Mechanism for utilizing kerberos features by an ntlm compliant entity
AssigneeMicrosoft Corporation
InventorsDavid Christiansen, Liqiang Zhu
Life of this patent
Estimating the term…
Abstract
NTLM compliant clients and servers are mutually authenticated in accordance with the Kerberos authentication protocol without migrating the clients or servers to Kerberos. With an RPC framework, a target name is generated from the server host name. The target name includes an indication that mutual authentication is to be accomplished. During the initial stages of the RPC session, the target name is sent to the server. If the server recognizes the target name, the client and server are mutually authenticated in accordance with the Kerberos protocol. If the server does not recognize the target name, the client is authenticated in accordance with the NTLM authentication protocol.
Claims20
An authentication method for authenticating at least one of a first entity and a second entity, the method comprising:
- receiving a first name indicative of the first entity;
- generating a second name indicative of the first entity, the second name comprising:
- an indication of the first name;
- and
- an indication of compatibility with a first authentication protocol;
- determining, utilizing the second name, if the first entity is compatible with the first authentication protocol;
- if the first entity is compatible with the first authentication protocol:
- registering the second name in accordance with the first authentication protocol;
- authenticating the first entity in accordance with the first authentication protocol;
- and
- authenticating the second entity in accordance with the first authentication protocol;
- and
- if the first entity is not compatible with the first authentication protocol:
- authenticating the second entity in accordance with a second authentication protocol.
An authentication system for authenticating at least one of a first entity and a second entity, the system comprising:
- a first application configure to:
- receive, from the second entity, a first name indicative of the first entity;
- generate a second name indicative of the first entity, the second name comprising:
- an indication of the first name;
- and
- an indication of compatibility with a first authentication protocol;
- and
- a second application configured to:
- determine, utilizing the second name, if the first entity is compatible with the first authentication protocol;
- if the first entity is compatible with the first authentication protocol:
- register the second name in accordance with the first authentication protocol;
- authenticate the first entity in accordance with the first authentication protocol;
- and
- authenticate the second entity in accordance with the first authentication protocol;
- and
- if the first entity is not compatible with the first authentication protocol:
- authenticate the second entity in accordance with a second authentication protocol.
A computer-readable medium having stored thereon computer-executable instructions for providing authentication of at least one of a first entity and a second entity, comprising the steps of:
- receiving a first name indicative of a first entity to be authenticated;
- generating a second name indicative of the first entity, the second name comprising:
- an indication of the first name;
- and
- an indication of a first authentication protocol;
- and
- determining if the first entity is compatible with the first authentication protocol;
- if the first entity is compatible with the first authentication protocol:
- registering the second name in accordance with the first authentication protocol;
- authenticating the first entity in accordance with the first authentication protocol;
- and
- authenticating the second entity in accordance with the first authentication protocol;
- and
- if the first entity is not compatible with the first authentication protocol:
- authenticating the second entity in accordance with a second authentication protocol.
Dependencies are inferred from the claim text.