Directory services system and methods with mapping in database tables

• US 20030191759A1
• Filed: 11/21/2002
• Published: 10/09/2003
• Est. Priority Date: 09/01/1994
• Status: Active Grant

• Current Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Harvey, Richard Hans
• Granted Patent: US 7,685,142 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/284 Relational databases
• CPC Class Codes: G06F 16/288 Entity relationship models
• CPC Class Codes: G06F 16/289 Object oriented databases
• CPC Class Codes: H04L 61/4517 using open systems interconnection [OSI] directories, e.g. X.500
• CPC Class Codes: H04L 61/4523 using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 61/4552 Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99934 Query formulation, input preparation, or translation
• CPC Class Codes: Y10S 707/99942 Manipulating data structure, e.g. compression, compaction, compilation
• CPC Class Codes: Y10S 707/99954 Version management

Abstract

A method and apparatus for addressing problems associated with the implementation of directory services, such as X.500 and LDAP, in a SQL environment, particularly problems associated with interrogating database provided to implement directory services in the SQL environment. According to the disclosed method and apparatus, the system is based on the use of tables that may be arranged to have a plurality of columns, so that they support a variety of functions in order to implement directory services, such as X.500 and LDAP. In one aspect, the present invention provides a method of creating one or more SQL commands corresponding to a directory service. In another aspect, the present invention provides a many examples of tables and their function. Many examples of an implementation of directory services using SQL based technology are disclosed.

This application is a divisional of U.S. Ser. No. 08/793,575, which is currently pending and which is incorporated herein by reference in its entirety.

Claims

1. A method of implementing directory services for a relational data base management system using a relational language comprising:

establishing a database using a plurality of tables, each table having a plurality of rows and columns, said database comprising at least one each of a HIERARCHY table, an OBJECT table and an ATTRIBUTE table;

defining a plurality of relational language commands, each corresponding to a respective one of a plurality of directory services, each service having a corresponding service executing procedure;

selecting one of said plurality of directory services;

applying a process of name resolution to the selected directory service,

executing the procedure corresponding to the selected service, and

building a result comprising an error or search result in response to said executing step.

2. A method of implementing directory services as claimed in claim 1 wherein said relational language is SQL.

3. A method of implementing directory services as claimed in claim 2 wherein said building step comprises utilizing set orientation queries of SQL.

4. A method of implementing directory services as claimed in claim 1 wherein said selecting step comprises identifying a specific service and the information that is to be returned.

5. A method of implementing directory services as claimed in claim 1 wherein said database comprises a DIRECTORY tree, having a plurality of distinguished names (DN) each comprising one or more relative distinguished names (RDN), and said step of applying a process of name resolution comprises navigating said directory tree.

6. A method of implementing directory services as claimed in claim 5, wherein the search result returns to the response any distinguished name(s) located.

7. A method of implementing directory services as claimed in claim 1, wherein Entry Information Selection (EIS) is associated with the selected service.

8. A method of implementing directory services as claimed in claim 7, wherein the EIS can be selected to be one of:

no information,

attributes and value for selected or all attributes, or

values only for selected or all attributes.

9. A method of implementing directory services as claimed in claim 7, wherein the selected service is a read service.

10. A method of implementing directory services as claimed in claim 7, wherein the selected service is a search service.

11. A method of implementing directory services as claimed in claim 1, wherein the selected service executed has an associated set of common arguments defining service controls.

12. A method of implementing directory services as claimed in claim 11, wherein the service controls includes at least one of a size limits, a time limit or security information.

13. A method of implementing directory services as claimed in claim 1, further comprising,

building the response, which includes a set of common results.

14. A method of implementing directory services as claimed in claim 13, wherein the set of common results includes at least one of security parameters, the DN of the performer of the service or an alias dereferenced flag.

15. A method of implementing directory services as claimed in claim 5 wherein said process of navigating comprises a tree walk, which begins from the root of the directory tree and continues down the directory tree until all the RDNs in a DN have been resolved.

16. A method of implementing directory services as claimed in claim 5, further comprising:

converting a DN into an entry ID (EID) and storing said EID; and

wherein said process of navigating for a particular entry comprises, given a DN for the entry, locate the entry in the HIERARCHY table which has an RDN equal to the first RDN in the DN; and

store the EID and recursively locate the entry which has an RDN equal to the next RDN in the DN and a parent equal to the stored EID.

17. A method of implementing directory services as claimed in claim 3, wherein said database returns data as attribute ID and raw data values.

18. A method of implementing directory services as claimed in claim 5, particularly a read service, further comprising:

converting a DN into an entry ID (EID) and storing said EID; and

in the OBJECT table, reading the values of all rows which match the stored EID.

19. A method of implementing directory services as claimed in claim 5, particularly a read service, in which ‘

type only’

is selected, further comprising;

converting a DN into an entry ID (EID) and storing said EID; and

in the OBJECT table, reading the types of all rows which match the stored EID.

