User account validity definition in clustered computer systems

• US 20070180128A1
• Filed: 01/18/2006
• Published: 08/02/2007
• Est. Priority Date: 01/18/2006
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Behrend, George, DeRobertis, Christopher
• Application Number:
  US11/334,210
• Publication Number:
  US 20070180128A1
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment

Abstract

Disclosed are a method of and system for defining user account validity in a cluster of computer systems. The method comprises the steps of providing a centralized management system for said cluster; and using said centralized management system to maintain a record indicating, for each user of the cluster, whether the user is valid on each of the computer systems in the cluster. Preferably, the step of using said centralized management system includes the step of using said centralized management system to create a user account validity definition, and to identify in said definition which ones of the users are valid on which ones of the computer systems.

Claims

1. A method of defining user account validity in a cluster of computer systems, the method comprising the steps of:

providing a centralized management system for said cluster; and

using said centralized management system to maintain a record indicating, for each user of the cluster, whether the user is valid on each of the computer systems in the cluster.

2. A method according to claim 1, wherein the step of using said centralized management system includes the step of using said centralized management system to create a user account validity definition, and to identify in said definition which ones of the users are valid on which ones of the computer systems.

3. A method according to claim 1, comprising the further steps of:

providing each of the computer systems of the cluster with a user authentication module; and

when one of the users requests authentication on one of the computer systems, using said user authentication module of said one of the computer systems to determine whether said one of the users is valid on said one of the computer systems.

4. A method according to claim 3, wherein:

the step of using said centralized management system to maintain a record includes the step of maintaining a list on the centralized management system identifying which of the users have access to which of the computer systems; and

the step of using the authentication module includes the step of using the authentication module to ask the centralized management system whether said one of the users is valid on said one of the computer systems.

5. A method according to claim 3, comprising the further step of:

providing each of the computer systems with a cache of user account values; and

wherein the step of using the authentication module includes the step of using the authentication module of said one of the computer systems to access the cache of user account values of said one of the computer systems to determine if said one of the users is valid on said one of the computer systems.

6. A method according to claim 1, wherein the using step includes the steps of:

identifying groups of nodes; and

for each of at least some of the users, identifying which ones of the computer systems that said user is valid on by identifying one of said group of nodes.

7. A system for defining user account validity in a cluster of computer systems, the system comprising

a centralized manager for said cluster;

and

said centralized manager including means to maintain a record indicating, for each user of the cluster, whether the user is valid on each of the computer systems in the cluster.

8. A system according to claim 7, wherein the means to maintain a record includes means to create a user account validity definition, and to identify in said definition which ones of the users are valid on which ones of the computer systems.

9. A system according to claim 7, further comprising:

a plurality of user authentication modules, each of the computer systems of the cluster being provided with one of the user authentication module; and

wherein, when one of the users requests authentication on one of the computer systems, said one of the computer systems uses the user authentication modules of said one of the computer systems to determine whether said one of the users is valid on said one of the computer systems.

10. A system according to claim 9, wherein:

the means to maintain a record includes means to maintain a list on the centralized manager identifying which of the users have access to which of the computer systems; and

the authentication module of each one of the computer systems includes means to ask the centralized manager whether one of the users is valid on said one of the computer systems.

11. A system according to claim 9, wherein:

each of the computer systems includes a cache of user account values; and

when one of the users requests authentication on one of the computer systems, said one of the computer systems uses the user authentication module of said one of the computer systems to access the cache of user account values of said one of the computer systems to determine if said one of the users is valid on said one of the computer systems.

12. A system according to claim 7, wherein the centralized manager includes:

means for identifying groups of nodes; and

means for identifying, for each of at least some of the users, which ones of the computer systems that said user is valid on by identifying one of said groups of nodes.

13. A program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform method steps for defining user account validity in a cluster of computer systems, the method comprising the steps of:

accessing a centralized management system for said cluster; and

using said centralized management system to maintain a record indicating, for each user of the cluster, whether the user is valid on each of the computer systems in the cluster.

14. A program storage device according to claim 13, wherein the step of using said centralized management system includes the step of using said centralized management system to create a user account validity definition, and to identify in said definition which ones of the users are valid on which ones of the computer systems.

15. A program storage device according to claim 13, wherein said method steps comprise the further steps of:

providing each of the computer systems of the cluster with a user authentication module; and

when one of the users requests authentication on one of the computer systems, using said user authentication module of said one of the computer systems to determine whether said one of the users is valid on said one of the computer systems.

16. A program storage device according to claim 15, wherein:

the step of using said centralized management system to maintain a record includes the step of maintaining a list on the centralized management system identifying which of the users have access to which of the computer systems; and

the step of using the authentication module includes the step of using the authentication module to ask the centralized management system whether said one of the users is valid on said one of the computer systems.

17. A program storage device according to claim 15, wherein said method steps comprise the further step of:

providing each of the computer systems with a cache of user account values; and

wherein the step of using the authentication module includes the step of using the authentication module of said one of the computer systems to access the cache of user account values of said one of the computer systems to determine if said one of the users is valid on said one of the computer systems.

18. A program storage device according to claim 13, wherein the using step includes the steps of:

identifying groups of nodes; and

for each of at least some of the users, identifying which ones of the computer systems that said user is valid on by identifying one of said group of nodes.