Abstract:
Method of authenticating a user in a heterogeneous computer environment. The method may include defining a set of unique prefixes, each prefix identifying a type of user repository; defining a set of abstract repository names, each abstract repository name identifying an address of a user repository; and authenticating the user in the heterogeneous computer environment by assigning a sequence comprising a unique prefix, a reference to an abstract repository name and a unique identifier for the user within the user repository indicated by the reference to the abstract repository name.

Description:
PRIORITY CLAIM 
     This application claims benefit of priority of European application no. EP 07 011 721.3 titled “Method And System For Authenticating A User”, filed Jun. 14, 2007, and whose inventors are Thomas Vogler, Dieter Kessler, Heiko Weber, and Johannes Viegener. 
     TECHNICAL FIELD 
     The present invention relates to a method for authenticating a user in a heterogeneous computer environment. 
     BACKGROUND OF THE INVENTION 
     A computer system typically requires a user to authenticate himself to the system. Authentication is a necessary technical precondition for any authorization of a user. Only if a computer system or a network of connected computer systems can authenticate a user, i.e. be sure about his identity, the user can be authorized to perform certain actions within the network, such as adding, modifying or removing data. 
     Before the time of the Internet, the user&#39;s identity was only used within a limited space, typically a single computer. One user repository (for example, one LDAP directory) was sufficient for authentication of all users of the single computer system. However, with the development of computer networks, the use of only a single user repository is no longer sufficient. Accordingly, concepts were developed for authentication in a whole computer environment comprising several computer systems. One example is Microsoft&#39;s current Active Directory model, wherein multiple domains are combined within one “forest”. In this concept, the indication of the domain name in front of the actual userid is sufficient for a unique identification. 
     However, most computer environments are nowadays no longer homogeneous but use instead hardware and software from a variety of vendors, which apply different authentication strategies. For example, a user may authenticate himself on a given Active Directory using MS programs as: 
     “euro\jdoe” 
     However, the same user, may authenticate himself on a UNIX system, which results in the following Id: 
     “en=John Doe,ou=users,ou=England,dc=euro, dc=company,dc=com” 
     Another example is Windows NT: Internally, users are represented by a SID (security identifier), which is a numeric value that can globally identify a user uniquely within a windows domain. The form of the SID that can be read by humans and processed also by non-Windows software looks like: 
     jdoe@myorg.com. 
     In the Lightweight Directory Access Protocol (LDAP), the LDAP directory is a centrally reachable service that maintains, among other entries, user entries. Any LDAP object is always represented by its position within the hierarchical tree: 
     “en=john doe, ou=userjo=eurjdc=mycomp,dc=org” 
     It is quite evident that there is no easy way to identify all of the above representations as actually referring to the same user. The above difficulties occur regardless of whether the user is a human or again a computer or an application, which accesses resources within the heterogeneous computer environment. 
     Such inconsistencies are particularly a problem, if tasks are delegated within a heterogeneous computer environment. To this end, credentials of a certain user are passed on in such a way that the recipient system must be able to recognize these credentials. Accordingly, it must be able to compare specific credentials with others and these credentials must be meaningful, and not just a blob of data. Only if the recipient understands the user credentials he can then take further authorization actions. Mapping one user id (of one part of the computer environment) to another resolves the issue only partly, since every mapping process leads to a loss of the information, namely, where a user may have authenticated himself for the first time in the overall computer environment. 
     Thus, in view of the above, improvements in authentication of users are desired. 
     SUMMARY OF THE INVENTION 
     Various embodiments for authenticating a user in a heterogeneous computer environment are provided below. 
     A method for authenticating a user in a heterogeneous computer environment may include:
     a. defining a set of unique prefixes, each prefix identifying a type of user repository;   b. defining a set of abstract repository names, each abstract repository name identifying an address of a user repository; and   c. authenticating the user in the heterogeneous computer environment by assigning a sequence comprising a unique prefix, a reference to an abstract repository name and a unique identifier for the user within the user repository indicated by the reference to the abstract repository name.   