20. A method of implementing directory services as claimed in claim 5, particularly a compare service, further comprising:

converting a DN into an entry ID (EID) and storing said EID; and

in the OBJECT table, testing for a matching value in all rows which match the stored EID and a specified attribute ID (AID).

21. A method as claimed in claim 20, wherein the step of testing also includes matching a proported value.

22. A method of implementing directory services as claimed in claim 5, particularly a list service, further comprising:

converting a DN into an entry ID (EID) and storing said EID; and

in the HIERARCHY table, return the RDNs for all rows with a parent matching the stored EID.

23. A method of implementing directory services as claimed in claim 5, particularly an add entry service, further comprising:

converting all but the last RDN of a DN into an entry ID (EID) and storing said EID; and

to the HIERARCHY table, add a new EID, and to the OBJECT table, add rows for each value in the new entry.

24. A method of implementing directory services as claimed in claim 5, particularly a remove entry service, further comprising:

converting a DN into an entry ID (EID) and storing said EID; and

from the HIERARCHY table, remove the entry and from the OBJECT table, remove all rows, which match the stored EID.

25. A method of implementing directory services as claimed in claim 24, further comprising:

prior to the converting step, checking that the entry has no subordinate entries on the tree.

26. A method of implementing directory services as claimed in claim 5, particularly a modify entry service, further comprising:

converting a DN into an entry ID (EID) and storing said EID; and

in the OBJECT table, apply at least one of an add, remove or modify service to rows matching the stored EID.

27. A method of implementing directory services as claimed in claim 5, particularly a modify RDN service, further comprising:

converting a DN into an entry ID (EID) and storing said EID;

check that the new name (RDN) does not exist in the current level of the subtree, and

modify the entry in the HIERARCHY and OBJECT tables.

28. A method of implementing directory services as claimed in claim 5, particularly a base level search service, further comprising:

converting a DN into an entry ID (EID) and storing said EID;

in the OBJECT table, read nominated values from rows, which match the stored EID where a filter criteria is satisfied.

29. A method of implementing directory services as claimed in claim 5, particularly a one level search service, further comprising:

converting a DN into an entry ID (EID) and storing said EID;

returning a list of EIDs which have a parent EID matching the stored EID in the HIERARCHY table and have values which satisfy the filter criteria in the OBJECT table; and

in the OBJECT table, read nominated values for returned EIDs.

30. A method of implementing directory services as claimed in claim 5, particularly a subtree search service, further comprising:

converting a DN into an entry ID (EID) and storing said EID;

returning a list of EIDs which have a path matching that of the base object in the HIERARCHY table and have values which satisfy the filter criteria in the OBJECT table; and

in the OBJECT table, read nominated values for returned EIDs.

31. A method of implementing directory services as claimed in claim 5, further comprising:

resolving aliases during navigation in response to an alias control flag and the characteristic of the service implemented.

47. A method as set forth in any one of claims 1-46 wherein said directory service is one of an X.500 or LDAP service.

134. In use, a directory service system implementing a method as claimed in any one of claims 1-46 and 92-132.

135. In use, a system as claimed in claim 134, wherein the directory service is X.500 or LDAP.

136. A program product comprising a computer storage medium containing therein a computer program operable in accordance with the method recited in any one of claims 1-46 and 92-132.

137. A program product as set forth in claim 136 wherein said directory service is one of an X.500 or LDAP service.

151. A method as set forth in claim 18 wherein said method is for implementing X.500 READ services in a RDBMS which supports a relational language, having a fixed set of queries/services defined by service modeling.

152. A method as set forth in claim 20 wherein said method is for implementing X.500 COMPARE services in a RDBMS which supports a relational language, having a fixed set of queries/services defined by service modeling.

153. A method as set forth in claim 22 wherein said method is for implementing X.500 LIST services in a RDBMS which supports a relational language, having a fixed set of queries/services defined by service modeling.

154. A method as set forth in claim 28 wherein said method is for implementing X.500 SEARCH services in a RDBMS which supports a relational language, having a fixed set of queries/services defined by service modeling.

155. A method as set forth in claim 29 wherein said method is for implementing X.500 SEARCH services in a RDBMS which supports a relational language, having a fixed set of queries/services defined by service modeling.

156. A method as set forth in claim 30 wherein said method is for implementing X.500 SEARCH services in a RDBMS which supports a relational language, having a fixed set of queries/services defined by service modeling.

157. A method as set forth in claim 23 wherein said method is for implementing X.500 ADD ENTRY services in a RDBMS which supports a relational language, having a fixed set of queries/services defined by service modeling.

158. A method as set forth in claim 24 wherein said method is for implementing X.500 REMOVE entry services in a RDBMS which supports a relational language, having a fixed set of queries/services defined by service modeling.

159. A method as set forth in claim 26 wherein said method is for implementing X.500 MODIFY services in a RDBMS which supports a relational language, having a fixed set of queries/services defined by service modeling.

160. A method as set forth in claim 27 wherein said method is for implementing X.500 MODIFY RDN services in a RDBMS which supports a relational language, having a fixed set of queries/services defined by service modeling.

