Identifying dynamic groups

• US 20040010606A1
• Filed: 12/23/2002
• Published: 01/15/2004
• Est. Priority Date: 07/11/2002
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Summers, Robert, Delaney, Shawn P.
• Granted Patent: US 7,206,851 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

Technology is disclosed for identifying dynamic groups that correspond to a user of a system. A system partitions a set of dynamic groups into multiple test sets of dynamic groups. The system selects a test set and determines whether the user corresponds to the test set. In one implementation, the system combines the filters for the dynamic groups in each test set into a single test set filter. The test set filter is satisfied if the filter of any dynamic group in the test set is satisfied. This allows the system to perform a single comparison between the resulting test set filter and the user'"'"'s profile to determine whether the user is a member of any dynamic group in the test set. If the user is not a member of any dynamic group in the test set, the system eliminates all of the test set'"'"'s dynamic groups from consideration, based on the single comparison. Otherwise, the dynamic groups in the test set remain in a list of groups that may include the user. This process is repeated for each test set. After each test set has been evaluated, new test sets are repeatedly generated and evaluated in the above-described fashion using the dynamic groups that are still in consideration. In each iteration, each test set contains fewer dynamic groups. This continues until each test set only contains one dynamic group. After performing an iteration with each test set containing one dynamic group, the only remaining dynamic groups are the ones that include the user as a member.

Claims

1. A method of identifying dynamic groups corresponding to a user, comprising the steps of:

(a) partitioning a set of dynamic groups into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups; and

(b) determining whether said user corresponds to a test set in said multiple test sets, wherein said test set includes multiple dynamic groups from said set of dynamic groups.

2. A method according to claim 1, wherein said step (b) includes the steps of:

(1) setting matching criteria for said test set; and

(2) determining whether said user satisfies said matching criteria.

3. A method according to claim 2, wherein each dynamic group in said test set corresponds to at least a portion of said matching criteria.

4. A method according to claim 2, wherein said matching criteria includes a logical OR of at least one filter from each dynamic group in said test set.

5. A method according to claim 2, wherein said matching criteria is satisfied if a filter for any dynamic group in said test set is satisfied.

6. A method according to claim 2, wherein:

said matching criteria is a rule including a filter component, and

said filter component is satisfied if any filter from a dynamic group in said test set is satisfied.

7. A method according to claim 6, wherein said filter component is a logical OR of a filter from each dynamic group in said test set.

8. A method according to claim 6, wherein:

said filter component is a logical OR of a filter defining each dynamic group in said test set.

9. A method according to claim 6, wherein:

said rule includes a searchbase component, and

said searchbase component corresponds to a subtree containing said user.

10. A method according to claim 6, wherein:

said rule includes a searchbase component, and

said searchbase component corresponds to said user.

11. A method according to claim 10, wherein said user is represented by a user profile in a directory.

12. A method according to claim 11, wherein said step (b)(2) includes the step of:

(i) searching said directory using said rule.

13. A method according to claim 12, wherein said step (b)(2)(i) is performed using a LDAP search.

14. A method according to claim 11, wherein said directory employs LDAP.

15. A method according to claim 14, wherein:

said rule includes a scope component; and

said scope component corresponds to a base object scope.

16. A method according to claim 15, wherein said step (b)(2) includes the step of:

(i) searching said directory using said rule.

17. A method according to claim 11, wherein said directory is in communication with an Identity System.

18. A method according to claim 1, wherein said method further includes the step of:

(c) eliminating all dynamic groups in said test set from said set of dynamic groups, if it is determined in said step (b) that said user does not correspond to said test set.

19. A method according to claim 18, wherein said steps (b) and (c) are performed for each test set in said multiple test sets.

20. A method according to claim 19, wherein said method further includes the steps of:

(d) partitioning said set of dynamic groups into multiple second test sets, wherein each test set in said multiple second test sets includes at least one dynamic group from said set of dynamic groups, wherein said step (d) is performed after said steps (b) and (c) have been performed for each test set in said multiple test sets; and

(e) determining whether said user corresponds to a test set in said multiple second test sets.

21. A method according to claim 1, wherein said method further includes the step of:

(f) removing from said test set all dynamic groups in said test set that do not correspond to said user, if it is determined in said step (b) that said user does correspond to said test set.

22. A method according to claim 21, wherein said step (f) includes the step of:

(1) removing from said set of dynamic groups said all dynamic groups in said test set that do not correspond to said user.

23. A method according to claim 22, wherein said step (f) includes the steps of:

(2) partitioning said test set into multiple second test sets, wherein each test set in said multiple second test sets includes at least one dynamic group from said test set, wherein said step (f)(2) is performed after said step (b) has been performed for said test set; and

(3) determining whether said user corresponds to a test set in said multiple second test sets.

24. A method according to claim 21, wherein said method further includes the step of:

(g) eliminating all dynamic groups in said test set from said set of dynamic groups, if it is determined in said step (b) that said user does not correspond to said test set.

25. A method according to claim 24, wherein said steps (b), (f), and (g) are performed for each test set in said multiple test sets.

