Utilizing LDAP directories for application access control and personalization

• US 20040267670A1
• Filed: 06/28/2004
• Published: 12/30/2004
• Est. Priority Date: 06/27/2003
• Status: Active Grant

• Current Assignee: Attachmate Corporation (Open Text Corporation)
• Original Assignee: WRQ, Inc. (Open Text Corporation)
• Inventors: Minyailov, Vyacheslav
• Granted Patent: US 7,571,180 B2
• Time in Patent Office: Days
• US Class Current: 705/51
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 9/4492 Inheritance
• CPC Class Codes: H04L 61/4523 using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99943 Generating database or data structure, e.g. via user interface

Abstract

Lightweight LDAP Access Control for authorization and personalization integrates with a directory service for defining sessions for users and groups without requiring read access or modification to directory schemas. In one exemplary illustrative non-limiting implementation, authorization/personalization data is stored in a private data store outside of the LDAP directory (e.g., on a management or other server). When a user attempts to log on to the computer system, the LDAP directory is queried for a list of associated groups and/or organizational units in the normal way. To compute a resulting set of authorization/personalization rules applicable to the user, an entity (e.g., the management or other server) traverses the organizational hierarchy of the directory groups/OU'"'"'s, overriding the inherited attributes with explicitly associated ones. Integration with existing user/group/organization unit infrastructures is provided while avoiding the need to deploy additional user/group databases. In one example arrangement, an LDAP directory is queried for the list of groups and OUs during user logon. There is no need to replicate user/group directory data in a private data store of the Management Server. This improves performance and eliminates the need to synchronize data between the directory and the private data store of the Management Server. To compute the resulting set of authorization/personalization rules applicable to a user, the Management Server traverses the organizational hierarchy of directory groups/OUs, overriding the inherited attributes with the explicitly mapped ones. This minimizes the amount of administrative work for restricting access to protected resources for individuals. In many cases, users will simply inherit authorization/personalization data from the group/OUs they are members of.

Claims

1. A computer system comprising:

a lightweight directory access protocol directory; and

a management server separate from said directory but providing services integrated therewith, said management server having a private data store outside of the directory that stores authorization/personalization data, said management server querying said directory and applying additional authorization/personalization rules to enhance directory services and override inherited attributes without requiring modification of said directory.

2. A method of authorizing a computer system user comprising:

receiving a request related to said user;

referencing said user in an LDAP directory and, if a corresponding user entry is found, obtaining information pertaining to said user;

associating authorization and/or personalization data pertaining to said user with a protected resource; and

saving said authorization and/or personalization in a private data store separate from said LDAP directory.

3. A storage medium storing executable instructions providing an authorization service for authorizing users to access protected resources, said storage medium storing the following instructions:

first instructions that query and receive user information from a directory database;

second instructions that create authorization associations with respect to user information received from said directory database;

third instructions that store, retrieve said associations to/from a private data store separate from said directory database to override inherited attributes.

4. A computer operating method comprising:

querying an LDAP directory during computer user logon;

traversing an organizational hierarchy of directory information while overriding inherited attributes with explicitly mapped ones;

accessing a private data store separate from said directory, said private data store not replicating substantial user/group directory data to eliminate need for detailed synchronization between the directory and the private data store; and

restricting access to protected resources based on private data store authorization/personalization data contents.

5. A method of logging a user onto a computer system comprising:

receiving a user identification during a log on process;

in response to said received user identification, querying a directory for a list of associated groups and/or organizational units associated with the user;

traversing an organizational hierarchy of directory groups/OU'"'"'s; and

overriding inherited attributes with explicitly associated attributes obtained from a private data store outside of the directory.

6. The method of claim 5 wherein said directory is an LDAP directory.

7. The method of claim 5 wherein said querying is performed by a management server.