32. A method of implementing directory services for a relational data base management system using a relational language comprising:

establishing a database using a plurality of tables, each table having a plurality of rows and columns, said database comprising at least one each of a HIERARCHY table comprising a DIT, NAME, ALIAS and TREE table, an OBJECT table comprising a SEARCH and an ENTRY table, and an ATTRIBUTE table;

defining a plurality of relational language commands, each corresponding to a respective one of a plurality of directory services, each service having a corresponding service executing procedure;

selecting one of said plurality of directory services;

applying a process of name resolution to the selected directory service,

executing the procedure corresponding to the selected service, and

building a response comprising an error or search result in response to said executing step.

33. A method of implementing directory services as claimed in claim 32, further comprising:

in order to effect the adding of object(s) to the DIT table, adding a corresponding row to the TREE table which is used to store a path to the object(s) by way of a list of corresponding EID(s).

34. A method of implementing directory services as claimed in claim 32 wherein said database comprises a directory tree, having a plurality of distinguished names (DN) each comprising one or more relative distinguished names (RDN), and said step of applying a process of name resolution comprises navigating said directory tree.

35. A method of implementing directory services as claimed in claim 34 wherein said process of navigating comprises a tree walk, which begins from the root of the directory tree and continues down the directory tree until all the RDNs in a DN have been resolved.

36. A method of implementing directory services as claimed in claim 34, further comprising:

converting a DN into an entry ID (EID) and storing said EID; and

wherein said process of navigating for a particular entry comprises, given a DN for the entry, locate the entry in the HIERARCHY table which has an RDN equal to the first RDN in the DN; and

store the EID and recursively locate the entry which has an RDN equal to the next RDN in the DN and a parent equal to the stored EID.

37. A method of implementing directory services as claimed in claim 34, particularly a read service to extract information from an explicitly identified entry, further comprising:

perform a tree walk using the DIT table, resolving aliases if necessary and obtain the base EID;

using a path from the TREE table and raw RDN'"'"'s from the NAME table, build a DN;

if no attributes or values are specified, just return the DN;

if attributes or values are specified as ALL types and values, return the RAW values from the ENTRY table for the matching EID; and

if attributes or values of selected types and values are specified, obtain attribute IDs (AID'"'"'s) from the ATTRIBUTE able and then return selected types and/or values for the matching EID.

38. A method of implementing directory services as claimed in claim 34, particularly a compare service for comparing a value with values of a particular attribute type in a particular object entry, further comprising:

perform a tree walk using the DIT table, resolving aliases if necessary, and obtain the EID of the base object;

from the ATTRIBUTE table, obtain the AID of the attribute to be compared;

from the ENTRY table, select the one or more rows matching the EID and AID;

compare the value and return TRUE or FALSE as the compare result; and

if an alias is dereferenced, return the DN of the selected object, using the path from the TREE Table and the RAW RDN'"'"'s from the NAME table.

39. A method of implementing directory services as claimed in claim 34, particularly a list service to obtain a list of immediate subordinates of an explicitly identified entry, further comprising:

performing a tree walk using the DIT table, resolving aliases if necessary;

obtaining the EID of the base object; and

using the DIT and NAME tables, return an ALIAS flag and RAW RDN rows where PARENT equal to the EID of the base object.

40. A method of implementing directory services as claimed in claim 34, particularly a base object search service, further comprising:

perform a tree walk using the DIT table, resolving aliases if necessary, and obtain the EID of the base object;

apply the filter to attributes and values in the SEARCH table with the EID of the selected object;

if the filter condition is matched, return the entry Information from the ENTRY table; and

if an alias is dereferenced, return the DN using the TREE table to extract the data defining a PATH and the NAME table to build the DN.

41. A method of implementing directory services as claimed in claim 34, particularly a one level search service, further comprising:

perform a tree walk using the DIT table, resolving aliases if necessary, and obtain the EID of the base object;

check to see if any aliases exist with PARENT=EID and if so resolve them to obtain an aliases dereferenced list;

using the SEARCH and DIT tables, apply the filter (attribute/value conditions) and the scope (PARENT=EID of selected object and any aliases dereferenced) so that a list of matching EID'"'"'s will be returned;

if an alias is dereferenced, return the DN using the TREE table to extract the information related to the PATH and the NAME table to build the DN; and

for each matching EID, and return the entry information obtained from the SEARCH table using the ENTRY table.

42. A method of implementing directory services as claimed in claim 34, particularly a whole subtree search service, further comprising:

perform a tree walk using the DIT table, resolving aliases if necessary, and obtain the EID of the base object;

check to see if any aliases exist with a PATH prefix matching the PATH of the selected object;

for each alias discovered, check to see if the alias points outside the current subtree and, if it does repeat the previous step until all aliases have been resolved, whereby a set of unique base objects will have been found;

using the SEARCH and TREE tables, apply a filter and a scope to each unique base object so that a list of matching EID'"'"'s will be returned;

if an alias is dereferenced during navigation and not during searching, return the DN using the TREE table to extract the PATH and the NAME table to build the DN; and

for each matching EID, return the Entry Information obtained from the SEARCH Table using the ENTRY table.

