Method and apparatus for enabling a web server to impersonate a user of a distributed file system to obtain secure access to supported web documents

A method operative during a stateless Web transaction for enabling a Web server to impersonate a Web client to obtain access to Web documents stored in a distributed file system of a stateful distributed computing environment, the distributed computing environment including a security service for returning a credential to a user authenticated to access the distributed file system, comprising the steps of:

• maintaining a storage of the credentials of the users authenticated to access the distributed file system;
• responsive to receipt of a user id and password from the Web client during a Web transaction, determining whether the user id and password map into one of the credentials maintained in the storage;
• if the user id and password map into one of the credentials maintained in the storage, having the Web server reuse authentication information in the credential associated with the user id and password to retrieve a file in the distributed file system on behalf of the Web client;
• and
• upon logging of the Web transaction, temporarily inhibiting the Web server from using the authentication information until a next Web transaction by the user.

A computer program product in a computer readable medium for use in a computer during a stateless Web transaction to enable a Web server to impersonate a Web client and obtain access to Web documents stored in a distributed file system of a stateful distributed computing environment, the distributed computing environment including a security service for returning a credential to a user authenticated to access the distributed file system, the computer program product comprising:

• means for maintaining a storage of the credentials of the users authenticated to access the distributed file system;
• means responsive to receipt of a user id and password from the Web client during a Web transaction, for determining whether the user id and password map into one of the credentials maintained in the storage;
• means responsive to the determining means for controlling the Web server to reuse authentication information in the credential associated with the user id and password to retrieve a file in the distributed file system on behalf of the Web client;
• and
• means responsive to logging of the Web transaction for temporarily inhibiting the Web server from using the authentication information until a next Web transaction by the user.

A computer connectable to a stateful distributed computing environment having a distributed file system service and a security service for returning a credential to a user authenticated to access the distributed file system, the computer comprising:

• a processor;
• an operating system;
• a Web server program for providing Web information retrieval to Web clients connectable to the Web server program via a stateless computer network;
• a session manager program for maintaining a storage of the credentials of the users previously authenticated to access the distributed file system;
• and
• a server plug-in program responsive to receipt of a user id and password from the Web client during a Web transaction (a) for determining whether the user id and password map into one of the credentials maintained in the storage, (b) for controlling the Web server to reuse authentication information in the credential associated with the user id and password to retrieve a file in the distributed file system on behalf of the Web client;
• and (c) for inhibiting the Web server from using the authentication information after the Web transaction is complete and until a next Web transaction is initiated to the distributed file system from a user having the user id and password.

A method operative during a stateless transaction for enabling a process to impersonate a user, the process connectable to a stateful environment having a security service for returning a credential to a user authenticated to access a service in the environment, comprising the steps of:

• responsive to receipt of an account name, logging in the account name to the security service to produce a user id, password, ticket and ticket expiration;
• storing the user id, password, ticket and ticket expiration for reuse;
• during a stateless transaction and responsive to receipt of a user id and password, checking to determine if the ticket has expired;
• if the ticket has not expired, installing an authorization into the process to enable the process to obtain the service from the environment on behalf of the user;
• and
• removing the authorization upon completion of the stateless transaction.

A method operative during a stateless Web transaction for enabling a Web server process to impersonate a Web client without change to the browser code used by the Web client, the Web server connectable to a stateful distributed computing environment having a distributed file system service and a security service for returning a credential to a user authenticated to access the distributed file system service, comprising the steps of:

• responsive to receipt of an account name, logging in the account name to the security service to produce a user id, password, ticket and ticket expiration;
• storing the user id, password, ticket and ticket expiration for reuse;
• responsive to receipt of a user id and password during a Web transaction, checking to determine if the ticket has expired;
• if the ticket has not expired, installing an authorization into the Web server to enable the process to retrieve a file from the distributed file system on behalf of the Web client;
• and
• upon logging of the Web transaction, removing the authorization from the Web server.