Method and apparatus for transmitting additional authorization data via gssapi

A system for enabling an authorization process to provide extended authorization for use by a first computer through a security context established through a client-server connection comprising:

• a generic security service application program interface (GSSAPI) and a server process running on a second computer, said GSSAPI configured to submit credentials from security tokens received by said server process from said first computer and confirm authentication and authorization for a security context based on said security token for said server process to send to said first computer;
• a module configured to intercept a security token received from said first computer, remove any non-operating-system authorization data added to said security token by said first computer, pass said non-operating-system authorization data to an authorization process running on said second computer pass said security token without said non-operating-system authorization data to said GSSAPI process;
• said GSSAPI further configured to use said passed security tokens for authentication and authorization and confirm said authentication and authorization for said server process;
• said authorization process configured to provide extended authorization for said security context based on said removed non-operating-system authorization data.

A method for enabling an authorization process to provide extended authorization for a security context for a client-server connection for a first computer comprising:

• requesting a security token for a server process running on a second computer via a generic security service application program interface (GSSAPI), said GSSAPI creating a security token for a client process running on said first computer to send to said server process;
• intercepting the security token created by said GSSAPI,
• querying an authorization process for non-operating-system authorization data from said authorization process to be added to said security token
• returning said security token with said added data to said client process;
• requesting a security context using said security token with said added data from said server process running on said second computer.

A method for enabling an authorization process to provide extended authorization for use by a first computer through a security context established through a client-server connection comprising:

• receiving by a server process a security context request including security tokens from said first computer;
• said server process submitting said received security token for authentication and authorization;
• intercepting said security token;
• removing any non-operating-system authorization data added to said security token by said first computer;
• passing said non-operating-system authorization data to an authorization process running on said second computer;
• passing said security token without said non-operating-system authorization data to a GSSAPI process;
• said GSSAPI submitting said passed security token for authentication and authorization and confirming said authentication and authorization for said server process;
• said authorization process providing extended authorization for said security context based on said removed non-operating-system authorization data.