43. A method of implementing directory services as claimed in claim 34, particularly an add service to add a leaf entry, either an object entry or an alias entry, to the Directory Information Tree (DIT), further comprising:

using the DIT table, tree walk to the parent of the entry to be added;

using the DIT table, check if the entry exists; and

if the entry does not exist, allocate a new EID and add the entry, insert into the DIT Table, the NAME Table, the TREE Table, the SEARCH Table, the ENTRY Table and, if it is an alias entry, the ALIAS Table.

44. A method of implementing directory services as claimed in claim 34, particularly a remove service to remove a leaf entry, either an object entry or an alias entry, to the Directory Information Tree (DIT), further comprising:

perform a tree walk using the DIT table, and obtain the EID of the base object;

if the entry exists, and it is a leaf entry, then for the condition EID=EID of the selected object, delete from the DIT Table, the NAME Table, the TREE Table, the SEARCH Table, the ENTRY Table and, if it is an alias entry, the ALIAS Table.

45. A method of implementing directory services as claimed in claim 34, particularly a modify entry service, further comprising:

perform a tree walk using the DIT table, and obtain the EID of the selected object;

for the selected object, perform one or more of the following actions;

Add Value, Delete Value, Add Attribute, Delete Attribute, whose operations required for each action are as follows;

Add Value;

if the attribute exists, add the value to the ENTRY Table and the SEARCH Table;

Delete Value;

for the ENTRY Table and the SEARCH Table, if the attribute value exists, delete it;

Add Attribute;

if the attribute does not exist, add the Attribute Values to the ENTRY Table and the SEARCH Table; and

Delete Attribute;

for the ENTRY Table and the SEARCH Table, if the attribute exists, delete it.

46. A method of implementing directory services as claimed in claim 34, particularly a modify RDN service, further comprising:

perform a tree walk using the DIT table, and obtain the EID and Parent EID of the base object;

using the DIT table, check for equivalent entries and return error if one is found;

using the NAME table, replace the old RDN with the new RDN;

using the DIT Table, replace the old RDN with a normalised form of the new RDN;

using the ENTRY table, insert the new value;

using the SEARCH table, locate value=old RDN and set DISTING to 0 and insert the new value;

if deleteOldRDN is set to TRUE the procedures following the Tree Walk are as follows;

using the DIT table, check for a sibling with the same name and an EID not equal to the base EID;

using the NAME Table, replace the old RDN with the new RDN;

using the DIT Table, replace the old RDN with a normalised form of the new RDN;

using the ENTRY Table, delete the old value(s) and insert the new value(s); and

using the Perform SEARCH Table, delete the old value(s) and insert the new

48. A system for implementing directory services for a relational data base management system using a relational language comprising:

means for establishing a database using a plurality of tables, each table having a plurality of rows and columns, said database comprising at least one each of a HIERARCHY Table, an OBJECT Table and an ATTRIBUTE Table;

means for defining a plurality of relational language commands, each corresponding to a respective one of a plurality of directory services, each service having a corresponding service executing procedure;

means for selecting one of said plurality of directory services;

means for applying a process of name resolution to the selected directory service,

means for executing the procedure corresponding to the selected service, and

means for building a response comprising an error or search result in response to said executing means.

49. A system for implementing directory services as claimed in claim 48 wherein said relational language is SQL.

50. A system for implementing directory services as claimed in claim 49 wherein said building means comprises means for utilizing set orientation queries of SQL.

51. A system for implementing directory services as claimed in claim 48 wherein said selecting means comprises means for identifying a specific service and the information that is to be returned.

52. A system for implementing directory services as claimed in claim 48 wherein said database comprises a directory tree, having a plurality of distinguished names (DN) each comprising one or more relative distinguished names (RDN), and said means for applying a process of name resolution comprises navigating said directory tree.

53. A system for implementing directory services as claimed in claim 52, wherein the search result returns as the response any distinguished name(s) located.

54. A system for implementing directory services as claimed in claim 48, wherein Entry Information Selection (EIS) is associated with the selected service.

55. A system for implementing directory services as claimed in claim 54, wherein the EIS can be selected to be one of:

no information,

attributes and value for selected or all attributes, or

values only for selected or all attributes.

56. A system for implementing directory services as claimed in claim 54, wherein the selected service is a read service.

57. A system for implementing directory services as claimed in claim 54, wherein the selected service is a search service.

58. A system for implementing directory services as claimed in claim 48, wherein the selected service executed has an associated set of common arguments defining service controls.

59. A system for implementing directory services as claimed in claim 48, wherein the service controls includes at least one of a size limits, a time limit or security information.

60. A system for implementing directory services as claimed in claim 48, further comprising,

building the response which includes a set of common results.

61. A system for implementing directory services as claimed in claim 60, wherein the set of common results includes at least one of security parameters, the DN of the performer of the service or an alias dereferenced flag.

62. A system for implementing directory services as claimed in claim 61 wherein said process of navigating comprises a tree walk, which begins from the root of the directory tree and continues down the directory tree until all the RDNs in a DN have been resolved.

