Methods, systems and computer program products for changing objects in a directory system

• US 20070043716A1
• Filed: 08/18/2005
• Published: 02/22/2007
• Est. Priority Date: 08/18/2005
• Status: Abandoned Application

• Current Assignee: NetIQ Corporation (Open Text Corporation)
• Original Assignee: NetIQ Corporation (Open Text Corporation)
• Inventors: Blewer, Ronnie, Perdue, David, McClendon, Lee
• Application Number:
  US11/206,933
• Publication Number:
  US 20070043716A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems

Abstract

Methods, systems and computer program products for changing an object associated with a directory system of a computer system and having a current classification are provided. A request to change the object is received. The request includes a specification of a new classification of the object different from the current classification of the object. A template is retrieved identifying attributes associated with the new classification and/or the current classification responsive to the received request. Attributes of the object to change are automatically identified based on a comparison of the template associated with the new classification and/or the current classification and on current attributes of the object responsive to the received request and the identified attributes are changed. The current classification and the new classification may be a position, a role and/or a location of the object and the object may be a user account and the attributes may include group memberships.

Claims

1. A method for changing an object associated with a directory system of a computer system and having a current classification, the method comprising:

receiving a request to change the object, the request including a specification of a new classification of the object different from the current classification of the object;

retrieving a template identifying attributes associated with the new classification and/or the current classification responsive to the received request;

automatically identifying attributes of the object to change based on a comparison of the template associated with the new classification and/or the current classification and on current attributes of the object responsive to the received request; and

changing the identified attributes.

2. The method of claim 1, wherein the current classification and the new classification comprise a position, a role and/or a location of the object.

3. The method of claim 2 wherein the object comprises a user account and wherein the attributes include group memberships.

4. The method of claim 2 wherein automatically identifying attributes of the object to change comprises:

comparing attributes identified in the template associated with the new classification with the current attributes of the object; and

identifying attributes to add to the object that are identified in the template and are not current attributes of the object.

5. The method of claim 2 wherein automatically identifying attributes of the object to change comprises:

comparing attributes identified in the template associated with the current classification with the current attributes of the object; and

identifying attributes to drop from the object that are identified in the template associated with the current classification and are current attributes of the object.

6. The method of claim 5 wherein automatically identifying attributes of the object to change further comprises:

comparing attributes identified in the template associated with the new classification with the current attributes of the object; and

identifying attributes to add to the object that are identified in the template associated with the new classification and are not current attributes of the object.

7. The method of claim 6, wherein changing the identified attributes comprises dropping the identified attributes that are identified in the template associated with the current classification and are current attributes of the object and adding the identified attributes that are identified in the template associated with the new classification and are not current attributes of the object without changing other attributes of the object.

8. The method of claim 7, wherein changing the identified attributes comprises changing a plurality of attributes of the object while retaining at least one attribute of the object without change.

9. The method of claim 7, wherein the object comprises a user account and wherein the attributes include group memberships.

10. The method of claim 9, wherein the attributes further include identification, address, computer resource allocation, telephone and/or organization properties.

11. The method of claim 7, wherein changing the identified attributes is preceded by:

providing a summary of the identified attributes that will be changed; and

receiving a confirmation of the request to change the object responsive to providing the summary; and

wherein changing the identified attributes comprises changing the identified attributes responsive to receipt of the confirmation.

12. The method of claim 11, wherein receiving the confirmation includes receiving a designation of a change in a desired value of at least one of the identified attributes from the summary and wherein changing the identified attributes includes changing the attributes based on the designation of a change in a desired value.

13. The method of claim 7, wherein receiving a request to change the object comprises receiving the request from a user account having associated powers over the object to be changed and wherein changing the identified attributes comprises:

determining if any identified attribute to add would escalate the associated powers over the object to be changed of the user account requesting the change; and

generating an error notification and denying addition of the identified attribute that would escalate the associated power if it is determined that the associated powers would be escalated.

14. The method of claim 7 wherein the directory comprises an operating system directory of the computer system, a database directory and/or a secured computing application directory.

15. The method of claim 7, further comprising:

receiving a designation of desired values for attributes of the object not included in a retrieved template; and

wherein changing the identified attributes further includes changing attributes of the object to the received designated desired values.

16. The method of claim 7, wherein receiving a request to change an object comprises receiving a request to change a plurality of user account objects and wherein retrieving a template, automatically identifying attributes and changing the identified attributes comprises:

generating a worklist defining a task for each of the plurality of user accounts; and

automatically retrieving a template, identifying attributes and changing attributes for each of the plurality of user accounts based on the worklist.

17. The method of claim 7, wherein a plurality of objects are changed and wherein the method further comprises generating a log of changes to the plurality of objects.

18. The method of claim 7, wherein the object is a user account and wherein changing the identified attributes includes changing properties of an electronic mail (email) mailbox of the user account.

19. The method of claim 7, wherein the computer system comprises a network and wherein changing the identified attributes includes changing local attributes associated with the object on an individual computer on the network.

20. A system for changing attributes of an object associated with a directory system of a computer system and having a current classification, the system comprising:

a user interface configured to receive a request to change the object, the request including a specification of a new classification of the object different from the current classification of the object;

a template database including a template identifying attributes associated with the new classification and/or a template identifying attributes associated with the current classification;

an object transform module that identifies attributes of the object to change based on a comparison of the template associated with the new classification and/or the template associated with the current classification and on current attributes of the object and that changes the identified attributes.

21. The system of claim 20, wherein the object comprises a user account and wherein the attributes include group memberships.

22. The system of claim 21, wherein the request is received from a user account having associated powers over the object to be changed, the system further comprising:

a security module that determines if any identified attribute to add would escalate the associated powers over the object to be changed of the user account requesting the change and generates an error notification and denies addition of the identified attribute that would escalate the associated power if it is determined that the associated powers would be escalated.

23. A computer program product for changing an object associated with a directory system of a computer system and having a current classification, the computer program product comprising:

a computer readable medium having computer readable program code embodied therein, the computer readable program code comprising;

computer readable program code configured to receive a request to change the object, the request including a specification of a new classification of the object different from the current classification of the object;

computer readable program code configured to retrieve a template identifying attributes associated with the new classification and/or the current classification responsive to the received request;

computer readable program code configured to automatically identify attributes of the object to change based on a comparison of the template associated with the new classification and/or the current classification and on current attributes of the object responsive to the received request; and

computer readable program code configured to change the identified attributes.

24. The computer program product of claim 23, wherein the object comprises a user account and wherein the attributes include group memberships.

25. The computer program product of claim 24, wherein the request to change the object is received from a user account having associated powers over the object to be changed, the computer program product further comprising.

computer readable program code configured to determine if any identified attribute to add would escalate the associated powers over the object to be changed of the user account requesting the change;

and

computer readable program code configured to generate an error notification and deny addition of the identified attribute that would escalate the associated power if it is determined that the associated powers would be escalated.