IDENTIFYING DYNAMIC GROUPS

• US 20070168530A1
• Filed: 03/12/2007
• Published: 07/19/2007
• Est. Priority Date: 07/11/2002
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Summers, Robert, Delaney, Shawn
• Granted Patent: US 7,613,794 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

Technology is disclosed for identifying dynamic groups that correspond to a user of a system. A system partitions a set of dynamic groups into multiple test sets of dynamic groups. The system selects a test set and determines whether the user corresponds to the test set. In one implementation, the system combines the filters for the dynamic groups in each test set into a single test set filter. The test set filter is satisfied if the filter of any dynamic group in the test set is satisfied. This allows the system to perform a single comparison between the resulting test set filter and the user'"'"'s profile to determine whether the user is a member of any dynamic group in the test set. If the user is not a member of any dynamic group in the test set, the system eliminates all of the test set'"'"'s dynamic groups from consideration, based on the single comparison. Otherwise, the dynamic groups in the test set remain in a list of groups that may include the user. This process is repeated for each test set. After each test set has been evaluated, new test sets are repeatedly generated and evaluated in the above-described fashion using the dynamic groups that are still in consideration. In each iteration, each test set contains fewer dynamic groups. This continues until each test set only contains one dynamic group. After performing an iteration with each test set containing one dynamic group, the only remaining dynamic groups are the ones that include the user as a member.

Claims

1. A method of identifying dynamic groups corresponding to a user, the method comprising:

partitioning a set of dynamic groups into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups; and

determining whether said user corresponds to a test set in said multiple test sets, wherein said test set includes multiple dynamic groups from said set of dynamic groups.

2. A method according to claim 1, wherein determining whether said user corresponds to a test set in said multiple test sets comprises:

setting matching criteria for said test set; and

determining whether said user satisfies said matching criteria.

3. A method according to claim 2, wherein each dynamic group in said test set corresponds to at least a portion of said matching criteria.

4. A method according to claim 2, wherein said matching criteria includes a logical OR of at least one filter from each dynamic group in said test set.

5. A method according to claim 2, wherein said matching criteria is satisfied if a filter for any dynamic group in said test set is satisfied.

6. A method according to claim 2, wherein:

said matching criteria is a rule including a filter component, and

said filter component is satisfied if any filter from a dynamic group in said test set is satisfied.

7. A method according to claim 6, wherein said filter component is a logical OR of a filter from each dynamic group in said test set.

8. A method according to claim 6, wherein:

said filter component is a logical OR of a filter defining each dynamic group in said test set.

9. A method according to claim 6, wherein:

said rule includes a searchbase component, and

said searchbase component corresponds to a subtree containing said user.

10. A method according to claim 6, wherein:

said rule includes a searchbase component, and

said searchbase component corresponds to said user.

11. A method according to claim 10, wherein said user is represented by a user profile in a directory.

12. A method according to claim 11, wherein said determining whether said user satisfies said matching criteria comprises:

searching said directory using said rule.

13. A method according to claim 12, wherein said directory is searched using a LDAP search.

14. A method according to claim 11, wherein said directory employs LDAP.

15. A method according to claim 14, wherein:

said rule includes a scope component; and

said scope component corresponds to a base object scope.

16. A method according to claim 15, wherein said determining whether said user satisfies said matching criteria comprises:

searching said directory using said rule.

17. A method according to claim 11, wherein said directory is in communication with an Identity System.

18. A method according to claim 1, further comprising:

eliminating all dynamic groups in said test set from said set of dynamic groups, if it is determined that said user does not correspond to said test set.

19. A method according to claim 18, wherein said determining whether said user corresponds to a test set in said multiple test sets and said eliminating all dynamic groups in said test set from said set of dynamic groups are performed for each test set in said multiple test sets.

21. A method according to claim 1, further comprising:

removing from said test set all dynamic groups in said test set that do not correspond to said user, if it is determined that said user does correspond to said test set.

22. A method according to claim 21, wherein said removing from said test set all dynamic groups in said test set that do not correspond to said user comprises:

removing from said set of dynamic groups said all dynamic groups in said test set that do not correspond to said user.

24. A method according to claim 21, further comprising:

eliminating all dynamic groups in said test set from said set of dynamic groups, if it is determined that said user does not correspond to said test set.

25. A method according to claim 24, wherein said determining whether said user corresponds to a test set in said multiple test sets, said removing from said set of dynamic groups all dynamic groups in said test set that do not correspond to said user, and said eliminating all dynamic groups in said test set from said set of dynamic groups, are performed for each test set in said multiple test sets.

26. A method according to claim 1, wherein said determining whether said user corresponds to a test set in said multiple test sets comprises:

determining that all dynamic groups in said test set do not correspond to said user, based on a single directory search.

27. A method according to claim 1, wherein:

said method is performed as part of an Identity System.