63. A system for implementing directory services as claimed in claim 52, further comprising:

means for converting a DN into an entry ID (EID) and storing said EID; and

wherein said process of navigating for a particular entry comprises, given a DN for the entry, locate the entry in the HIERARCHY Table which has an RDN equal to the first RDN in the DN; and

means to store the EID and recursively locate the entry which has an RDN equal to the next RDN in the DN and a parent equal to the stored EID.

64. A system for implementing directory services as claimed in claim 51, wherein said database returns data as attribute ID and raw data values.

65. A system for implementing directory services as claimed in claim 52, particularly a read service, further comprising:

means for converting a DN into an entry ID (EID) and storing said EID; and

means for reading, in the OBJECT Table, the values of all rows which match the stored EID.

66. A system for implementing directory services as claimed in claim 52 particularly a compare service, further comprising:

means for converting a DN into an entry ID (EID) and storing said EID; and

means for testing, in the OBJECT Table, for a matching value in all rows which match the stored EID and a specified attribute ID (AID).

67. A system for implementing directory services as claimed in claim 52, particularly a list service, further comprising:

means for converting a DN into an entry ID (EID) and storing said EID; and

means for returning the RDNs, in the HIERARCHY Table, for all rows with a parent matching the stored EID.

68. A system for implementing directory services as claimed in claim 52, particularly an add entry service, further comprising:

means for converting all but the last RDN of a DN into an entry ID (EID) and storing said EID; and

means for adding a new EID to the HIERARCHY Table, and for adding to the OBJECT Table rows for each value in the new entry.

69. A system for implementing directory services as claimed in claim 52, particularly a remove entry service, further comprising:

means for converting a DN into an entry ID (EID) and storing said EID; and

means for removing the entry from the HIERARCHY Table, and means for removing from the OBJECT Table all rows which match the stored EID.

70. A system for implementing directory services as claimed in claim 69, further comprising:

means for checking, prior to the converting step, that the entry has no subordinate entries on the tree.

71. A system for implementing directory services as claimed in claim 52, particularly a modify entry service, further comprising:

means for converting a DN into an entry ID (EID) and storing said EID; and

means for, in the OBJECT Table, applying at least one of an add, remove or modify service to rows matching the stored EID.

72. A system for implementing directory services as claimed in claim 52, particularly a modify RDN service, further comprising:

means for converting a DN into an entry ID (EID) and storing said EID;

means to check that the new name (RDN) does not exist in the current level of the subtree, and

means to modify the entry in the HIERARCHY and OBJECT Tables.

73. A system for implementing directory services as claimed in claim 52, particularly a base level search service, further comprising:

means for converting a DN into an entry ID (EID) and storing said EID;

means for reading, in the OBJECT Table, nominated values from rows which match the stored EID where a filter criteria is satisfied.

74. A system for implementing directory services as claimed in claim 52, particularly a one level search service, further comprising:

means for converting a DN into an entry ID (EID) and storing said EID;

means for returning a list of EIDs which have a parent EID matching the stored EID in the HIERARCHY Table and have values which satisfy the filter criteria in the OBJECT Table; and

means for reading, in the OBJECT Table, nominated values for returned EIDs.

75. A system for implementing directory services as claimed in claim 52, particularly a subtree search service, further comprising:

means for converting a DN into an entry ID (EID) and storing said EID;

means for returning a list of EIDs which have a path matching that of the base object in the HIERARCHY Table and have values which satisfy the filter criteria in the OBJECT Table; and

means for reading, in the OBJECT Table, nominated values for returned EIDs.

76. A system for implementing directory services as claimed in claim 52, further comprising:

means for resolving aliases during navigation in response to an alias control flag and the characteristic of the service implemented.

91. A system as set forth in any one of claims 48-90 wherein said directory service is one of an X.500 and a LDAP service.

138. A system as recited in any one of claims 48-90, wherein the directory services implemented are X.500 or LDAP.

77. A system for implementing directory services for a relational data base management system using a relational language comprising:

means for establishing a database using a plurality of tables, each table having a plurality of rows and columns, said database comprising at least one each of a HIERARCHY Table comprising a DIT Table, NAME Table, ALIAS Table and TREE Table, an OBJECT Table comprising a SEARCH Table and an ENTRY Table, and an ATTRIBUTE Table;

means for defining a plurality of relational language commands, each corresponding to a respective one of a plurality of directory services, each service having a corresponding service executing procedure;

means for selecting one of said plurality of directory services;

means for applying a process of name resolution to the selected directory service,

means for executing the procedure corresponding to the selected service, and

means for building a response comprising an error or search result in response to said executing step.

78. A system for implementing directory services as claimed in claim 77 wherein said database comprises a directory tree, having a plurality of distinguished names (DN) each comprising one or more relative distinguished names (RDN), and said step of applying a process of name resolution comprises navigating said directory tree.

79. A system for implementing directory services as claimed in claim 78 wherein said process of navigating comprises a tree walk, which begins from the root of the directory tree and continues down the directory tree until all the RDNs in a DN have been resolved.

