| 摘要 |
A system and method for preventing an administrator impersonating a user from accessing sensitive resources on a target system is provided. The method comprises receiving a first request from a user to change the user's password on a target system to be changed, sending a “change password” request for the user to the target system, storing the user's new password, receiving a second request from the target system on behalf of the user for access to a sensitive resource, wherein the second request contains information about the user's password, and denying the second request if the information about the user's password is not consistent with the user's stored new password. |
| 主权项 |
1. A method of changing a user password, the method comprising:
receiving, at a target system from an access control system, a password change request associated with a user account at the target system and comprising a new user password, the password change request responsive to a prior request comprising the new user password received by the access control system from a user associated with the user account via a user computer system; associating, by the target system, the user account with the new user password; receiving, at the target system from the user, an access request comprising an inputted password; responsive to receiving the access request at the target system from the user, sending, by the target system to the access control system, a verification request comprising a representation of the inputted password; and receiving, at the target system from the access control system, verification for the access request in response to a determination by the access control system that the representation of the inputted password is consistent with the new user password. |
