Secure identity impersonation for Commvault automated file operations

Internship at Commvault

Abstract

The ability to move files between servers automatically is essential for modern data management. During my internship at Commvault, I worked on improving this process by moving away from the use of manual passwords. A major security challenge is that many automated programs rely on passwords written directly into the code or stored locally in the registry, which creates a risk of sensitive information being exposed. To address this, I used Microsoft Group Managed Service Accounts to allow the computer to handle logins on its own. I developed a background program in C++ that manages these operations as a Windows service. The system utilizes the Kerberos S4U2self protocol to request digital access keys directly from the network. By using these digital keys instead of stored passwords, the system can securely perform network tasks without human input. This project removes the need for hardcoded login info, making Commvault’s automated operations much more secure.