Central administration of one or more resources

• US 20030233439A1
• Filed: 11/05/2002
• Published: 12/18/2003
• Est. Priority Date: 11/05/2001
• Status: Active Grant

• Current Assignee: Accenture Global Services Limited (Accenture PLC)
• Original Assignee: Accenture Global Services Limited (Accenture PLC)
• Inventors: Stone, Andrew J., Sanner, Robin, Sherrel, Brad, Russell, Bruce, Huckaby, Tim, Jablonski, Marty, McCarthy, Tim
• Granted Patent: US 8,244,837 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: D04B 1/26 stockings
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A central administration tool or manager supports entry or selection of attribute data or datum (e.g., an attribute value) associated with at least one of a resource and a user. The entered or selected attribute data is arranged into a data structure (e.g., a file) for transmission over a communications network. The data structure is transmitted over the communications network to a directory interface. The transmitted data structure is processed to be compatible with interpretation by a directory services system. The directory services system is invoked consistent with the contents of the data structure (e.g., the file) and the previous processing of the data structure. Resources (e.g., applications) that are under the control of the directory services are managed consistent with the contents of the data structure.

Claims

1. A method for managing one or more resources associated with a client-server system, the method comprising:

selecting attribute data associated with at least one of a resource and a user;

arranging the selected attribute data for a user into a data structure for transmission over a communications network; and

transmitting the data structure over the communications in preparation for interpretation by a directory services system.

2. The method according to claim 1 wherein the transmitting comprises transmitting the selected attribute data to the affected resources in a group transmission to multiple resources.

3. The method according to claim 1 wherein the transmitting comprises transmitting the selected data in each affected resource in a series of separate transmissions to multiple resources.

4. The method according to claim 1 further comprising:

processing the data structure to be compatible with interpretation by a directory services system.

5. The method according to claim 1 further comprising:

invoking the directory services system consistent with contents of the transmitted data structure;

managing at least one application under the control of the directory services system consistent with the contents of the data structure.

6. The method according to claim 5 wherein the invoking comprises applying an action selected from the group of modification, deletion, and addition of an attribute of a user to the directory services system.

7. The method according to claim 1 wherein the data structure comprises a file.

8. The method according to claim 1 wherein the arranging step comprises organizing data into an extensible mark-up language file as the data structure.

9. The method according to claim 1 wherein the directory services system comprises a lightweight data access protocol (LDAP) compliant system.

10. A system for managing one or more resources associated with a network, the system comprising:

a data entry module for selecting an attribute value associated with at least one of a user and a resource;

a format arranger for arranging the at least one selected attribute value for a user into a data structure for transmission over a communications network; and

a transmitter for transmitting the data structure over the communications network for processing to be compatible with a directory services system remotely situated from the transmitter.

11. The system of claim 10 further comprising:

a directory interface for processing the data structure to be compatible with interpretation by a directory services system.

12. The system of claim 10 further comprising:

a directory services system managing at least one data structure consistent with the contents of the data structure.

13. The system according to claim 10 wherein the data structure comprises a file.

14. The system according to claim 10 wherein the arranging step comprises organizing data into an extensible mark-up language file as the data structure.

15. The system according to claim 10 wherein the directory services system comprises a lightweight data access protocol (LDAP) compliant system.

16. The system according to claim 10 wherein the directory services system applies an action selected from the group consisting of modification, addition, deletion of an attribute to the directory services system.

17. A method for administering a resource for a user of a computer system, the method comprising:

inputting a request to manage an attribute of a resource;

arranging the request into a file for transmission over a communications network;

determining if a user associated with the request is authorized to carry out a command embedded in the request; and

interpreting the request if the use associated with the request is authorized.

18. The method according to claim 17 wherein the interpreting comprises:

executing the request with respect to data storage associated with one or more applications.

19. The method according to claim 17 further comprising:

updating a value of the attribute of at least one application per the request.

20. The method according to claim 17 further comprising:

saving a former state of the attribute for a directory services system;

reverting to the former state of the attribute for the directory services system if the command cannot be executed by at least one data storage for an application.

21. The method according to claim 17 further comprising:

acknowledging whether or not the request updated a value of the attribute in data storage for at least one application.

