Method and apparatus for implementing an extensible authentication mechanism in a web application server

Abstract

A highly scalable, flexible, and extensible mechanism is provided for authenticating a request from a client. In a preferred embodiment, the invention comprises an authentication engine, an authentication host, a plurality of providers coupled to the host which implement selected authentication schemes, and a machine independent communication mechanism which enables the various components to communicate with each other irregardless of the machine each component resides on. The communication mechanism enables the invention to be distributed, which in turn, makes the invention highly scalable. In operation, the authentication engine receives a request having associated therewith a protect string. The protect string specifies the authentication scheme or schemes that need to be implemented for that request. The authentication engine parses the protect string into one or more provider requests, and sends the requests to the authentication host. In response, the host forwards the requests to the appropriate providers for processing. The results of the providers' processing are sent back to the authentication engine, which then processes the results according to the protect string to determine whether the request has been authenticated. With the present invention, it is possible to add providers to the system, or to substitute a new provider for an existing provider, without changing or recompiling any other component in the system. It is also possible to change the authentication schemes associated with a request by simply changing the protect string. These aspects of the invention make it possible to change implementation at deployment time, as opposed to compile time. This makes the invention highly flexible and extensible.