Cloud Identity Provider Mediating Legacy Kerberos Tickets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The integration of on-premise applications with cloud computing services is challenging due to incompatibility between legacy authentication protocols used in domain-based networks and cloud-based authentication protocols, particularly when regulatory compliance restricts on-premise applications from being hosted in the cloud and when legacy protocols like Kerberos are not supported by cloud-based protocols such as OpenIdConnect (OIDC) and OAuth2.0.
Innovation Solution
A cloud-based identity provider generates a Kerberos security ticket upon successful authentication, which is embedded in an access token using the OAuth/OIDC protocol, allowing a client application or agent to extract and use this ticket for access to on-premise applications adhering to the legacy Kerberos protocol, thus enabling seamless authentication across different authentication protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cloud-based authentication protocol (OIDC/OAuth2.0) is used, then authentication security and cloud integration are improved, but compatibility with legacy authentication protocol (Kerberos) deteriorates
Solution Approach 1:
The patent introduces a cloud-based identity provider as an intermediary between the client application and the on-premise application. The identity provider receives authentication requests using modern OIDC/OAuth2.0 protocols, validates them, and then generates legacy Kerberos tickets that are compatible with the on-premise application's authentication system. This intermediary enables secure cloud-based authentication while maintaining compatibility with legacy systems.
Solution Approach 2:
The patent transforms the authentication protocol parameters by converting modern OIDC/OAuth2.0 authentication requests into legacy Kerberos authentication tickets. The identity provider changes the authentication mechanism from token-based cloud protocols to ticket-based legacy protocols, allowing the same authentication flow to serve both modern and legacy systems.
2Reliability
If on-premise application remains on-premise, then regulatory compliance is maintained, but integration with cloud computing service deteriorates
Solution Approach 1:
The cloud-based identity provider acts as a mediator that enables integration between cloud-based client applications and on-premise applications. The identity provider handles authentication requests from cloud clients and generates appropriate Kerberos tickets for on-premise applications, allowing seamless integration without moving the on-premise application to the cloud.
Solution Approach 2:
The identity provider provides universal authentication capabilities by supporting both cloud-based OIDC/OAuth2.0 protocols and legacy Kerberos protocols through a single service. This multi-functional authentication system enables both cloud-based and on-premise applications to authenticate users without requiring separate authentication systems.
3Adaptability or versatility
If legacy authentication protocol is used, then compatibility with on-premise application is maintained, but integration with cloud-based authentication service deteriorates
Solution Approach 1:
The identity provider serves as an intermediary that simplifies the authentication system by handling the complexity of protocol translation. Instead of modifying the legacy on-premise application to support modern protocols, the identity provider receives modern authentication requests and generates legacy Kerberos tickets, maintaining simplicity in the on-premise application while enabling cloud integration.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An identity provider of a cloud computing service provides authentication for on-premise applications that is subject to a legacy authentication protocol that differs from the cloud-based network authentication protocol used by the identity provider. The identity provider generates a security ticket for use to gain access to the on-premise application. The security ticket is embedded in a security token associated with a cloud-based network authentication protocol. A client application seeking access to the on-premise application extracts the embedded security ticket from the security token which is then used to access the on-premise application via a legacy authentication protocol.