Netapp, Inc.

Juniper Networks, Inc.

Kartik Kumar

Ravindra Kumar

Anshu Surana

James P Wood

Shailaja Kamila

Hemanth Pannem

Raja Shekar

Senthilkumar Ponnappan

Roger Allen Chickering

James Hartwell Holl, Ii

Ankur Agrawal

Chandrasekaran Rajagopalan

Vamsi K Anne

A VPN gateway is described that provides single sign-on (SSO) functionality with respect to remote users who have established tunneling sessions with the VPN gateway and who attempt to access a protected resource. The VPN gateway may receive, from a client device, a security assertion request that includes a request for a security assertion to be made by the VPN gateway with respect to a user of a private network associated with the VPN gateway, determine whether the security assertion request was received via a tunneling session established for the user between the client device and the VPN gateway, and issue a security assertion for the user in response to determining that the security assertion request was received via the tunneling session. In this way, a VPN gateway may act as an SSO identity provider for users that have an established tunneling session with the gateway.

Tunneling session detection to provide single-sign on (SSO) functionality for a VPN gateway

In general, the invention is directed to techniques for enabling single sign-on (SSO) for a client seeking access to multiple resources protected by a certificate-based authentication scheme. For example, as described herein, a secure gateway comprises a certificate repository to store a digital certificate as well as a policy that includes one or more policy rules. A network interface of the secure gateway receives a message from a client device, wherein the message comprises a request to access a protected resource and an identifier for the requesting agent. The secure gateway also comprises a resource authentication module to map the identifier and the protected resource to the digital certificate based on the policy. The resource authentication module retrieves the digital certificate from the certificate repository and sends the digital certificate to the protected resource to authenticate the secure gateway to the protected resource.

Virtual single sign-on for certificate-protected resources

In general, techniques are described for dynamic resource allocation in virtual environments. A network device comprising physical resources, a first virtual machine (VM), a second VM and a hypervisor may implement these techniques. The first VM executes within a first partition of the physical resources to process a first portion of received network traffic, while the second MV executes within a second partition of the physical resources to process a second portion of the received network traffic. The first VM determines whether physical resources in addition to those allocated by way of the first partition are required to process the incoming network traffic and issues a request requesting additional physical resources based on the determination. Either the second VM or the hypervisor, in response to the request, dynamically reallocates at least a portion of the physical resources allocated to the second partition to the first partition.

Dynamic resource allocation in virtual environments

An embodiment of a network manager permits a resource group administrator (with resource group level permissions but without global permissions) to add a global object to his/her resource group as a managed object, without requiring the administrator to have a global permission, as discussed further below. An embodiment of the network manager permits a resource group administrator to also edit the configuration settings that are attached to his/her resource group without requiring the administrator to have a global permission.

De-centralization of group administration authority within a network storage architecture

Method and system for managing a storage environment having a cluster based storage system and a non-cluster based storage system is provided. A management application collects information regarding components of both the cluster based storage system and the non-cluster based storage system. A layout having a plurality of data structures is generated and maintained by the management application. The data structures include information regarding the components and their relationships with each other, if any. The layout is used for responding to user requests and presenting an integrated view of the storage environment on a display device with selectable options for selecting the cluster based storage system components and the non-cluster based storage system components.

Method and system for managing clustered and non-clustered storage systems

A system and method administers virtual servers executing on one or more physical storage systems. One or more virtual servers are created and associated with a management group. An administrator is then granted permissions to the group. Upon logging into management software, only information relating to the virtual servers associated with the group are displayed to the administrator, thereby limiting access to information related to other virtual servers and/or physical storage systems.

System and method for administration of virtual servers

A storage management application is provided to manage and monitor virtual storage servers in a hosting storage server. In addition, in order to facilitate virtual storage server management and monitoring, a virtual storage server administrator role is provided. The role is allowed to access details of the virtual storage server assigned to the role, but not the details of the hosting server and other virtual servers.

Growing community of inventors

Bengaluru, India

Kartik Kumar