A flexible interface to authentication services in a distributed data processing system

Claim 1

A system having means for authenticating a requester, at a first node, of a service running at a second node, wherein the requester and the service are connected by a means of communication in a distributed data processing system, the system comprising: means for constructing authentication information by a facility, supporting an authentication policy, separate from the requester; and means for determining, at the second node, from the constructed authentication information, an authentication of the requester.

Claim 2

A system having means for authenticating a requester, at a first node, of a service running at a second node, wherein the requester and the service are connected by a means of communication in a distributed data processing system, the system comprising: means for constructing authentication information by a facility, supporting an authentication policy, separate from the requester; and means for determining, at the second node, from the constructed authentication information, an authentication of the requester.

Claim 5

A system having means for authenticating a requester, at a first node, of a service running at a second node, wherein the requester and the service are connected by a means of communication in a distributed data processing system, the system comprising: means for constructing authentication information and an authentication acknowledgement by a facility, supporting an authentication policy, separate from the requester; means for sending, by the requester, the authentication information to the service running at the second node; means for processing the sent authentication information at a second facility, supporting the authentication policy, at the second node separate from the service; means for acquiring, by the service, an outcome of the processing for determining a first authentication of the requester and a second authentication acknowledgement; means for receiving, by the requester, the second authentication acknowledgement; and means for comparing, by the requester, the first authentication acknowledgement and the second received authentication acknowledgement for determining a second authentication of the service.

Claim 6

A system having means for authenticating a requester, at a first node, of a service running at a second node, wherein the requester and the service are connected by a means of communication in a distributed data processing system, the system comprising: means for constructing authentication information and an authentication acknowledgement by a facility, supporting an authentication policy, separate from the requester; means for sending, by the requester, the authentication information to the service running at the second node; means for processing the sent authentication information at a second facility, supporting the authentication policy, at the second node separate from the service; means for acquiring, by the service, an outcome of the processing for determining a first authentication of the requester and a second authentication acknowledgement; means for receiving, by the requester, the second authentication acknowledgement; and means for comparing, by the requester, the first authentication acknowledgement and the second received authentication acknowledgement for determining a second authentication of the service.

Claim 7

A system as claimed in any preceding claim, further comprising means for replacing the current separate facility with a different separate facility supporting a different implementation of the authentication policy.

Claim 8

A system as claimed in any of claims 1 to 4, further comprising means for replacing the current separate facility with a different separate facility supporting a different authentication policy.

Claim 9

A system as claimed in any preceding claim, wherein the requester is a process running for a user on an operating system at the first node and the separate facility is a daemon process.

Claim 11

A system as claimed in any of claims 1 to 6, wherein the requester is a process running on an operating system at the first node and the separate facility is accessible by at least one other process running on the operating system. means for constructing authentication information and an authentication acknowledgement by a facility, supporting an authentication policy, separate from the requester; means for sending, by the requester, the authentication information to the service running at the second node; means for processing the sent authentication information at a second facility, supporting the authentication policy, at the second node separate from the service; means for acquiring, by the service, an outcome of the processing for determining a first authentication of the requester and a second authentication acknowledgement; means for receiving, by the requester, the second authentication acknowledgement; and means for comparing, by the requester, the first authentication acknowledgement and the second received authentication acknowledgement for determining a second authentication of the service.

Claim 12

A method for authenticating a requester, at a first node, of a service running at a second node, wherein the requester and the service are connected by a means of communication in a distributed data processing system, the method comprising: constructing authentication information by a facility, supporting an authentication policy, separate from the requester; and determining, at the second node, from the constructed authentication information an authentication of the requester.

Claim 13

A method for authenticating a requester, at a first node, of a service running at a second node, wherein the requester and the service are connected by a means of communication in a distributed data processing system, the method comprising: constructing authentication information by a facility, supporting an authentication policy, separate from the requester; and determining, at the second node, from the constructed authentication information an authentication of the requester.

