the data intake and query system, and wherein the component of the data intake and query system performs a second authentication of the user by verifying that the user is authorized to access the component of the data intake and query system, wherein performing the second authentication comprises communicating the credentials of the user to the external authentication system; and
communicating the second request to the component of the data intake and query system via the second API.

2. The method of claim 1 , wherein authenticating the user, during the first authentication or the second authentication, comprises verifying an identity of the user.

3. The method of claim 1 , wherein the component performs an action based on the second request.

4. The method of claim 1 , wherein the second request includes an instruction to add a dataset to a metadata catalog, and wherein the second authentication verifies that the user is authorized to add the dataset to the metadata catalog.

5. The method of claim 1 , wherein the second request includes an instruction to modify a dataset identified in a metadata catalog, and wherein the second authentication verifies that the user is authorized to modify the dataset identified in the metadata catalog.

6. The method of claim 1 , wherein the second request includes an instruction to modify a regular expression identified in a metadata catalog, and wherein the second authentication verifies that the user is authorized to modify the regular expression identified in the metadata catalog.

7. The method of claim 1 , wherein the second request includes an instruction to modify a rule configuration record of in a metadata catalog, and wherein the second authentication verifies that the user is authorized to modify the rule configuration record of the metadata catalog.

8. The method of claim 1 , wherein the second request includes an instruction to edit a dataset configuration record of a metadata catalog, and wherein the second authentication verifies that the user is authorized to edit the dataset configuration record of the metadata catalog.

9. The method of claim 1 , wherein the second request includes an instruction to edit a dataset association record in a metadata catalog, and wherein the second authentication verifies that the user is authorized to edit the dataset association record in the metadata catalog.

10. The method of claim 1 , wherein the second request includes an instruction to process data associated with a dataset, and wherein the second authentication verifies that the user is authorized to process the data associated with the dataset.

11. The method of claim 1 , wherein the second request includes an instruction to process data from a data source, and wherein the second authentication verifies that the user is authorized to process the data from the data source.

12. The method of claim 1 , wherein the second request includes an instruction to execute a query, wherein the second authentication verifies that the user is authorized to execute the query, and the method further comprising:
identifying a containerized search head to process the query based on a tenant identifier associated with the user;
identifying one or more containerized search nodes to execute the query based on the tenant identifier, wherein the containerized search head processes the query and the one or more containerized search nodes execute the query; and
providing results of the query to the computing device associated with the user.

13. The method of claim 1 , wherein the component is a metadata catalog that stores information regarding one or more tenants, datasets associated with tenants, and rules associated with the datasets.

14. The method of claim 1 , wherein the component includes a streaming data processor configured to process data from an intake ingestion buffer and provide results to an output ingestion buffer, wherein the output ingestion buffer makes the results available to at least one of an intake system or a query system.

15. The method of claim 1 , wherein the component includes a plurality of containerized indexing nodes to process the raw machine data and generate the events.

16. The method of claim 1 , wherein the component includes a plurality of containerized search nodes to process the events and return query results.

17. The method of claim 1 , wherein the events are stored in common storage.

18. The method of claim 1 , wherein the events are stored in S3 storage.

19. The method of claim 1 , wherein the events are stored in one or more time series buckets.

20. A computing system of a data intake and query system, the computing system comprising:
memory; and
one or more processing devices coupled to the memory and configured to:
receive, from a computing device associated with a user, a first request via a first application programming interface (API) to access the data intake and query system,
wherein the first API enables interactions with the data intake and query system,
wherein the data intake and query system enables at least one of generating or searching events, each event including a portion of raw machine data associated with a timestamp, and
wherein the raw machine data reflects activity in an information technology environment;

performing a first authentication of the user by verifying that the user is authorized to access the data intake and query system, wherein performing the first authentication comprises communicating credentials of the user to an external authentication system;
receive, from the computing device associated with the user, a second request, via the first API, for a component of the data intake and query system;
based at least in part on a determination that the user is authorized to access the data intake and query system, translate the second request based on a second API, wherein the second API enables interactions with the component of the data intake and query system, and wherein the component of the data intake and query system performs a second authentication of the user by verifying that the user is authorized to access the component of the data intake and query system, wherein performing the second authentication comprises communicating the credentials of the user to the external authentication system; and
communicate the seco

Assignees

• Splunk Inc

Inventors

• Batsakis Alexandros
• Gordon Clifton
• Lovering Brad
• Pride Christopher Madden

Classifications

• G06F2209/5015

  Service provider selection · CPC title

• G06F2221/2111

  Location-sensitive, e.g. geographical location, GPS · CPC title

• G06F21/31

  User authentication · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• G06F40/205

  Parsing · CPC title