     Accordingly, a unique authentication or naming scheme may be provided, which allows to identify the type and the origin of the user repository, which authenticated the user in the heterogeneous computer environment, wherein different rules can be specified for each type of repository. Based on the provided unique scheme identities of human or non-human users can be compared to verify, whether a certain user is correctly authenticated and authorized to perform requested actions. It is no longer a problem, if, for example, the credentials of one specific user are gathered through different authentication processes, but using the same underlying repository, since all ambiguities can be resolved using the defined authentication scheme. 
     Further, information about users can be freely exchanged, since all participants of the heterogeneous computer environment “speak the same language” with respect to the description of a user, which is in addition easily readable for a human. The latter is important, since modern communication protocols, such as XML (SOAP), require the usage of a printable (human readable) form. 
     In one embodiment, the set of unique prefixes comprises prefixes for at least one user repository type of the group comprising:
         Lightweight Directory Access Protocol Server (LDAP)   Windows Active Directory Server (ADS)   Security Authorization Function (SAF), in particular RACF, ACF2 or TopSecret.       

     Alternatively or additionally, the set of unique prefixes may comprise a prefix of a user repository of any native operating system. Since the type of user repository may be identified by the prefix, embodiments described herein may be fully flexible to authenticate users, which are managed by a repository that is later added to an already existing computer environment and applies rules, which are unknown to the rest of the environment. 
     Step b. may include defining an Abstract Repository Name Catalogue, which maps references to abstract repository names and to physical addresses. This catalogue may define a mapping between references, abstract repository names and the various real addresses (for example an IP-address, depending on the unique prefix). More than one physical address can be provided for a single abstract repository name, if the respective repository can be accessed using more than one transport protocol such as TCP/IP, SSL, HTTP, HTTPS etc. 
     In one embodiment, there may be more than one reference for a single abstract repository name, if the respective repository requires different addressing information when accessed from different locations in the environment. The Abstract Repository Name Catalogue can be implemented as a database. 
     The methods described herein may be implemented or executing according to computer program(s) stored in memory medium(s) of computer system(s), e.g., in a heterogeneous computer environment. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       In the following detailed description, a presently preferred embodiment is described with reference to the drawings, with the following figures: 
         FIG. 1 : A schematic representation of a heterogeneous computer environment in accordance with an embodiment; and 
         FIG. 2   a - c:  Three examples of strings for authenticating a user in the heterogeneous computer environment. 
     
    
    
