Disconnected credential validation using pre-fetched service tickets

An apparatus to validate login credentials, the apparatus comprising:

• a computer processor;
• a ticket pre-fetch module comprising computer-executable instructions that cause the processor to obtain a Kerberos user service ticket from a Kerberos server, wherein the Kerberos user service ticket identifies a login device as a principal and a user as a service provider and comprises an encrypted portion with identification information about the user that is used to subsequently authenticate the user;
• a ticket cache configured to pre-cache the Kerberos user service ticket for subsequent authentication of the user;
• and
• an authentication module comprising computer-executable instructions that cause the processor to:
• receive an authentication request at the login device for the user subsequent to pre-caching of the Kerberos user service ticket in the ticket cache, the authentication request comprising one or more login credentials of the user,
• determine whether the Kerberos server is available, and
• in response to determining that the Kerberos server is unavailable, authenticate the user with the Kerberos user service ticket by at least decrypting the Kerberos user service ticket and comparing the identification information about the user stored in the Kerberos user service ticket with one or more login credentials of the user.

A tangible computer storage device having encoded thereon a plurality of computer-executable instructions that, when combined with computer hardware capable of executing the instructions, create computer circuitry that performs operations defined by the computer-executable instructions, the computer-executable instructions comprising:

• a first set of computer-executable instructions that causes the computer hardware to receive a first service ticket for a login device from an authentication server prior to receiving a login request of a user, wherein the first service ticket identifies the login device as a principal and the user as a service provider and the first service ticket further comprises an encrypted portion with identification information about the user that is used to subsequently authenticate the user;
• a second set of computer-executable instructions that causes the computer hardware to pre-cache the first service ticket in a ticket cache;
• a third set of computer-executable instructions that causes the computer hardware to receive a login request with the login device from the user to access a service subsequent to said pre-caching of the first service ticket, the login request from the user comprising a login credential;
• a fourth set of computer-executable instructions that causes the computer hardware to attempt to obtain a second service ticket from the authentication server in response to receiving the login request from the user;
• and
• a fifth set of computer-executable instructions that causes the computer hardware, in response to failing to receive the second service ticket, to authenticate the user by comparing information in the first service ticket stored in the ticket cache with the login credential.