80. A system for implementing directory services as claimed in claim 78, further comprising:

means for converting a DN into an entry ID (EID) and storing said EID; and

wherein said process of navigating for a particular entry comprises, given a DN for the entry, locating the entry in the HIERARCHY Table which has an RDN equal to the first RDN in the DN; and

means for storing the EID and recursively locate the entry which has an RDN equal to the next RDN in the DN and a parent equal to the stored EID.

81. A system for implementing directory services as claimed in claim 78, particularly a read service to extract information from an explicitly identified entry, further comprising:

means for performing a tree walk using the DIT Table, resolving aliases if necessary and obtain the base EID;

means for using a path from the TREE Table and raw RDN'"'"'s from the NAME Table, to build a DN and, if no attributes or values are specified, just return the DN, and

if attributes or values are specified as all types and values, return the RAW values from the ENTRY Table for the matching EID, and if attributes or values of selected types and values are specified, obtain attribute IDs (AID'"'"'s) from the ATTRIBUTE Table and then return selected types and/or values for the matching EID.

82. A system for implementing directory services as claimed in claim 78, particularly a compare service for comparing a value with values of a particular attribute type in a particular object entry, further comprising:

means for performing a tree walk using the DIT Table, resolving aliases if necessary, and obtaining the EID of the base object;

means for obtaining, from the ATTRIBUTE Table, the AID of the attribute to be compared;

means for selecting, from the ENTRY Table, the one or more rows matching the EID and AID;

means for comparing the value and return TRUE or FALSE as the compare result; and

means for, if an alias is dereferenced, returning the DN of the selected object, using the path from the TREE Table and the RAW RDN'"'"'s from the NAME Table.

83. A system for implementing directory services as claimed in claim 78, particularly a list service to obtain a list of immediate subordinates of an explicitly identified entry, further comprising:

means for performing a tree walk using the DIT Table, resolving aliases if necessary;

means to obtain the EID of the base object; and

means, using the DIT and NAME Tables, to return an ALIAS flag and RAW RDN rows where PARENT equal to the EID of the base object.

84. A system for implementing directory services as claimed in claim 78, particularly a base object search service, further comprising:

means for performing a tree walk using the DIT Table, resolving aliases if necessary, and obtaining the EID of the base object;

means to apply the filter to attributes and values in the SEARCH Table with the EID of the selected object;

means, if the filter condition is matched, to return the entry Information from the ENTRY Table; and

means, if an alias is dereferenced, to return the DN using the TREE Table to extract the data defining a PATH and the NAME Table to build the DN.

85. A system for implementing directory services as claimed in claim 78 particularly a one level search service, further comprising:

means for performing a tree walk using the DIT Table, resolving aliases if necessary, and obtaining the EID of the base object;

means to check to see if any aliases exist with PARENT=EID and if so resolve them to obtain an aliases dereferenced list;

means, using the search and DIT Tables, to apply the filter (attribute/value conditions) and the scope (PARENT=EID of selected object and any aliases dereferenced) so that a list of matching EID'"'"'s will be returned;

means, if an alias is dereferenced, to return the DN using the TREE Table to extract the information related to the PATH and the NAME Table to build the DN; and

for each matching EID,

means to return the entry information obtained from the SEARCH Table using the ENTRY Table.

86. A system for implementing directory services as claimed in claim 78, particularly a whole subtree search service, further comprising:

means for performing a tree walk using the DIT Table, resolving aliases if necessary, and obtaining the EID of the base object;

means to check to see if any aliases exist with a PATH prefix matching the PATH of the selected object;

means, for each alias discovered, to check to see if the alias points outside the current subtree and, if it does repeat the previous step until all aliases have been resolved, whereby a set of unique base objects will have been found;

means, using the SEARCH and TREE Tables, to apply a filter and a scope to each unique base object so that a list of matching EID'"'"'s will be returned;

means, if an alias is dereferenced during navigation and not during searching, to return the DN using the TREE Table to extract the PATH and the NAME Table to build the DN; and

for each matching EID, means to return the entry information obtained from the SEARCH Table using the ENTRY Table.

87. A system for implementing directory services as claimed in claim 77, particularly an add service to add a leaf entry, either an object entry or an alias entry, to the Directory Information Tree (DIT), further comprising:

means for using the DIT Table, tree walk to the parent of the entry to be added;

means for using the DIT Table, check if the entry exists; and

means, if the entry does not exist, to allocate a new EID and add the entry, insert into the DIT Table, the NAME Table, the TREE Table, the SEARCH Table, the ENTRY Table and, if it is an alias entry, the ALIAS Table.

88. A system for implementing directory services as claimed in claim 77, particularly a remove service to remove a leaf entry, either an object entry or an alias entry, to the Directory Information Tree (DIT), further comprising:

means for performing a tree walk using the DIT Table, and obtaining the EID of the base object;

means, if the entry exists, and it is a leaf entry, then for the condition EID=EID of the selected object, to delete from the DIT Table, the NAME Table, the TREE Table, the SEARCH Table, the ENTRY Table and, if it is an alias entry, the ALIAS Table.

