International Business Machines Corporation

Davis Kent Soper

Theodore Jack London Shrader

Garry Lee Child

Bruce Arland Rich

Michael Bradford Ault

Ernst Robert Plassmann

Theodore J Shrader

Xiaoyan Y Zhang

Randy Scott Humphrey

An analysis of at least one authentication token for an application is provided. At least one login module within the application is identified. Responsive to a failure to access the application, principal information is retrieved associated with the at least one login module. A recovery action is then generated. The recovery action corresponds to the failure and the principal information.

Architecture for the graphical management and analysis of authentication tokens

A method, program and system for mapping ASN.1 data to an object model are provided. The invention consists of identifying the start of a data stream and then generating a new object name for the data. Next, the data is parsed to get the identifier and the data length. Then the data's tag type is analyzed. If the tag type is simple, a class diagram is generated for the data and then the source code for the data is generated. If the tag type is not simple, a subroutine is called to further parse the data before generating the class diagram and source code.

Strategy for dynamically modeling ASN.1 data to an object model

A method for changing a user password is preferably operative as a Web server impersonates a Web client to obtain access to files stored in a distributed file system space of a distributed computing environment. The method begins in response to receipt of a Web transaction request from the Web client to determine whether the user's password has expired. If so, the method suspends processing of the Web transaction request and then enters a password change subprogram to enable the user to define a new password. Typically, the password change subprogram displays a password change dialog that interacts with the user. Upon definition of the new password by the user, the mechanism resumes processing of the original Web transaction request. Alternatively, the user may be prompted to terminate the original transaction request and select a new URL and/or document.

Method for changing a security policy during processing of a transaction request

A method of authenticating a Web client to a Web server connectable to a distributed file system of a distributed computing environment. The distributed computing environment includes a security service for returning a credential to a user authenticated to access the distributed file system. The method preferably operates within the context of a native operating system environment such as &ldquo;Windows NT&rdquo;. Upon initialization of the Web server, a session manager creates a pool of temporary Windows NT user identities. In response to a Web client browser request, a temporary NT user identity is associated with proper DCE credentials. A server process then impersonates the returned NT user identity on a thread which is attempting to access the requested resource.

Method for enabling a web server running a &ldquo;closed&rdquo; native operating system to impersonate a user of a web client to obtain a protected file

A method of executing Common Gateway Interface (CGI) programs in a computer network having a Web client and a Web server, the server connectable to a secure distributed file system of a distributed computing environment. If a Web client user request requires CGI processing, the requested CGI program is run in a new process spawned from the Web server thread and executing within the context of the temporary user identity set up with the proper DCE credentials. This function is effected by saving the name and path of the user-requested CGI program and then substituting the name and path of an encapsulation CGI program. The encapsulation CGI program starts the user-requested CGI program in a new process (i.e. a desktop) within the context of the temporary user identity (having proper DCE credentials). The encapsulation program thus ensures that the CGI program being executed cannot harm the default Web server desktop.

Method for executing a user-requested CGI program in a new

A test page including a statement invoking an executable periodically reloading the test page is placed on a Web server having a security plug-in to be tested. The test page may include multiple frames, each containing a reference requesting access to the same test page or each performing a different testing function. The test page may be placed in a protected directory, may include an attempt to access the contents of a file within a different protected directory, and may include attempts to access protected CGI executables or other programs or modules which may be run on the Web server. A remote browser is employed to attempt to access the test page using the userid and password employed to login to the browser. Successful or unsuccessful access to the test page verifies proper operation of the security plug-in. The test page is automatically reloaded by the browser at a selected interval, and multiple frames or multiple browser instances each accessing the test page results in stress testing of the security plug-in.

Growing community of inventors

Cedar Park, TX, United States of America

Davis Kent Soper