MECHANISM OF COMMON AUTHENTICATION FOR BOTH SUPERVISOR AND GUEST CLUSTERS
This disclosure describes a computer implemented method for receiving authentication credentials identifying a user; identifying computing systems for which the user is authorized access to; and transmitting tokens granting access to the identified computing systems. In some embodiments, no two tokens of the transmitted tokens grants access to the same one of the identified computing systems. The user typically has access to a management tool configured to manage the transmission of the received tokens to the corresponding computing systems, thereby granting the user the ability to have seamless access to any of the computing systems associated with the user's authenticated identity.
Latest VMware, Inc. Patents:
- CLOUD NATIVE NETWORK FUNCTION DEPLOYMENT
- LOCALIZING A REMOTE DESKTOP
- METHOD AND SYSTEM TO PERFORM COMPLIANCE AND AVAILABILITY CHECK FOR INTERNET SMALL COMPUTER SYSTEM INTERFACE (ISCSI) SERVICE IN DISTRIBUTED STORAGE SYSTEM
- METHODS AND SYSTEMS FOR USING SMART NETWORK INTERFACE CARDS TO SECURE DATA TRANSMISSION OF DISAGGREGATED HARDWARE
- METHODS AND SYSTEMS FOR INTELLIGENT ROAMING USING RADIO ACCESS NETWORK INTELLIGENT CONTROLLERS
This application is a continuation of U.S. patent application Ser. No. 16/918,709, entitled “MECHANISM OF COMMON AUTHENTICATION FOR BOTH SUPERVISOR AND GUEST CLUSTERS,” filed on Jul. 1, 2020, the content of which is hereby incorporated by reference in its entirety for all purposes.
FIELDThe present disclosure relates generally to minimizing the number of times an administrator is asked to authenticate their credentials when administrating server clusters.
BACKGROUNDAdministrators often find themselves managing multiple computing systems and/or networks that can be distributed geographically and/or virtually. In order to avoid a situation in which a bad actor that has gained some level of access to one of the multiple computing systems is able to infiltrate the rest of the computing systems, the administrators are generally asked to maintain large lists of sign-on credentials in order to securely authenticate themselves as administrators to each of the multiple computing systems. This can become quickly unmanageable where the administrators are asked to monitor or administrate over hundreds of computing systems. For this reason, a mechanism for providing the administrators a secure but less burdensome way to access the multiple systems without compromising security is desirable.
SUMMARYThis disclosure describes mechanisms for providing a user access to multiple computing systems based on a single authentication.
A computer implemented method for authenticating a user is disclosed. The computer implemented method includes: receiving credentials identifying a user; authenticating the credentials identifying the user; identifying a first computing system and a second computing system the user is authorized to access from a plurality of computing systems based on the authentication of the credentials; and transmitting a first token to the user that provides access to the first computing system and a second token to the user that provides access to the second computing system. The first token does not provide access to the second computing system and the second token does not provide access to the first computing system.
A non-transitory computer-readable storage medium storing instructions configured to be executed by one or more processors of a computing device is disclosed. The execution of the instructions by the processors cause the computing device to carry out steps that include: receiving authentication credentials identifying a user; authenticating the credentials identifying the user; identifying a first computing system and a second computing system the user is authorized to access from a plurality of computing systems based on the authentication of the credentials; transmitting a first token to the user that provides access to the first computing system; and transmitting a second token to the user that provides access to the first computing system and the second computing system. The first token provides more access to the first computing system than the second token provides to the first computing system.
A computer system is disclosed and includes one or more processors; and memory storing one or more programs configured to be executed by the one or more processors, the one or more programs including instructions for: receiving authentication credentials identifying a user; identifying computing systems from a plurality of computing systems the user is authorized to access; and transmitting a first token to the user that provides access to a first computing system of the plurality of computing systems and a second token to the user that provides access to a second computing system of the plurality of computing systems. The first token provides access only to the first computing system.
Other aspects and advantages of the invention will become apparent from the following detailed description taken in conjunction with the accompanying drawings which illustrate, by way of example, the principles of the described embodiments.
The disclosure will be readily understood by the following detailed description in conjunction with the accompanying drawings, wherein like reference numerals designate like structural elements.
Certain details are set forth below to provide a sufficient understanding of various embodiments of the invention. However, it will be clear to one skilled in the art that embodiments of the invention may be practiced without one or more of these particular details. Moreover, the particular embodiments of the present invention described herein are provided by way of example and should not be used to limit the scope of the invention to these particular embodiments. In other instances, hardware components, network architectures, and/or software operations have not been shown in detail in order to avoid unnecessarily obscuring the invention.
