Role based groups

• US 20080208807A1
• Filed: 02/27/2007
• Published: 08/28/2008
• Est. Priority Date: 02/27/2007
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Rowley, Peter Andrew
• Granted Patent: US 7,720,881 B2
• Time in Patent Office: Days
• US Class Current: 707/3
• CPC Class Codes: G06F 16/10 File systems; File servers

Abstract

A method and apparatus for managing group based roles in a directory server is described. In one embodiment, a group of entries is defined in the directory server. One or more of the entries possess a group based role. The group based role points to one or more groups. Entries that belong to a group pointed by the group based role also possess the group based role.

Claims

1. A computer-implemented method for managing a directory server, the method comprising:

defining at least one group of entries in the directory server, at least one of the entries associated with a group based role, the group based role associated with one or more groups;

determining which entry possesses the group based role by querying members in the one or more groups associated with the group based role;

providing the plurality of entries that possess the group based role to a client, the plurality of entries being within a scope of the group based role.

2. The method of claim 1 further comprising:

receiving from the client, a request for determining if an entry of the directory server possesses a role, the request comprising an nsrole attribute.

3. The method of claim 1 further comprising:

evaluating members of a static group, the static group listing at least one entry in the directory server.

4. The method of claim 1 further comprising:

evaluating members of a dynamic group, the dynamic group comprising a search criteria for the entries in the directory server.

5. The method of claim 1 wherein the directory server comprises a Lightweight Directory Access Protocol (LDAP) repository.

15. The article of manufacture of claim 1 wherein the directory server comprises a Lightweight Directory Access Protocol (LDAP) repository.

6. An apparatus comprising:

a directory server to define at least one group of entries in the directory server, at least one of the entries associated with a group based role, the group based role associated with one or more groups, to determine which entry possesses the group based role by querying members in the one or more groups associated with the group based role, and to provide the plurality of entries that possess the group based role to a client, the plurality of entries being within a scope of the group based role.

7. The apparatus of claim 6 wherein the directory server is to receive from the client, a request for determining if an entry of the directory server possesses a role, the request comprising an nsrole attribute.

8. The apparatus of claim 6 wherein the directory server is to evaluate members of a static group, the static group listing at least one entry in the directory server.

9. The apparatus of claim 6 wherein the directory server is evaluate members of a dynamic group, the dynamic group comprising a search criteria for the entries in the directory server.

10. The apparatus of claim 6 wherein the directory server comprises a Lightweight Directory Access Protocol (LDAP) repository.

11. An article of manufacture comprising:

a machine-accessible storage medium including data that, when accessed by a machine, cause the machine to perform a method comprising;

defining at least one group of entries in the directory server, at least one of the entries associated with a group based role, the group based role associated with one or more groups;

determining which entry possesses the group based role by querying members in the one or more groups associated with the group based role;

providing the plurality of entries that possess the group based role to a client, the plurality of entries being within a scope of the group based role.

12. The article of manufacture of claim 11 wherein the method further comprises:

receiving from the client, a request for determining if an entry of the directory server possesses a role, the request comprising an nsrole attribute.

13. The article of manufacture of claim 11 wherein the method further comprises:

evaluating members of a static group, the static group listing at least one entry in the directory server.

14. The article of manufacture of claim 11 wherein the method further comprises:

evaluating members of a dynamic group, the dynamic group comprising a search criteria for the entries in the directory server.

16. A computer-implemented method for managing a directory server, the method comprising:

defining at least one group of entries in the directory server, each group of entries comprising at least one of a plurality of entries; and

associating the plurality of entries with a group based role, the group based role pointing to one or more group of entries so that entries in the one or more group of entries possess the group based role.

17. The method of claim 16 further comprising:

receiving-a role query from a client;

determining which entries possess the group based role; and

providing entries that possess the group based role to the client.

18. The method of claim 17 wherein determining comprises:

evaluating members of the groups associated with the group based role; and

determining members of groups that are within a scope of the group based role.

19. The method of claim 17 wherein at least one group of entries is a static or a dynamic group.

20. The method of claim 16 wherein the directory server comprises a Lightweight Directory Access Protocol (LDAP) repository.