Claim 16

A method for authenticating a requester, at a first node, of a service running at a second node, wherein the requester and the service are connected by a means of communication in a distributed data processing system, the method comprising: constructing authentication information and an authentication acknowledgement by a facility, supporting an authentication policy, separate from the requester; sending, by the requester, the authentication information to the service running at the second node; processing the sent authentication information at a second facility, supporting the authentication policy, at the second node separate from the service; acquiring, by the service, an outcome of the processing for determining a first authentication of the requester and a second authentication acknowledgement; receiving, by the requester, the second authentication acknowledgement; and comparing, by the requester, the first authentication acknowledgement and the second received authentication acknowledgement for determining a second authentication of the service.

Claim 17

A method for authenticating a requester, at a first node, of a service running at a second node, wherein the requester and the service are connected by a means of communication in a distributed data processing system, the method comprising: constructing authentication information and an authentication acknowledgement by a facility, supporting an authentication policy, separate from the requester; sending, by the requester, the authentication information to the service running at the second node; processing the sent authentication information at a second facility, supporting the authentication policy, at the second node separate from the service; acquiring, by the service, an outcome of the processing for determining a first authentication of the requester and a second authentication acknowledgement; receiving, by the requester, the second authentication acknowledgement; and comparing, by the requester, the first authentication acknowledgement and the second received authentication acknowledgement for determining a second authentication of the service.

Claim 18

A method as claimed in any of Claims 10 to 13, further comprising replacing the first separate facility and the second separate facility with different separate mechanisms supporting a different authentication policy.

Claim 19

A method for use on a first data processing system having means for requesting, by a process at the first data processing system, a service at a second data processing system connected to the first data processing system through a means of communication, the method comprising: sending a message to a replaceable facility, supporting an authentication policy, separate from the requesting process, to initiate authentication by constructing authentication information; and sending, unaware of the contents of the constructed authentication information, the constructed authentication information, with a request to use the service, to the service for becoming authenticated to use the service.

Claim 20

A method for use on a first data processing system having means for requesting, by a process at the first data processing system, a service at a second data processing system connected to the first data processing system through a means of communication, the method comprising: sending a message to a replaceable facility, supporting an authentication policy, separate from the requesting process, to initiate authentication by constructing authentication information; and sending, unaware of the contents of the constructed authentication information, the constructed authentication information, with a request to use the service, to the service for becoming authenticated to use the service.

Claim 22

A method for use on a second data processing system having means for receiving a request, from a process at the first data processing system, for a service, the second data processing system connected to the first data processing system through a means of communication, the method comprising: sending authentication information, received from the process, to a replaceable facility, supporting an authentication policy, separate from the service, for an interpretation of the authentication information and a construction of a plurality of authentication credentials; receiving the constructed credentials from the separate facility; performing an operation on the request based on the received credentials; and returning to the requesting process a result of the operation and the authentication acknowledgement received from the separate facility.

Claim 23

A method for use on a second data processing system having means for receiving a request, from a process at the first data processing system, for a service, the second data processing system connected to the first data processing system through a means of communication, the method comprising: sending authentication information, received from the process, to a replaceable facility, supporting an authentication policy, separate from the service, for an interpretation of the authentication information and a construction of a plurality of authentication credentials; receiving the constructed credentials from the separate facility; performing an operation on the request based on the received credentials; and returning to the requesting process a result of the operation and the authentication acknowledgement received from the separate facility.

Claim 24

A method for use with at least one data processing system, the method comprising: receiving a message from a process to initiate authentication of the process in response to a request by the requesting process to use a service of a different process; constructing authentication information and an authentication acknowledgement from requester information and service information found in the received message; sending the constructed authentication information and the authentication acknowledgement to the requesting process; receiving the constructed authentication information from the service; constructing a plurality of credentials from the received authentication information for the service and a second authentication acknowledgement; and sending the constructed credentials and the authentication acknowledgement to the service.

Claim 25

A method for use with at least one data processing system, the method comprising: receiving a message from a process to initiate authentication of the process in response to a request by the requesting process to use a service of a different process; constructing authentication information and an authentication acknowledgement from requester information and service information found in the received message; sending the constructed authentication information and the authentication acknowledgement to the requesting process; receiving the constructed authentication information from the service; constructing a plurality of credentials from the received authentication information for the service and a second authentication acknowledgement; and sending the constructed credentials and the authentication acknowledgement to the service.