Administrators are generally trusted with broad access to the resources of multiple computing systems, servers and/or server clusters. For this reason, owners of these resources expect the administrators to maintain unique credentials to avoid a situation in which a stolen set of credentials can be used for unauthorized access to a number of different systems.
One solution to this issue is when an administrator logs in to a trusted system, the trusted system can include a module that checks the credentials provided by the administrator to identify the administrator and then generates tokens for each of the systems that the identified administrator has access to. In this way, when the administrator attempts to access a particular system, a particular token that applies only to that particular system being accessed is transmitted to that system. This configuration has the following advantages: (1) the administrator is not required to enter new credentials to gain access to the system; (2) a rogue administrator or another bad actor that has somehow intercepted or stolen the transmitted token only gains access to the particular system associated with the transmitted token; (3) attempts to improperly use the token can be more easily logged and tracked since each token is only used to gain access to particular systems; and (4) since the administrator is only responsible for maintaining a single set of credentials in a single authentication system, additional security measures such as more frequent password changes, two factor authentication and biometric verification can be put in place without unduly burdening the administrator. It should be noted that while this application will discuss the specific instance where an administrator is being authenticated across multiple systems or server clusters that the described embodiments may also apply to users without elevated privileges in a manner that reduces the likelihood of a user's access to multiple systems being compromised.
Another benefit of the disclosed authentication method is that the trusted authentication system is in at least periodic communication with all the other systems for which it is configured to create and issue tokens. In some embodiments, the systems can take the form of supervisor clusters and guest clusters. Supervisor clusters use virtual machines (VMs) to implement both control plane nodes and compute objects managed by the Kubernetes® control plane. For example, Kubernetes® pods are implemented as “pod VMs,” each of which includes a kernel and container engine that supports execution of containers. The Kubernetes® control plane of the supervisor cluster is extended to support VM objects in addition to pods, where the VM objects are implemented using native VMs (as opposed to pod VMs). Guest clusters include a standard Kubernetes® control plane and associated nodes, as well as components for interfacing the underlying supervisor cluster. The guest cluster executes within compute objects managed by the supervisor cluster (e.g., native VMs or both native VMs and pod VMs) and utilizes networking and storage exposed by the supervisor cluster. In this manner, a guest cluster is a virtual extension of an underlying management cluster (i.e., the supervisor cluster) The communication with the other systems allows the trusted authentication system to assist in maintaining security compliance for the systems for which it generates tokens. For example, if a guest cluster changes a security policy it can request that the trusted authentication system confirm that the trusted authentication system will comply with or has already complied with the changed security policy. In cases where the trusted authentication system is unable to comply with the new security policy, the system with the new security policy could suspend authorization for the trusted authentication system to issue new tokens for the system until the new security policy is met by the trusted authentication system.
These and other embodiments are discussed below with reference to
Each of hosts 102, 112, 122 and 132 are capable of running virtualization software 108, 118, 128 and 138, respectively. The virtualization software can run within a virtual machine (VM) and includes management tools for starting, stopping and managing various virtual machines running on the host. For example, host 102 can be configured to stop or suspend operations of virtual machines 104 or 106 utilizing virtualization software 108. Virtualization software 108, commonly referred to as a hypervisor, can also be configured to start new virtual machines or change the amount of processing or memory resources from host hardware 110 that are assigned to one or more VMs running on host 102. Host hardware 110 includes one or more processors, memory, storage resources, I/O ports and the like that are configured to support operation of VMs running on host 102. In some embodiments, a greater amount of processing, memory or storage resources of host hardware 110 is allocated to operation of VM 104 than to VM 106. This may be desirable when, e.g., VM 104 is running a larger number of services or running on a more resource intensive operating system than VM 106. Clients 140 and 150 are positioned outside server cluster 100 and can request access to services running on server cluster 100 via network 160. Responding to the request for access and interacting with clients 140 and 150 can involve interaction with a single service or in other cases may involve multiple smaller services cooperatively interacting to provide information requested by clients 140 and/or 150.
Hosts 102, 112, 122 and 132, which make up server cluster 100, can also include or have access to a storage area network (SAN) that can be shared by multiple hosts. The SAN is configured to provide storage resources as known in the art. In some embodiments, the SAN can be used to store log data generated during operation of server cluster 100. While description is made herein with respect to the operation of the hosts 110-140, it will be appreciated that those of hosts 110-140 provide analogous functionality, respectively.
