Storage Virtualization Trusted Delegate Kerberos Delegation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Storage virtualization systems fail to maintain seamless user access to data after migration, as they often cannot authenticate with third-party servers, leading to disrupted access and the need for manual user notification during server maintenance.
Innovation Solution
Designating the storage virtualization system as a trusted delegate, allowing it to authenticate and forward user requests transparently, using Kerberos protocol and constrained delegation to ensure seamless redirection and access to the second server without disrupting user access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is migrated from the first server to the second server using a storage virtualization system, then user access to migrated data should be maintained transparently, but user access privileges may not migrate when the first server requires user account authentication by a third party
Solution Approach 1:
The storage virtualization system acts as an intermediary between the client and the second server, obtaining Kerberos tickets from the domain controller and using them to authenticate with the second server on behalf of the user. This intermediary approach allows the system to maintain transparent access while handling the authentication complexity internally, resolving the contradiction between access continuity and authentication complexity.
2Ease of operation
If the storage virtualization system performs transparent re-direction, then users do not notice any disruption when accessing the server, but the storage virtualization system may not have been authenticated for access to the migrated data on the second server
Solution Approach 1:
The storage virtualization system performs preliminary authentication by obtaining Kerberos tickets from the domain controller before accessing the second server. This preliminary action ensures that the system is authenticated and authorized to access migrated data transparently, resolving the contradiction between ease of operation and authentication capability.
3Reliability
If manual user notification is required during server maintenance, then administrators can inform users of access changes, but seamless access and transparency are disrupted
Solution Approach 1:
The storage virtualization system automatically handles authentication and re-direction without requiring manual user notification. The system services itself by obtaining Kerberos tickets and performing transparent re-direction to the second server, eliminating the need for administrator intervention and maintaining continuous transparent access, thus resolving the contradiction between access transparency and notification time.
Data Source
AI summary
The invention is a system and method for ensuring that a storage virtualization system performs as a trusted delegate for a user attempting to access data on an authenticated server. Data is moved from a first server to a second server by a storage virtualization system. Even though the user may have been authenticated to access the first server, the storage virtualization system which re-directs user requests to the migrated data on the second server may not be authenticated. The first time a user is re-directed to the second server, the storage virtualization system will obtain request to act as a trusted delegate for the user by communicating with a third server, such as a Kerberos domain controller. After the storage virtualization system is properly authenticated as a trusted delegate for the user, future re-directed requests will be seamless and transparent to the user.