22. The method according to claim 17 further comprising:

using a global password and account identifier to access one or more data storage units associated with corresponding applications to update the data storage units consistent with the request.

23. The method according to claim 22 further comprising:

serially updating the values of attributes in the data storage of different applications.

24. A system for administering a resource for a user of a computer system, the system comprising:

a user interface for inputting a request to manage an attribute of a resource;

a central administration tool for arranging the request into a file for transmission over a communications network;

a directory services interface for determining if a user associated with the request is authorized to carry out a command embedded in the request; and

a transaction handler for interpreting the request if the use associated with the request is authorized.

25. The system according to claim 24 wherein the transaction handler executes the request with respect to data storage associated with one or more applications.

26. The system according to claim 24 wherein the transactional handler updates a value of the attribute of at least one application per the request.

27. The system according to claim 24 wherein the directory services interface supports

saving a former state of the attribute for a directory services system, the directory services interface arranged to revert to the former state of the attribute for the directory services system if the command cannot be executed by at least one data storage for an application.

28. The system according to claim 24 wherein the transaction handler generates an acknowledgement for transmission to the central administration tool, the acknowledgement message containing data on whether or not the request updated a value of the attribute in data storage for at least one application.

29. The system according to claim 24 wherein the transaction handler applies a global password and account identifier to access one or more data storage units associated with corresponding applications to update the data storage units consistent with the request.

30. The system according to claim 29 wherein the transactional handler is adapted to serially update the values of attributes in the data storage of different applications.

31. A system for administering a resource for a user of a computer system, the system comprising:

a user interface for inputting a request to manage an attribute of a resource;

a central administration tool for arranging the request into a file for transmission over a communications network;

a directory interface server for determining if a user associated with the request is authorized to carry out a command embedded in the request; and

a transaction server for interpreting the request if the use associated with the request is authorized.

32. A server comprising:

a receiver for receiving a data structure from a central administration tool via communications network;

a directory services system for supporting access of at least one client to at least one resource;

a directory interface for interpreting the data structure to be compatible with the directory services system;

a security module associated with the directory services system, the security module keeping records of security data obtained from the at least one resource.

33. The server according to claim 32 wherein the resource comprises an application.

34. The server according to claim 32 wherein the security module further comprises:

a log-in module having a security message queue for receiving data messages reported from applications; and

a data manager for organizing the received data messages for storage.

35. The server according to claim 32 wherein the security module further comprises:

a log harvester having an extractor for extracting security data from an ancillary support module; and

an organizer for organizing the extracted security data for storage.

36. A client-server data processing system for providing one or more administrators access to at least one resource, the data processing system comprising:

a first security manager having a first set of administrative user identifiers and a first set of corresponding passwords, the first security manager managing access of an administrator to a first resource;

a second security manager having a second set of administrative user identifiers and a second set of corresponding passwords, the second security manager managing access of the administrator to a second resource;

a security controller for interfacing with the first security manager and the second security manager to provide a global user identifier, and

a global password and the global identifier and password triggering the execution of a script, transparent to the administrator, that logs the administrator into the first security manager and the second security manager.

37. The system according to claim 36 further comprising:

a directory services system;

a central authentication module associated with the directory services system, the central authentication module having a third set of user identifiers and corresponding passwords, the global password and the global identifier arranged to log the administrator into a directory services system associated with the central authentication module.

38. The system according to claim 36 wherein the first security manager comprises a knowledge management system.

39. The system according to claim 36 wherein the second security manager comprises a filenet document center.

40. The system according to claim 36 wherein the first manager comprises a lightweight-data-access-protocol compliant knowledge management system.

41. The system according to claim 36 wherein the security controller provides the administrator with access at an administrative level to modify an attribute of at least one resource.

42. The system according to claim 36 wherein the security controller provides the administrator with access at an administrative level to delete an attribute of at least one resource.

43. The system according to claim 36 wherein the security controller provides the administrator with access at an administrative level to add an attribute of at least one resource.

44. The system according to claim 36 wherein at least one of the first resource and the second resource comprises at least one of an application program, a database of user listings, an address of a printer on a network.