89. A system for implementing directory services as claimed in claim 77, particularly a modify entry service, further comprising:

means for performing a tree walk using the DIT Table, and obtaining the EID of the selected object;

means, for the selected object, to perform one or more of the following actions;

Add Value, Delete Value, Add Attribute, Delete Attribute, whose operations required for each action are as follows;

Add Value;

if the attribute exists, add the value to the ENTRY Table and the SEARCH Table;

Delete Value;

for the ENTRY Table and the SEARCH Table, if the attribute value exists, delete it;

Add Attribute;

if the attribute does not exist, add the Attribute Values to the ENTRY Table and the SEARCH Table; and

Delete Attribute;

for the ENTRY Table and the SEARCH Table, if the attribute exists, delete it.

90. A system of implementing directory services as claimed in claim 77, particularly a modify RDN service, further comprising:

means for performing a tree walk using the DIT Table, and obtaining the EID and Parent EID of the base object;

means, using the DIT Table, to check for equivalent entries and return error if one is found;

means, using the NAME Table, to replace the old RDN with the new RDN;

means, using the DIT Table, to replace the old RDN with a normalised form of the new RDN;

means, using the ENTRY Table, to insert the new value;

means, using the SEARCH Table, to locate value=old RDN and set DISTING to 0 and insert the new value; and

if deleteOldRDN is set to TRUE the operations following the Tree Walk are as follows;

means, using the DIT Table, to check for a sibling with the same name and an EID not equal to the base EID;

means, using the NAME Table, to replace the old RDN with the new RDN;

means, using the DIT Table, to replace the old RDN with a normalised form of the new RDN;

means, using the ENTRY Table, to delete the old value(s) and insert the new value(s); and

means, using the Perform SEARCH Table, to delete the old value(s) and insert the new.

92. A method of creating one or more SQL commands corresponding to a directory service, the method including the steps of:

i. determining the directory service,

ii. applying a process of name resolution to the service,

iii. executing a procedure corresponding to the service, and

iv. building an error or result in response to step iii.

93. A method as claimed in claim 92, comprising, applying at least one service control to the method.

94. A method as claimed in claim 93, wherein the service control comprises at least a time limit.

95. A method as claimed in claim 94, wherein the service control comprises at least a size limit.

96. A method of executing a service in a directory service system, the method including using a DIT Table for a navigate function.

97. A method of executing a service in a directory service system, the method including using a DIT Table for a one level search function.

98. A method of executing a service in a directory service system, the method including using a SEARCH Table for a find function.

99. A method of executing a service in a directory service system, the method including using a NAME Table for a returning DN function.

100. A method of executing a service in a directory service system, the method including using an ENTRY Table for a returning object function.

133. A method as set forth in any one of claims 92-132 wherein said directory service is one of an X.500 or LDAP service.

101. A method of executing a service in a directory service system, the method including using a TREE Table for a returning DN function.

102. A method of executing a service in a directory service system, the method including using a TREE Table for a subtree search function.

103. A method of executing a service in a directory service system, the method including using an ALIAS Table for an alias function.

104. A method of creating one or more SQL commands corresponding to a directory service, the method including the steps of:

i. determining the directory service,

ii. applying a process of name resolution to the service,

iii. executing a procedure corresponding to the service, and

iv. building an error or result in response to step iii,

the method further comprising, applying at least one service control, wherein the step of executing comprises using a DIT Table for a one level search function.

105. A method of creating one or more SQL commands corresponding to a directory service, wherein the service control comprises a time limit.

106. A method of creating one or more SQL commands corresponding to a directory service, wherein the service control comprises a size limit.

108. A method of creating one or more SQL commands corresponding to a directory service as set forth in claim 106, wherein the service control comprises a time limit.

107. A method of creating one or more SQL commands corresponding to a directory service, the method including the steps of:

i. determining the directory service,

ii. applying a process of name resolution to the service,

iii. executing a procedure corresponding to the service, and

v. building an error or result in response to step iii,

the method further comprising, applying at least one service control, wherein the step of executing comprises using a SEARCH Table for a find function.

109. A method of creating one or more SQL commands corresponding to a directory service as set forth in claim 107, wherein the service control comprises a size limit.

110. A method of creating one or more SQL commands corresponding to a directory service, the method including the steps of:

i. determining the directory service,

ii. applying a process of name resolution to the service,

iii. executing a procedure corresponding to the service, and

vi. building an error or result in response to step iii,

the method further comprising, applying at least one service control, wherein the step of executing comprises using a NAME Table for returning a DN function.

111. A method of creating one or more SQL commands corresponding to a directory service as set forth in claim 110, wherein the service control comprises a time limit.

112. A method of creating one or more SQL commands corresponding to a directory service as set forth in claim 110, wherein the service control comprises a size limit.

