Proxy Server Password Policy Enforcement in Distributed Directory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed directory environments, existing systems fail to effectively enforce password policies across multiple backend servers, leading to inconsistent policy enforcement, outdated operational attributes, and lack of support for passing password policy controls from backend to client.
Innovation Solution
The proxy server is enhanced to support the passing of password policy controls from backend servers to clients, ensuring all compare operations for a single user are directed to the same backend server, and enforcing password policies through pre-bind and post-bind extended operations, including checking for account locks and expired passwords.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a distributed directory environment uses multiple backend servers to store directory information, then the system scalability and availability are improved, but consistent password policy enforcement becomes difficult to maintain
Solution Approach 1:
The patent introduces a proxy server as an intermediary component between clients and backend directory servers. The proxy server receives password policy request controls from clients, forwards them to the appropriate backend server, receives response controls, and returns them to clients. This intermediary ensures consistent password policy enforcement across all backend servers by centralizing the policy decision logic and maintaining a unified view of password policy state, thereby resolving the contradiction between system scalability and policy enforcement consistency.
2Device complexity
If password policy controls are not passed from backend servers to clients, then the system complexity is reduced, but clients cannot receive accurate policy error and warning information
Solution Approach 1:
The patent implements a feedback mechanism through password policy request controls and response controls. Clients send request controls to the proxy server, which forwards them to backend servers. The backend servers return response controls containing policy error and warning information to the proxy server, which then passes this information back to clients. This feedback loop ensures that clients receive accurate policy information without requiring complex direct communication protocols with backend servers, thus resolving the contradiction between system complexity and information completeness.
3Productivity
If compare operations for password are directed to different backend servers, then load distribution is improved, but operational attributes become outdated and inconsistent
Solution Approach 1:
The patent segments the password policy enforcement process into distinct phases: pre-bind processing and post-bind processing. Pre-bind processing includes checking account lock status and retrieving password policy information. Post-bind processing includes updating failed login counters and resetting operational attributes. By segmenting these operations and directing them to appropriate backend servers through the proxy server, the system maintains load distribution while ensuring operational attributes remain accurate and consistent across all servers.
Data Source
AI summary
The invention describes techniques for enforcing password policy within a distributed directory environment that includes one or more distributed directory servers and a proxy server that acts as an intermediate agent between a client and the distributed directory environment. In one aspect, the proxy server is enhanced to support the passing (from the backend server to the client) of password policy controls. In particular, controls returned from a backend server are parsed and cached (for re-use) for the life of a given client connection. According to another aspect, the proxy server ensures that all compare operations for a single user's password are directed to the same backend server in the distributed directory environment. This insures that a user's most current password is used, and that failed operation counts, resets and operational attributes are up-to-date. According to still another aspect, the proxy server enforces password policy on bind plug-ins and, in particular, through a pair of pre-bind and post-bind extended operations. In particular, pre-bind processing includes checking if an account is locked. Post-bind processing includes checking for expired passwords, grace logins and updating failed/successful bind counters.