28. A method according to claim 1, wherein:

said method is performed as part of an Access System.

29. A method according to claim 1, wherein:

said method is performed as part of an integrated Access System and Identity System.

30. A method according to claim 1, wherein determining whether said user corresponds to a test set in said multiple test sets is performed without accessing a directory server.

31. A method according to claim 30, wherein said determining whether said user corresponds to a test set in said multiple test sets is performed using a filter tester.

32. A method according to claim 1, wherein determining whether said user corresponds to a test set in said multiple test sets is performed using an SQL command.

20. (canceled)

23. (canceled)

33. One or more processor readable storage devices having processor readable code embodied on said one or more processor readable storage devices, said processor readable code for programming one or more processors and comprising:

code for partitioning a set of dynamic groups into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups; and

code for determining whether a user corresponds to a test set in said multiple test sets, wherein said test set includes multiple dynamic groups from said set of dynamic groups.

34. One or more processor readable storage devices according to claim 33, wherein said code for determining whether a user corresponds to a test set in said multiple test sets comprises:

code for setting matching criteria for said test set; and

code for determining whether said user satisfies said matching criteria.

35. One or more processor readable storage devices according to claim 34, wherein:

said matching criteria is a rule including a filter component, and

said filter component is satisfied if a filter for any dynamic group in said test set is satisfied.

36. One or more processor readable storage devices according to claim 35, wherein:

said rule includes a searchbase component, and

said searchbase component corresponds to said user.

37. One or more processor readable storage devices according to claim 36, wherein said user is represented by a user profile in a directory.

38. One or more processor readable storage devices according to claim 37, wherein said code for determining whether said user satisfies said matching criteria comprises:

code for searching said directory using said rule.

39. One or more processor readable storage devices according to claim 38, wherein said code for searching said directory using said rule comprises code for searching using a LDAP search.

40. One or more processor readable storage devices according to claim 37, wherein:

said rule includes a scope component, and

said scope component corresponds to a base object scope.

41. One or more processor readable storage devices according to claim 40, wherein said code for determining whether said user satisfies said matching criteria comprises:

code for searching said directory using said rule.

42. One or more processor readable storage devices according to claim 33, wherein said processor readable code further comprises:

code for eliminating all dynamic groups in said test set from said set of dynamic groups, if it is determined that said user does not correspond to said test set.

43. One or more processor readable storage devices according to claim 42, wherein said processor readable code comprises, for each test set in said multiple test sets, code for determining whether said user corresponds to a test set in said multiple test sets and code for eliminating all dynamic groups in said test set from said set of dynamic groups

45. One or more processor readable storage devices according to claim 33, wherein said processor readable code further comprises:

code for removing from said test set all dynamic groups in said test set that do not correspond to said user, if it is determined that said user does correspond to said test set.

46. One or more processor readable storage devices according to claim 45, wherein said code for removing from said test set all dynamic groups in said test set that do not correspond to said user comprises:

code for removing from said set of dynamic groups said all dynamic groups in said test set that do not correspond to said user.

49. One or more processor readable storage devices according to claim 33, wherein said code for determining whether a user corresponds to a test set in said multiple test sets comprises:

code for determining that all dynamic groups in said test set do not correspond to said user, based on a single directory search.

50. One or more processor readable storage devices according to claim 33, wherein:

said processor readable code is executable by an Identity System.

51. One or more processor readable storage devices according to claim 33, wherein:

said processor readable code is executable by an Access System.

52. One or more processor readable storage devices according to claim 33, wherein:

said processor readable code is executable by an integrated Access System and Identity System.

44. (canceled)

47-48. -48. (canceled)

53. An apparatus, comprising:

one or more storage devices; and

one or more processors in communication with said one or more storage devices, said one or more storage devices comprising processor readable code for programming said one or more processors, said processor readable code comprising;

code for partitioning a set of dynamic groups into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups; and

code for determining whether a user corresponds to a test set in said multiple test sets, wherein said test set includes multiple dynamic groups from said set of dynamic groups.

54. An apparatus according to claim 53, wherein said code for determining whether a user corresponds to a test set in said multiple test sets comprises:

code for setting matching criteria for said test set; and

code for determining whether said user satisfies said matching criteria.

55. An apparatus according to claim 54, wherein:

said matching criteria is a rule including a filter component, and

said filter component is satisfied if a filter for any dynamic group in said test set is satisfied.

56. An apparatus according to claim 55, wherein:

said rule includes a searchbase component, and

said searchbase component corresponds to said user.

57. An apparatus according to claim 56, wherein said user is represented by a user profile in a directory.

58. An apparatus according to claim 57, wherein said code for determining whether said user satisfies said matching criteria comprises:

code for searching said directory using said rule.

59. An apparatus according to claim 57, wherein:

said rule includes a scope component; and

said scope component corresponds to a base object scope.

