Data processing: database and file management or data structures – Database design – Data structure types
Reexamination Certificate
1998-05-14
2002-01-08
Amsbury, Wayne (Department: 2171)
Data processing: database and file management or data structures
Database design
Data structure types
C707S793000, C707S793000
Reexamination Certificate
active
06338064
ABSTRACT:
BACKGROUND OF THE INVENTION
1. Technical Field
The present invention relates generally to Web transaction processing and more particularly to enabling access to protected files (e.g., Web documents) stored in a secure distributed file system.
2. Description of the Related Art
The World Wide Web of the Internet is the most successful distributed application in the history of computing. In the Web environment, client machines effect transactions to Web servers using the Hypertext Transfer Protocol (HTTP), which is a known application protocol providing users access to files (e.g., text, graphics, images, sound, video, etc.) via a standard page description language known as Hypertext Markup Language (HTML). HTML provides basic document formatting and allows the developer to specify “links” to other servers and files. In the Internet paradigm, a network path to a server is identified by a so-called Uniform Resource Locator (URL) having a special syntax for defining a network connection. Use of an HTML-compatible browser (e.g., Netscape Navigator or Microsoft Explorer) at a client machine involves specification of a link via the URL. In response, the client makes a request to the server identified in the link and receives in return a document formatted, for example, according to HTML.
Many business organizations and other entities now desire to integrate Web transaction processing into their distributed computing environment in which users access distributed resources and process applications. A known distributed computing environment, called DCE, has been implemented using “open” software conforming to standards implemented from time-to-time by the Open Group (f/k/a the Open Systems Foundation (OSF)). As DCE environments become more popular, many applications may be utilized to provide distributed services such as data sharing, printing services and database access. Open Group DCE includes a distributed file system, called Distributed File Services (DFS), for use in these environments.
DFS provides many advantages over a standalone file server, such as higher availability of data and resources, the ability to share information throughout a very large-scale system, and protection of information by the robust DCE security mechanism. In particular, DFS makes files highly available through replication, making it possible to access a copy of a file if one of the machines where the file is located goes down. DFS also brings together all of the files stored in various file systems in a global namespace. Multiple servers can export their file system to this namespace. All DFS users, in the meantime, share this namespace, making all DFS files readily available from any DFS client machine.
It would be highly desirable to extend the functionality of existing standalone Web servers in the enterprise environment to take advantage of the scalability, file availability and security features of DFS (or other similar distributed file systems). As a by-product, users with an off-the-shelf browser would be able to easily access the Web information stored in the DFS namespace with no additional software on the client machine.
This goal, however, cannot be readily achieved, especially with respect to client-server based systems running a “closed” native operating system such as Microsoft Windows NT. Because of the “closed” nature of Windows NT, a user of a client machine running this operating system may only log on against an account held at the machine, at a server running the Windows NT operating system, or at any other servers that are “trusted” by the NT server that the client is configured against. Only these options are supplied to the user during the logon process, and there are no practical interfaces to allow user authentication from non-native server domains. This closed architecture eliminates the ability of the Web server to impersonate a user of Windows NT client machine to access a protected DFS file or resource.
A method of obtaining a DCE credential and making that credential available to a Netscape server process prior to accessing a file within a DFS filespace has been described in U.S. Pat. No. 5,918,228 to Rich et al. That application is entitled “Method And Apparatus For Enabling A Web Server To Impersonate A User Of A Distributed File System To Obtain Secure Access To Supported Web Documents” and is assigned to the assignee of this application. The method described in this patent, however, does not work when the server process is supported on a Windows NT platform.
This invention addresses and solves that problem.
BRIEF SUMMARY OF THE INVENTION
A specific object of this invention is to provide a “Windows NT” method for enabling a Web server to impersonate a user of a Web client machine to obtain access to a file protected within a secure distributed file system.
Another object of this invention is to respond to a Web client browser request by setting up a temporary NT user identity with proper DCE credentials and then impersonating that NT user identity on a Web server thread which is attempting to access the requested resource.
A more general object of this invention is to authenticate native operating system (e.g., Windows NT) users accessing a distributed file system through an Internet World Wide Web server.
It is a further general object of this invention to provide a authentication scheme to facilitate secure Web document access from a distributed file system.
It is yet another object of the invention to implement a Windows NT operating system-based authentication scheme for Web server applications to enable the Web server to impersonate a Web client browser user to a secure file system.
It is another objective of the invention to integrate a security mechanism provided by a Web Server with conventional DFS security. This enables the functionality of existing standalone Web servers to be enhanced in the enterprise environment to take advantage of the scalability, file availability and security features of DFS (or other similar distributed file systems). As a by-product, users with an off-the-shelf browser are able to easily access the Web information stored in the DFS namespace, typically with no additional software on the client machine.
The invention preferably is implemented in a plug-in or other application executed by the Web server. The plug-in component has associated therewith a session manager control process and a session manager process, each of which preferably are created by the server plug-in component when the Web server initializes. During its initialization, the session manager control process calls Windows NT APIs to create a pool of temporary NT user identities (and their NT logon passwords) for use by the session manager process. When a browser user attempts to access a DFS file from a Windows NT system running the Web server and the server plug-in, the plug-in component prompts the browser user for a DCE user id and password. When the plug-in component receives this input, it invokes the session manager process in an attempt to acquire the credentials of that DCE user. In particular, the session manager process obtains an unused NT user identity from the pool and marks it as “in use”. It then invokes DCE security API's necessary to perform a “programmatic” dce_login. These API's create a DCE credential file for the DCE user and return the path specification of the file.
When the server thread then invokes the DFS file system to access the DFS file requested by the browser user, the Windows NT registry is interrogated to learn whether the NT user identity of this thread has any associated DCE credentials. Access to the DFS file is granted or denied accordingly. When the server thread again returns to the plug-in (after returning the requested file), the plug-in code calls a session manager API to “release” the NT user identity that had been used to service the browser request. Returning the NT user identity back to the “pool” makes the identity available for the processing of future requests.
The foregoing has outlined some of the more pertin
Ault Michael Bradford
Child Garry L.
London Shrader Theodore Jack
Plassmann Ernst Robert
Rich Bruce Arland
Amsbury Wayne
Burwell Joseph R.
Judson David
LaBaw Jeffrey S.
Pardo Thuy
LandOfFree
Method for enabling a web server running a... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Method for enabling a web server running a..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Method for enabling a web server running a... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2817884