26. A method according to claim 1, wherein said step (b) includes the step of:

(1) determining that all dynamic groups in said test set do not correspond to said user, based on a single directory search.

27. A method according to claim 1, wherein:

said method is performed as part of an Identity System.

28. A method according to claim 1, wherein:

said method is performed as part of an Access System.

29. A method according to claim 1, wherein:

said method is performed as part of an integrated Access System and Identity System.

30. A method according to claim 1, wherein step (b) is performed without accessing a directory server.

31. A method according to claim 30, wherein said step (b) is performed using a filter tester.

32. A method according to claim 1, wherein said step (b) is performed using an SQL command.

33. One or more processor readable storage devices having processor readable code embodied on said one or more processor readable storage devices, said processor readable code for programming one or more processors to perform a method comprising the steps of:

(a) partitioning a set of dynamic groups into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups; and

(b) determining whether a user corresponds to a test set in said multiple test sets, wherein said test set includes multiple dynamic groups from said set of dynamic groups.

34. One or more processor readable storage devices according to claim 33, wherein said step (b) includes the steps of:

(1) setting matching criteria for said test set; and

(2) determining whether said user satisfies said matching criteria.

35. One or more processor readable storage devices according to claim 34, wherein:

said matching criteria is a rule including a filter component, and

said filter component is satisfied if a filter for any dynamic group in said test set is satisfied.

36. One or more processor readable storage devices according to claim 35, wherein:

said rule includes a searchbase component, and

said searchbase component corresponds to said user.

37. One or more processor readable storage devices according to claim 36, wherein said user is represented by a user profile in a directory.

38. One or more processor readable storage devices according to claim 37, wherein said step (b)(2) includes the step of:

(i) searching said directory using said rule.

39. One or more processor readable storage devices according to claim 38, wherein said step (b)(2)(i) is performed using a LDAP search.

40. One or more processor readable storage devices according to claim 37, wherein:

said rule includes a scope component; and

said scope component corresponds to a base object scope.

41. One or more processor readable storage devices according to claim 40, wherein said step (b)(2) includes the step of:

(i) searching said directory using said rule.

42. One or more processor readable storage devices according to claim 33, wherein said method further includes the step of:

(c) eliminating all dynamic groups in said test set from said set of dynamic groups, if it is determined in said step (b) that said user does not correspond to said test set.

43. One or more processor readable storage devices according to claim 42, wherein said steps (b) and (c) are performed for each test set in said multiple test sets.

44. One or more processor readable storage devices according to claim 43, wherein said method further includes the steps of:

(d) partitioning said set of dynamic groups into multiple second test sets, wherein each test set in said multiple second test sets includes at least one dynamic group from said set of dynamic groups, wherein said step (d) is performed after said steps (b) and (c) have been performed for each test set in said multiple test sets; and

(e) determining whether said user corresponds to a test set in said multiple second test sets.

45. One or more processor readable storage devices according to claim 33, wherein said method further includes the step of:

(f) removing from said test set all dynamic groups in said test set that do not correspond to said user, if it is determined in said step (b) that said user does correspond to said test set.

46. One or more processor readable storage devices according to claim 45, wherein said step (f) includes the step of:

(1) removing from said set of dynamic groups said all dynamic groups in said test set that do not correspond to said user.

47. One or more processor readable storage devices according to claim 45, wherein said method further includes the step of:

(g) eliminating all dynamic groups in said test set from said set of dynamic groups, if it is determined in said step (b) that said user does not correspond to said test set.

48. One or more processor readable storage devices according to claim 47, wherein said steps (b), (f), and (g) are performed for each test set in said multiple test sets.

49. One or more processor readable storage devices according to claim 33, wherein said step (b) includes the step of:

(1) determining that all dynamic groups in said test set do not correspond to said user, based on a single directory search.

50. One or more processor readable storage devices according to claim 33, wherein:

said method is performed as part of an Identity System.

51. One or more processor readable storage devices according to claim 33, wherein:

said method is performed as part of an Access System.

52. One or more processor readable storage devices according to claim 33, wherein:

said method is performed as part of an integrated Access System and Identity System.

53. An apparatus, comprising:

one or more storage devices; and

one or more processors in communication with said one or more storage devices, said one or more processors perform a method comprising the steps of;

(a) partitioning a set of dynamic groups into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups; and

(b) determining whether a user corresponds to a test set in said multiple test sets, wherein said test set includes multiple dynamic groups from said set of dynamic groups.

54. An apparatus according to claim 53, wherein said step (b) includes the steps of:

(1) setting matching criteria for said test set; and

(2) determining whether said user satisfies said matching criteria.

55. An apparatus according to claim 54, wherein:

said matching criteria is a rule including a filter component, and

said filter component is satisfied if a filter for any dynamic group in said test set is satisfied.

56. An apparatus according to claim 55, wherein:

said rule includes a searchbase component, and

said searchbase component corresponds to said user.

57. An apparatus according to claim 56, wherein said user is represented by a user profile in a directory.

58. An apparatus according to claim 57, wherein said step (b)(2) includes the step of:

(i) searching said directory using said rule.