60. An apparatus according to claim 59, wherein said code for determining whether said user satisfies said matching criteria comprises:

code for searching said directory using said rule.

61. An apparatus according to claim 53, wherein said processor readable code further comprises:

code for eliminating all dynamic groups in said test set from said set of dynamic groups, if it is determined that said user does not correspond to said test set.

63. An apparatus according to claim 53, wherein said processor readable code further comprises:

code for removing from said test set all dynamic groups in said test set that do not correspond to said user, if it is determined that said user does correspond to said test set; and

code for eliminating all dynamic groups in said test set from said set of dynamic groups, if it is determined that said user does not correspond to said test set.

64. An apparatus according to claim 53, wherein said code for determining whether a user corresponds to a test set in said multiple test sets comprises:

code for determining that all dynamic groups in said test set do not correspond to said user, based on a single directory search.

65. An apparatus according to claim 53, wherein:

said processor readable code is executable by an Identity System.

66. An apparatus according to claim 53, wherein:

said processor readable code is executable by an Access System.

62. (canceled)

67. A method of identifying dynamic profiles corresponding to an entity, the method comprising:

partitioning a set of dynamic profiles into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic profile from said set of dynamic profiles; and

determining whether said entity corresponds to a test set in said multiple test sets, wherein said test set includes multiple dynamic profiles from said set of dynamic profiles.

68. A method according to claim 67, wherein said determining whether said entity corresponds to a test set in said multiple test sets comprises:

setting matching criteria for said test set; and

determining whether said entity satisfies said matching criteria.

69. A method according to claim 68, wherein said matching criteria is satisfied if a filter for any dynamic profile in said test set is satisfied.

70. A method according to claim 68, wherein:

said matching criteria is a rule including a filter component, and

said filter component is satisfied if any filter from a dynamic group in said test set is satisfied.

71. A method according to claim 70, wherein:

said rule includes a searchbase component;

said searchbase component corresponds to said entity;

said rule includes a scope component; and

said scope component corresponds to a base object scope.

72. A method according to claim 71, wherein said entity is represented by a profile in a directory, wherein said determining whether said entity satisfies said matching criteria comprises:

code for searching said directory using said rule.

73. A method according to claim 67, wherein said entity is represented by a user profile and said set of dynamic profiles includes dynamic group profiles.

74. A method according to claim 67, further comprising:

eliminating all dynamic profiles in said test set from said set of dynamic profiles, if it is determined that said entity does not correspond to said test set.

75. A method according to claim 67, wherein said determining whether said entity corresponds to a test set in said multiple test sets comprises:

determining that all dynamic profiles in said test set do not correspond to said entity, based on a single directory search.

76. One or more processor readable storage devices having processor readable code embodied on said one or more processor readable storage devices, said processor readable code for programming one or more processors and comprising:

code for partitioning a set of dynamic profiles into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic profile from said set of dynamic profiles; and

code for determining whether said entity corresponds to a test set in said multiple test sets, wherein said test set includes multiple dynamic profiles from said set of dynamic profiles.

77. One or more processor readable storage devices according to claim 76, wherein said code for determining whether said entity corresponds to a test set in said multiple test sets comprises:

code for setting matching criteria for said test set; and

code for determining whether said entity satisfies said matching criteria, wherein said matching criteria is satisfied if a filter for any dynamic profile in said test set is satisfied.

78. One or more processor readable storage devices according to claim 77, wherein:

said matching criteria is a rule;

said rule includes a filter component;

said filter component is satisfied if a filter for any dynamic profile in said test set is satisfied;

said rule includes a searchbase component;

said searchbase component corresponds to said entity;

said rule includes a scope component; and

said scope component corresponds to a base object scope.

79. One or more processor readable storage devices according to claim 78, wherein said entity is represented by a profile in a directory, wherein said code for determining whether said entity satisfies said matching criteria comprises:

code for searching said directory using said rule.

80. One or more processor readable storage devices according to claim 76, wherein said processor readable code further comprises:

code for eliminating all dynamic profiles in said test set from said set of dynamic profiles, if it is determined that said entity does not correspond to said test set.

81. One or more processor readable storage devices according to claim 76, wherein said code for determining whether said entity corresponds to a test set in said multiple test sets comprises:

code for determining that all dynamic profiles in said test set do not correspond to said entity, based on a single directory search.

82. An apparatus, comprising:

one or more storage devices; and

one or more processors in communication with said one or more storage devices, said one or more storage devices comprising processor readable code for programming said one or more processors, said processor readable code comprising;

code for partitioning a set of dynamic profiles into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic profile from said set of dynamic profiles; and

code for determining whether said entity corresponds to a test set in said multiple test sets, wherein said test set includes multiple dynamic profiles from said set of dynamic-profiles.