113. A method of creating one or more SQL commands corresponding to a directory service, the method including the steps of:

i. determining the directory service,

ii. applying a process of name resolution to the service,

iii. executing a procedure corresponding to the service, and

vi. building an error or result in response to step iii,

the method further comprising, applying at least one service control, wherein the step of executing comprises using an ENTRY Table for returning an object function.

114. A method of creating one or more SQL commands corresponding to a directory service as set forth in claim 113, wherein the service control comprises a time limit.

115. A method of creating one or more SQL commands corresponding to a directory service as set forth in claim 113, wherein the service control comprises a size limit.

116. A method of creating one or more SQL commands corresponding to a directory service, the method including the steps of:

i. determining the directory service,

ii. applying a process of name resolution to the service,

iii. executing a procedure corresponding to the service, and

viii. building an error or result in response to step iii,

the method further comprising, applying at least one service control, wherein the step of executing comprises using a TREE Table for returning a DN function.

117. A method of creating one or more SQL commands corresponding to a directory service as set forth in claim 116, wherein the service control comprises a time limit.

118. A method of creating one or more SQL commands corresponding to a directory service as set forth in claim 116, wherein the service control comprises a size limit.

119. A method of creating one or more SQL commands corresponding to a directory service, the method including the steps of:

i. determining the directory service,

ii. applying a process of name resolution to the service,

iii. executing a procedure corresponding to the service, and

ix. building an error or result in response to step iii,

the method further comprising, applying at least one service control, wherein the step of executing comprises using a TREE Table for a subtree search function.

120. A method of creating one or more SQL commands corresponding to a directory service as set forth in claim 119, wherein the service control comprises a time limit.

121. A method of creating one or more SQL commands corresponding to a directory service as set forth in claim 119, wherein the service control comprises a size limit.

122. A method of creating one or more SQL commands corresponding to a directory service, the method including the steps of:

i. determining the directory service,

ii. applying a process of name resolution to the service,

iii. executing a procedure corresponding to the service, and

x. building an error or result in response to step iii,

the method further comprising, applying at least one service control, wherein the step of executing comprises using an ALIAS Table for an alias function.

123. A method of creating one or more SQL commands corresponding to a directory service as set forth in claim 122, wherein the service control comprises a time limit.

124. A method of creating one or more SQL commands corresponding to a directory service as set forth in claim 122, wherein the service control comprises a size limit.

125. A method of providing directory services in a directory service system, the method including the step of:

caching the ATTRIBUTE Table thereby limiting SQL statements issued to the database.

126. A method of providing directory services in a directory service system, the method including the step of:

performing validation in memory.

127. A method of providing arbitrary complexity in directory services in a directory service system, the method including the step of:

in applying an arbitrary filter, building a dynamic SQL equivalent.

128. A method of providing directory services in a directory service system, the method including the step of:

utilising set orientation queries of SQL.

129. A method of providing directory services in a directory service system, the method including the step of:

providing a FLAG column in order to enhance extensibility.

130. A method of providing directory services in a directory service system, the method including the step of:

providing a FLAG column as a ‘

summary’

function of contents of a table.

131. A method of providing directory services in a directory service system, the method including the step of:

providing cached aliases.

132. A method of providing directory services in a directory service system, the method including the step of:

providing a LEV column to shorten indexes on each table.

139. A method of implementing X.500 services in a RDBMS which supports a relational language, using service modeling, comprising:

modeling each of a plurality of X.500 services;

defining the relationships among each of said plurality of X.500 services;

defining a fixed set of queries/services using said modelled X.500 services and relationships; and

processing arbitrary data using said fixed set of queries/services;

wherein said service modeling uses relational queries to satisfy X.500 services compatibly with RDBMS.

140. The method of claim 139, wherein said relational language comprises SQL.

141. The method of claim 139, wherein X.500 services are invoked via a LDAP protocol.

142. The method of claim 140, wherein X.500 services are invoked via an X.500 protocol.

143. The method of claim 139, wherein every data type is treated generically and is assigned an index.

144. The method of claim 139, wherein services are resolved using static SQL statements or dynamic SQL statements.

145. An implementation of X.500 services in a RDBMS which supports a relational language, using service modeling, the implementation comprising:

an ATTRIBUTE Table, where extensibility is addressed by allowing the definition of a new attribute type by adding a row to the table;

an OBJECT Table, which defines the attributes within each object; and

/or

a HIERARCHY Table which defines the relationship between the objects.

146. The implementation of claim 145, wherein said OBJECT Table comprises normalised value columns and raw value columns.

147. The implementation of claim 145, wherein said HIERARCHY Table comprises a normalised name column and a raw name column.

148. The implementation of claim 145, wherein the HIERARCHY Table further comprises an alias column for indicating that an entry is an alias.

149. The implementation of claim 148, wherein the alias column comprises an alias and an A-EID column providing information about the destination to which the alias points.

150. The implementation of claim 148, wherein the HIERARCHY Table comprises a parent column with parent ID information defining the parent entry, and a path column, the path column containing information enabling a determination of the absolute position in a HIERARCHY and a determination if an entry is in a given subtree by its prefix.

161. The invention as herein disclosed.