Host 208 can run different types of workloads that include VMs 216 and pods 218. Pods 216 can run natively on virtualization software associated with hosts 208, 210 and 212 of supervisor cluster 202. Pods 216 are capable of supporting multiple containers within a native Kubernetes environment. Supervisor cluster 202 can also be configured to support one or more guest clusters. Guest cluster 220 is shown supporting a multiple workloads 226 that draw resources from any or all of the hosts included within supervisor cluster 202. It should be noted that while guest cluster 220 is shown running workloads 226 as opposed to specific types of workloads, workloads 226 refer broadly to virtual constructs such as containers, pods or VMs. Guest cluster 220 can be positioned within a namespace 222 that provides an abstraction onto which administrators are able to attach policy. In some embodiments, this policy is applied to namespaces to help with establishing permissions for one or more guest clusters. For example, supervisor namespace 228 can be configured to allow establishment of the same permissions for both guest cluster 230 and guest cluster 232. In some embodiments, each of VMs 216, pods 218 and guest clusters 220/228/230 can be configured with different security rules that allow users different levels of access to content hosted on the same host and/or server. To support this type of functionality users are often required to provide credentials when initially accessing a different service. In some embodiments, a service running on one VM or container may be able to auto-scale across different hosts or clusters to give a user access to another VM or container running the same service without requiring the user to provide a new set of sign-on credentials.
In some embodiments, prior to creation of tokens 412 security policies for each of the guest clusters and workloads can be determined or reconfirmed. Security policies for trusted authentication system 400 will generally be set to whatever the strictest policies are from the virtual constructs. In the case where trusted authentication system 400 is incompatible with requirements of a particular security policy, the workload or guest cluster with the incompatible security policy can be removed from the delegated single sign-on system. In some embodiments, trusted authentication system 400 may also be configured to allow administrators without the tools necessary to meet the security requirements of every one of the virtual constructs with which the trusted authentication system 306 is in communication the option to receive tokens for only a subset of the guest clusters or workloads with which trusted authentication system 400 is in communication.
Each of tokens 412 can include a private key providing access to secure information stored or accessible within the computing environment. Management server 404 will also repeatedly send updated tokens 412 to administrator 406 by way of supervisor cluster control panel 402 prior to previously issued tokens 412 expiring. In addition to providing tokens 412 to administrator 406 management server 404 can also be configured to transmit a public signing key 414 to guest cluster node 416. Guest cluster control plane node 416 can run within one of the guest master VMs associated with supervisor cluster control plane node 402. Public signing key 416 can be configured to recognize and validate the newly issued tokens 412 and any other valid tokens currently in use within the computing environment. While management server 404 is shown only sending public key 414 to guest cluster plane node 416 it should be appreciated that in some embodiments any time a change is made to public key 414 management server 404 would be configured to distribute public key 414 to all of the control plane nodes located in the computing environment.
The foregoing description, for purposes of explanation, used specific nomenclature to provide a thorough understanding of the described embodiments. However, it will be apparent to one skilled in the art that the specific details are not required in order to practice the described embodiments. Thus, the foregoing descriptions of specific embodiments are presented for purposes of illustration and description. They are not intended to be exhaustive or to limit the described embodiments to the precise forms disclosed. It will be apparent to one of ordinary skill in the art that many modifications and variations are possible in view of the above teachings.
Claims
1. A computer implemented method for authenticating a user, the computer implemented method comprising:
- receiving credentials identifying a user;
- authenticating the credentials identifying the user;
- identifying a first computing system and a second computing system the user is authorized to access from a plurality of computing systems; and
- transmitting a first token and a second token to the user in response to identifying the first computing system and the second computing system, wherein the first token provides access to the first computing system and the second token provides access to the second computing system,
- wherein the first token provides a first amount of access to the first computing system and the second token provides a second amount of access to the first computing system that is different than the first amount of access.
2. The computer implemented method as recited in claim 1, wherein identifying the plurality of computing systems comprises communicating with the plurality of computing systems to determine which of the plurality of computing systems the user is authorized to access.
3. The computer implemented method as recited in claim 2, wherein access to the first computing system is based at least in part upon roles defined by a namespace within which the first computing system resides.
4. The computer implemented method as recited in claim 3, further comprising synchronizing namespace role bindings with the first computing system.
