Cross-Domain Authentication With Identity Resolution for NFS Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network file system (NFS) implementations face challenges in securely authenticating users with multiple identity providers due to missing or format-mismatched identity parameters, leading to access failures for private files.
Innovation Solution
A computer-program product that includes a non-transitory machine-readable storage medium with instructions to receive authentication responses, obtain identity and authorization attributes, generate unique user and group identifiers, and execute operations to modify files securely, using a session initiation token to manage access and version control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the NFS server uses multiple identity providers with different identity parameters, then the system can support more authentication sources, but authentication failures occur when parameters are missing or format-mismatched
Solution Approach 1:
The patent introduces an identity resolution service as an intermediary between the NFS server and multiple identity providers. This service receives authentication requests, resolves identity parameters from different providers into a unified format, and returns standardized credentials to the NFS server, thereby enabling multi-provider support while maintaining authentication reliability
Solution Approach 2:
The identity resolution service transforms identity parameters from various formats used by different identity providers into a standardized format required by the NFS server. This parameter transformation ensures that authentication requests meet the server's requirements regardless of the source provider
2Reliability
If the NFS server strictly validates identity parameters against configured formats, then authentication security is maintained, but legitimate users from providers with parameter format variations are rejected
Solution Approach 1:
The identity resolution service acts as a buffer that decouples the strict validation requirements of the NFS server from the varied parameter formats of identity providers. It performs format normalization before submission to the server, allowing the server to maintain its security validation while accepting credentials from diverse providers
3Reliability
If the system generates unique user identifiers and manages session tokens for each user, then secure access control is enabled, but system complexity increases
Solution Approach 1:
The identity resolution service automatically generates unique user identifiers and session tokens based on resolved identity attributes, and manages the mapping between original credentials and internal identifiers. This automation enables secure access control without requiring manual configuration or complex management overhead
Data Source
AI summary
A system, method, and computer-program product includes receiving, from a third-party identity management system, an authentication response indicating a set of login attributes; obtaining, from an identity resolution service, a set of identity and authorization attributes using the set of login attributes, the set of identity and authorization attributes including a unique user identifier (UID); granting, by the identity resolution service, a session initiation token when the set of identity and authorization attributes satisfy predefined authorization criteria; in response to the identity resolution service granting the session initiation token: allocating a compute session and a persistent storage resource to the unique UID; executing, via the compute session, an operation that modifies files stored in the persistent storage resource; and transmitting, to a version control system, a version control operation that records the files modified in the persistent storage resource to a code repository using the unique UID or group identifiers.