59. An apparatus according to claim 57, wherein:

said rule includes a scope component; and

said scope component corresponds to a base object scope.

60. An apparatus according to claim 59, wherein said step (b)(2) includes the step of:

(i) searching said directory using said rule.

61. An apparatus according to claim 53, wherein said method further includes the step of:

(c) eliminating all dynamic groups in said test set from said set of dynamic groups, if it is determined in said step (b) that said user does not correspond to said test set.

62. An apparatus according to claim 61, wherein said steps (b) and (c) are performed for each test set in said multiple test sets, wherein said method further includes the steps of:

(d) partitioning said set of dynamic groups into multiple second test sets, wherein each test set in said multiple second test sets includes at least one dynamic group from said set of dynamic groups, wherein said step (d) is performed after said steps (b) and (c) have been performed for each test set in said multiple test sets; and

(e) determining whether said user corresponds to a test set in said multiple second test sets.

63. An apparatus according to claim 53, wherein said method further includes the steps of:

(f) removing from said test set all dynamic groups in said test set that do not correspond to said user, if it is determined in said step (b) that said user does correspond to said test set; and

(g) eliminating all dynamic groups in said test set from said set of dynamic groups, if it is determined in said step (b) that said user does not correspond to said test set, wherein said steps (b), (f), and (g) are performed for each test set in said multiple test sets.

64. An apparatus according to claim 53, wherein said step (b) includes the step of:

(1) determining that all dynamic groups in said test set do not correspond to said user, based on a single directory search.

65. An apparatus according to claim 53, wherein:

said method is performed as part of an Identity System.

66. An apparatus according to claim 53, wherein:

said method is performed as part of an Access System.

67. A method of identifying dynamic profiles corresponding to an entity, comprising the steps of:

(a) partitioning a set of dynamic profiles into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic profile from said set of dynamic profiles; and

(b) determining whether said entity corresponds to a test set in said multiple test sets, wherein said test set includes multiple dynamic profiles from said set of dynamic profiles.

68. A method according to claim 67, wherein said step (b) includes the steps of:

(1) setting matching criteria for said test set; and

(2) determining whether said entity satisfies said matching criteria.

69. A method according to claim 68, wherein said matching criteria is satisfied if a filter for any dynamic profile in said test set is satisfied.

70. A method according to claim 68, wherein:

said matching criteria is a rule including a filter component, and

said filter component is satisfied if any filter from a dynamic group in said test set is satisfied.

71. A method according to claim 70, wherein:

said rule includes a searchbase component;

said searchbase component corresponds to said entity;

said rule includes a scope component; and

said scope component corresponds to a base object scope.

72. A method according to claim 71, wherein said entity is represented by a profile in a directory, wherein said step (b)(2) includes the step of:

(i) searching said directory using said rule.

73. A method according to claim 67, wherein said entity is represented by a user profile and said set of dynamic profiles includes dynamic group profiles.

74. A method according to claim 67, wherein said method further includes the step of:

(c) eliminating all dynamic profiles in said test set from said set of dynamic profiles, if it is determined in said step (b) that said entity does not correspond to said test set, wherein said steps (b) and (c) are performed for each test set in said multiple test sets.

75. A method according to claim 67, wherein said step (b) includes the step of:

(1) determining that all dynamic profiles in said test set do not correspond to said entity, based on a single directory search.

76. One or more processor readable storage devices having processor readable code embodied on said one or more processor readable storage devices, said processor readable code for programming one or more processors to perform a method comprising the steps of:

(a) partitioning a set of dynamic profiles into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic profile from said set of dynamic profiles; and

(b) determining whether said entity corresponds to a test set in said multiple test sets, wherein said test set includes multiple dynamic profiles from said set of dynamic profiles.

77. One or more processor readable storage devices according to claim 76, wherein said step (b) includes the steps of:

(1) setting matching criteria for said test set; and

(2) determining whether said entity satisfies said matching criteria, wherein said matching criteria is satisfied if a filter for any dynamic profile in said test set is satisfied.

78. One or more processor readable storage devices according to claim 77, wherein:

said matching criteria is a rule;

said rule includes a filter component;

said filter component is satisfied if a filter for any dynamic profile in said test set is satisfied;

said rule includes a searchbase component;

said searchbase component corresponds to said entity;

said rule includes a scope component; and

said scope component corresponds to a base object scope.

79. One or more processor readable storage devices according to claim 78, wherein said entity is represented by a profile in a directory, wherein said step (b)(2) includes the step of:

(i) searching said directory using said rule.

80. One or more processor readable storage devices according to claim 76, wherein said method further includes the step of:

(c) eliminating all dynamic profiles in said test set from said set of dynamic profiles, if it is determined in said step (b) that said entity does not correspond to said test set, wherein said steps (b) and (c) are performed for each test set in said multiple test sets.

81. One or more processor readable storage devices according to claim 76, wherein said step (b) includes the step of:

(1) determining that all dynamic profiles in said test set do not correspond to said entity, based on a single directory search.