Authentication referral search for LDAP

• US 20020087718A1
• Filed: 12/29/2000
• Published: 07/04/2002
• Est. Priority Date: 12/29/2000
• Status: Active Grant

• Current Assignee: X Corp. (f/k/a Twitter, Inc.) (X Holdings Corp.)
• Original Assignee: International Business Machines Corporation
• Inventors: Shi, Shaw-Ben Shepherd, Hill, Reginal Raynard
• Granted Patent: US 7,016,897 B2
• Time in Patent Office: Days
• US Class Current: 709/237
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99939 Privileged access
• CPC Class Codes: Y10S 707/99945 Object-oriented database structure processing
• CPC Class Codes: Y10S 707/99953 Recoverability

Abstract

A method, program and system for authenticating LDAP referral searches are provided. The invention comprises receiving a bind request from a LDAP referred search request and then searching the local directory for an entry corresponding to the distinguished name (DN) of the bind request. If an entry for the bind DN is located within the local directory, the bind request is authenticated. If an entry for the bind DN is not found in the local directory, a defined reference server is checked for the prefix of the bind DN. If the prefix for the bind DN is located in the reference server, the reference server is contacted for authentication, which is performed using a root DN. If an entry for the bind DN is not found in either the local directory or reference server, the bind request cannot be authenticated and is denied.

Claims

1. A method for authenticating LDAP referral searches, comprising:

receiving a bind request from a LDAP referred search request;

searching the local directory for an entry corresponding to the distinguished name (DN) of the bind request;

authenticating the bind request if an entry for the bind DN is located within the local directory;

checking a defined reference server for the prefix of the bind DN, if the bind DN is not found within local directory;

contacting the reference server for authentication, if the prefix of the bind DN is located on the reference server; and

denying the bind request if both the local directory and the reference server do not contain an entry corresponding to the bind DN.

2. The method according to claim l, wherein the defined reference server contains:

root DN'"'"'s; and

server location.

3. A computer program product in a computer readable medium for use in a data processing system, for authenticating LDAP referral searches, the computer program product comprising:

instructions for receiving a bind request from a LDAP referred search request;

instructions for searching the local directory for an entry corresponding to the distinguished name (DN) of the bind request;

instructions for authenticating the bind request if an entry for the bind DN is located within the local directory;

instructions for checking a defined reference server for the prefix of the bind DN, if the bind DN is not found within local directory;

instructions for contacting the reference server for authentication, if the prefix of the bind DN is located on the reference server; and

instructions for denying the bind request if both the local directory and the reference server do not contain an entry corresponding to the bind DN.

4. The computer program product according to claim 3, wherein the defined reference server contains:

root DN'"'"'s; and

server location.

5. A system for authenticating LDAP referral searches, comprising:

means for receiving a bind request from a LDAP referred search request;

means for searching the local directory for an entry corresponding to the distinguished name (DN) of the bind request;

means for authenticating the bind request if an entry for the bind DN is located within the local directory;

means for checking a defined reference server for the prefix of the bind DN, if the bind DN is not found within local directory;

means for contacting the reference server for authentication, if the prefix of the bind DN is located on the reference server; and

means for denying the bind request if both the local directory and the reference server do not contain an entry corresponding to the bind DN.

6. The system according to claim 5, wherein the defined reference server contains:

Root DN'"'"'s; and

server location.