5. The computer implemented method as recited in claim 1, wherein the first computing system comprises a plurality of workloads running within a supervisor cluster and the second computing system comprises a guest cluster.
6. The computer implemented method as recited in claim 1, further comprising transmitting a third token to the user that provides access to both a third computing system and a fourth computing system that share the same namespace.
7. The computer implemented method as recited in claim 1, further comprising:
- receiving an updated security policy from at least one computing system of the plurality of computing systems; and
- when the user has an active token granting access to the at least one computing system and the updated security policy is stricter than any of previously established security policies, requesting the user provide new authentication credentials conforming with the updated security policy.
8. The computer implemented method as recited in claim 7, further comprising:
- transmitting a notification to the user informing the user of when the active token granting access to the at least one computing system will expire if the new authentication credentials are not received.
9. The computer implemented method as recited in claim 1, further comprising:
- receiving log data from a log analytics system showing the first token issued to the user granting access to the first computing system has been used in an attempt to access a third computing system that the first token is not configured to grant access to; and
- reducing a trust level for the first computing system,
- wherein the first computing system is a guest cluster and the computer implemented method further comprises transmitting a notification to the guest cluster informing the guest cluster of a reason for reducing the trust level.
10. The computer implemented method as recited in claim 1, wherein the first token is configured to identify the user to the first computing system, and the first computing system is configured to provide access to the user in accordance with the identity of the user provided by the token.
11. A non-transitory computer-readable storage medium storing instructions configured to be executed by one or more processors of a computing device cause the computing device to carry out steps that include:
- receiving credentials identifying a user;
- authenticating the credentials identifying the user;
- identifying a first computing system and a second computing system the user is authorized to access from a plurality of computing systems based on the authentication of the credentials;
- transmitting a first token and a second token to the user in response to identifying the first computing system and the second computing system, wherein the first token provides access to the first computing system and the second token provides access to the second computing system,
- wherein the first token provides more access to the first computing system than the second token provides to the first computing system.
12. The non-transitory computer-readable storage medium as recited in claim 11, wherein the steps further include:
- periodically communicating with the plurality of computing systems to determine which of the plurality of computing systems the user still has authorization to access;
- transmitting updated tokens to the user for computing systems that the user is determined to still have access; and
- transmitting new tokens to the user that provide access to computing systems that the user is determined to have gained access.
13. The non-transitory computer-readable storage medium as recited in claim 12, wherein the tokens transmitted to the user are stored in a data repository that allows the user to access the computing systems the user is authorized to access.
14. The non-transitory computer-readable storage medium as recited in claim 12, wherein none of the updated tokens provide access to the same computing system.
15. The non-transitory computer-readable storage medium as recited in claim 11,
- wherein authenticating the credentials identifying the user comprises confirming the received credentials comply with security policies associated with the identified computing systems; and
- wherein identifying computing systems from the plurality of computing systems comprises receiving lists of authorized users from the plurality of computing systems.
16. A computer system, comprising:
- one or more processors; and
- memory storing one or more programs configured to be executed by the one or more processors, the one or more programs including instructions for: receiving credentials identifying a user; authenticating the credentials identifying the user; identifying a first computing system and a second computing system the user is authorized to access from a plurality of computing systems based on the authentication of the credentials; and transmitting a first token and a second token to the user in response to identifying the first computing system and the second computing system, wherein the first token provides access to the first computing system and the second token provides access to the second computing system, wherein the first token provides a first amount of access to the first computing system and the second token provides a second amount of access to the first computing system that is different than the first amount of access.
17. The computer implemented method as recited in claim 16, wherein the computer system includes a trusted authentication system running in a master virtual machine positioned in a first server cluster.
18. The computer implemented method as recited in claim 17, wherein the first computing system is located in the first server cluster and the second computing system is positioned in a second server cluster.
19. The computer implemented method as recited in claim 17, wherein the first computing system and the second computing system are both positioned in the first server cluster.
20. The computer implemented method as recited in claim 18, wherein the first and second server clusters are managed by the same management server.
Type: Application
Filed: Jan 27, 2023
Publication Date: Jun 8, 2023
Applicant: VMware, Inc. (Palo Alto, CA)
Inventors: Michal A. JANKOWSKI (Sunnyvale, CA), Mark JOHNSON (McKinleyville, CA), Fanny STRUDEL (Sunnyvale, CA), Zachary James SHEPHERD (San Francisco, CA)
Application Number: 18/102,584