     While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the drawings and detailed description thereto are not intended to limit the invention to the particular form disclosed, but on the contrary, the intention is to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the present invention as defined by the appended claims. 
     DETAILED DESCRIPTION 
       FIG. 1  presents a schematic representation of an exemplary computer environment comprising three clients  1 ,  3 ,  5  accessing an application  10 . In some embodiments, the exemplary computer environment of  FIG. 1  may be heterogeneous. For example, the clients  1 ,  3  and  5  and the application  10  may be running on different hardware platforms such as Windows servers, UNIX servers or mainframe systems (not shown in  FIG. 1 ) or use the same hardware but different operating systems. However, in some embodiments, the computer environment may be a homogeneous environment. 
     A user in the system of  FIG. 1  may be authenticated before here can perform any actions such as accessing the application  10 . To this end, there may be one or more different user repositories provided in the environment. The example of  FIG. 1  includes two repositories  20 ,  22 . User repository  20  may authenticate in step  100  the clients  1  and  3 ; user repository  22  may authenticate in step  102  client  5 . It is to be noted that the environment of  FIG. 1  is substantially simplified. In a real computer environment (and in envisioned embodiments) there might be hundreds of widely distributed repositories authenticating large numbers of clients. Thus, embodiments are not limited to the exemplary computer environment shown in  FIG. 1 . 
     The repositories  20 ,  22  in the embodiment of  FIG. 1  provide for each human or non-human user such as the clients  1 ,  3  and  5  a so-called User Principal Name (UPN). The UPN may specify in a prefix the type and in a further entry the actual user repository that was used to authenticate the credentials of a user. The authentication process can be performed in accordance with the specific rule of the respective repository  20 ,  22 . Due to the flexibility provided by the invention, there may be no need for harmonizing the authentication rules of the various repositories  22 ,  22  of the heterogeneous environment. Further, new repositories can be added to the environment, as needed. 
     This may be made possible by including abstract reference names (ARN) in the UPN. Such an ARN may uniquely identify a user repository and the required address information that must be used to communicate with the repository  20 ,  22  identified by the repository name. If the ARNs of two entities are not identical, they still may point to the same physical repository. 
     The list of all active ARNs may be stored in an ARN catalogue  30 , which may be accessible to all involved entities in the computer environment over the network. The ARN catalogue  30  can be implemented using a database  31 . As can be seen in  FIG. 1 , both, the clients  1 ,  3  and  5  as well as the application  10  can accesses the ARN catalogue  30 . Such an ARN catalogue  30  could be replicated in order to achieve high availability in the computer environment (not shown in  FIG. 1 ). 
     As mentioned above, there can be multiple reference names for a certain user repository. To find out if two different reference names refer to the same or two different repositories, the repository names that are stored in the ARN Catalogue can be compared. Using references in the UPN has the advantage that the actual repository can be changed without invalidating the UPN. Therefore, the address of the repository can be changed without requiring an adaptation of all UPNs, which results in a simplified management of the UPNs. Finally, the addressing information for the repository may not be put directly into the UPNs; instead, a symbolic name may be used. 
     As schematically shown in  FIG. 1 , the ARN catalogue  30  may be in a set of first steps  104  contacted by the clients  1 ,  3  and  5  in order to retrieve the alias name available for the current session. I.e. what is the current principal repository that is used for the authentication? This alias name  203  (cf.  FIG. 2  discussed below) will be used to compose the unique principal name. 
     Subsequently, the ARN catalogue  30  can in a step  108  be contacted by the application  10 , which needs to understand the user credentials forwarded by the clients  1 ,  3  and  5 , when requesting in step  106  a certain action from the application  10 . More precisely, the clients  1 ,  3  and  5  may include their UPNs in their requests  106 , which can then be verified by the application  10  contacting first the ARN catalogue  30  and then the respective user repository  20 ,  22 , respectively. 
     The UPN may include, in addition to the prefix and the reference, a so-called principalIdentifier. The principalIdentifier uniquely specifies a human or non-human user within a certain user repository. The syntax notation for the principalIdentifier depends on the above mentioned prefix, which may indicate a certain type of user repository. The rules how such a principalIdentifier is encoded, may be made available for any entity of the environment for each of the possible user repository types. 
       FIGS. 2   a - c  present four examples of UPN strings for authenticating a user using different user repositories. The UPN string itself may be represented for portability issues always in UTF-8 encoded Unicode. 
     In the example of  FIG. 2   a , the prefix  201  may indicate a LDAP user repository. The following reference  203  indicates a user repository “SouthEurope”. Using the ARN catalogue, any requesting entity can retrieve a physical address, where the referenced user repository can be found, for example a suitable IP address. The principalIdentifier  205 , finally, may identify a certain user in the referenced repository in accordance with the rules off a LDAP repository. 
     In the example of  FIG. 2   b , the prefix  201  indicates a user repository of an Active Directory Server of Microsoft. The reference  203  “AME” indicates a certain user repository of the ADS type, whereas the remaining principalIdentifier  205  identifies a certain user “JDoe” in the specifically referenced ADS repository AME. 
     The third example, finally, presents a UPN in accordance with an embodiment of the invention for a user authenticated by a Security Authorization Function as it may be used for IBM mainframes. Accordingly, the prefix  201  indicates this type of repository. The following reference  203  may allow for finding the user specific SAF repository, where the user “JFK” has authenticated. 
     The sequence of the various elements of the UPN, as shown in the strings of  FIGS. 2   a - 2  is only exemplary. The prefix, the reference and the principalIdentifier could be arranged in any order and be separated by any suitable delimiter. 
     It is apparent that  FIGS. 2   a - c  present only a selection of a possibly unlimited number of UPNs which can be created for any arbitrary type of user repository. Implementing the principles of the present invention, a user authenticated with any accessible user repository can be uniquely identified, without having to prescribe a single or a limited number of identification mechanisms. By contrast, any known or new type of user repository can be used and corresponding UPNs can be generated. 
     Further modifications and alternative embodiments of various aspects of the invention may be apparent to those skilled in the art in view of this description. Accordingly, this description is to be construed as illustrative only and is for the purpose of teaching those skilled in the art the general manner of carrying out the invention. It is to be understood that the forms of the invention shown and described herein are to be taken as embodiments. Elements and materials may be substituted for those illustrated and described herein, parts and processes may be reversed, and certain features of the invention may be utilized independently, all as would be apparent to one skilled in the art after having the benefit of this description of the invention. Changes may be made in the elements described herein without departing from the spirit and scope of the invention as described in the following claims.