Patent ID: 8738923

Claim:
A method of authenticating an end user for a client application using a directory service having an authentication control policy that tracks failed authentication attempts and allows lock out of an account after a predetermined number of failures, the method comprising: receiving, by a computer system executing the client application, end user identity information and security information at the client application from a front end application, wherein a hashing function has been applied to the security information by the front end application; sending, from the computer system executing the client application, a search request to the directory service for an entry associated with the end user identity information, the search request including at least some of the user identity information but not including the security information; receiving, by the computer system executing the client application, a authentication token from the directory service associated with the end user identity information, wherein the authentication token received from the directory service is generated by the same hashing function as applied to the security information by the front end application; comparing, by the computer system executing the client application, the received authentication token with the security information; if the authentication token matches the security information, sending, from the computer system executing the client application, a request to update the directory service to indicate that successful authentication of the end user has occurred; and if the authentication token does not match the security information, sending, from the computer system executing the client application, a request to update the directory service to indicate that a failed attempt at authentication of the end user has occurred.