User authentication using kerberos with identity cloud service

A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to authenticate a user, the authenticate comprising:

• receiving, at a microservice of a multi-tenant cloud based authentication system, from a Kerberos key distribution center (KDC) server, a request to authenticate the user, the request comprising a user identification (ID);
• retrieving at the multi-tenant cloud based authentication system a user record corresponding to the user ID, the user record comprising a principal key;
• decrypting at the multi-tenant cloud based authentication system the principal key using a tenant-specific encryption key;
• encrypting at the multi-tenant cloud based authentication system the decrypted principal key using a Kerberos master key to generate an encrypted principal key;
• retrieving at the multi-tenant cloud based authentication system a password policy corresponding to the user ID;
• based on the retrieved password policy, constructing at the multi-tenant cloud based authentication system password state attributes;
• returning to the KDC server the encrypted principal key, the password policy and the password state attributes;
• and
• enforcing the password policy at the multi-tenant cloud based authentication system, wherein the password policy is also enforced at the KDC server.

A system for authentication of a user, the system comprising:

• a plurality of tenants;
• a plurality of microservices;
• and
• one or more processors that:
• receive, at a microservice of a multi-tenant cloud based authentication system, from a Kerberos key distribution center (KDC) server, a request to authenticate the user, the request comprising a user identification (ID);
• retrieve at the multi-tenant cloud based authentication system a user record corresponding to the user ID, the user record comprising a principal key;
• decrypt at the multi-tenant cloud based authentication system the principal key using a tenant-specific encryption key;
• encrypt the decrypted principal key using a Kerberos master key to generate an encrypted principal key;
• retrieve at the multi-tenant cloud based authentication system a password policy corresponding to the user ID;
• based on the retrieved password policy, construct at the multi-tenant cloud based authentication system password state attributes;
• return to the KDC server the encrypted principal key, the password policy and the password state attributes;
• and
• enforcing the password policy at the multi-tenant cloud based authentication system, wherein the password policy is also enforced at the KDC server.