# US 10,454,915 B2 · User authentication using kerberos with identity cloud service > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,915 B2 - Document ID: US10454915B2 - Status: Granted - Kind: B2 - Application number: 15/797,374 - Filed: 2017-10-30 - Published: 2018-11-22 - Granted: 2019-10-22 - Earliest claimed: 2017-05-18 - Assignees: Oracle International Corporation - Applicants: Oracle International Corporation - Inventors: Mohamad Raja Gani Mohamad Abdul; Gregg Wilson - Web page: https://patentgrep.com/patent/US10454915B2 ## CPC - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/12: Transmitting and receiving encryption devices synchronised or initially set up in a particular manner - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 9/3271: {using challenge-response} - H04L 9/3297: {involving time stamps, e.g. generation of time stamps} - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Embodiments authenticate a user in response to receiving from a Kerberos key distribution center (“KDC”) a request to authenticate the user that includes a user identification (“ID”). Embodiments retrieve a user record corresponding to the user ID, the user record including a principal key. Embodiments decrypt the principal key using a tenant-specific encryption key and encrypt the decrypted principal key using a Kerberos master key to generate an encrypted principal key. Embodiments retrieve a password policy corresponding to the user ID. Based on the retrieved password policies, embodiments construct password state attributes and return to the KDC the encrypted principal key, the password policy and the password state attributes. ## Claims ### Claim 1 A method of authentication of a user, the method comprising: receiving, at a microservice of a multi-tenant cloud based authentication system, from a Kerberos key distribution center (KDC) server, a request to authenticate the user, the request comprising a user identification (ID); retrieving at the multi-tenant cloud based authentication system a user record corresponding to the user ID, the user record comprising a principal key; decrypting at the multi-tenant cloud based authentication system the principal key using a tenant-specific encryption key; encrypting at the multi-tenant cloud based authentication system the decrypted principal key using a Kerberos master key to generate an encrypted principal key; retrieving at the multi-tenant cloud based authentication system a password policy corresponding to the user ID; based on the retrieved password policy, constructing at the multi-tenant cloud based authentication system password state attributes; returning to the KDC server the encrypted principal key, the password policy and the password state attributes; and enforcing the password policy at the multi-tenant cloud based authentication system, wherein the password policy is also enforced at the KDC server. ### Claim 2 (depends on 1) The method of claim 1, wherein the request to authenticate the user comprises acquiring an OAuth token. ### Claim 3 (depends on 2) The method of claim 2, wherein the OAuth token is configured to allow the user to access the multi-tenant cloud based authentication system using an application programming interface (API) call. ### Claim 4 (depends on 3) The method of claim 3, wherein the multi-tenant cloud based authentication system comprises a plurality of microservices, and the API call corresponds to an API for one of the microservices. ### Claim 5 (depends on 1) The method of claim 1, further comprising encoding the encrypted principal key using ASN.1. ### Claim 6 (depends on 1) The method of claim 1, wherein the user record is retrieved from a user principals repository. ### Claim 7 (depends on 1) The method of claim 1, wherein the request is received from a KDC plug-in. ### Claim 8 A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to authenticate a user, the authenticate comprising: receiving, at a microservice of a multi-tenant cloud based authentication system, from a Kerberos key distribution center (KDC) server, a request to authenticate the user, the request comprising a user identification (ID); retrieving at the multi-tenant cloud based authentication system a user record corresponding to the user ID, the user record comprising a principal key; decrypting at the multi-tenant cloud based authentication system the principal key using a tenant-specific encryption key; encrypting at the multi-tenant cloud based authentication system the decrypted principal key using a Kerberos master key to generate an encrypted principal key; retrieving at the multi-tenant cloud based authentication system a password policy corresponding to the user ID; based on the retrieved password policy, constructing at the multi-tenant cloud based authentication system password state attributes; returning to the KDC server the encrypted principal key, the password policy and the password state attributes; and enforcing the password policy at the multi-tenant cloud based authentication system, wherein the password policy is also enforced at the KDC server. ### Claim 9 (depends on 8) The computer readable medium of claim 8, wherein the request to authenticate the user comprises acquiring an OAuth token. ### Claim 10 (depends on 9) The computer readable medium of claim 9, wherein the OAuth token is configured to allow the user to access the multi-tenant cloud based authentication system using an application programming interface (API) call. ### Claim 11 (depends on 10) The computer readable medium of claim 10, wherein the multi-tenant cloud based authentication system comprises a plurality of microservices, and the API call corresponds to an API for one of the microservices. ### Claim 12 (depends on 8) The computer readable medium of claim 8, further comprising encoding the encrypted principal key using ASN.1. ### Claim 13 (depends on 8) The computer readable medium of claim 8, wherein the user record is retrieved from a user principals repository. ### Claim 14 (depends on 8) The computer readable medium of claim 8, wherein the request is received from a KDC plug-in. ### Claim 15 A system for authentication of a user, the system comprising: a plurality of tenants; a plurality of microservices; and one or more processors that: receive, at a microservice of a multi-tenant cloud based authentication system, from a Kerberos key distribution center (KDC) server, a request to authenticate the user, the request comprising a user identification (ID); retrieve at the multi-tenant cloud based authentication system a user record corresponding to the user ID, the user record comprising a principal key; decrypt at the multi-tenant cloud based authentication system the principal key using a tenant-specific encryption key; encrypt the decrypted principal key using a Kerberos master key to generate an encrypted principal key; retrieve at the multi-tenant cloud based authentication system a password policy corresponding to the user ID; based on the retrieved password policy, construct at the multi-tenant cloud based authentication system password state attributes; return to the KDC server the encrypted principal key, the password policy and the password state attributes; and enforcing the password policy at the multi-tenant cloud based authentication system, wherein the password policy is also enforced at the KDC server. ### Claim 16 (depends on 15) The system of claim 15, wherein the request to authenticate the user comprises acquiring an OAuth token. ### Claim 17 (depends on 16) The system of claim 16, wherein the OAuth token is configured to allow the user to access the multi-tenant cloud based authentication system using an application programming interface (API) call. ### Claim 18 (depends on 17) The system of claim 17, wherein the API call corresponds to an API for one of the microservices. ### Claim 19 (depends on 15) The system of claim 15, further comprising encoding the encrypted principal key using ASN.1. ### Claim 20 (depends on 15) The system of claim 15, wherein the request is received from a KDC plug-in.