Role based groups

• US 20080208809A1
• Filed: 02/27/2007
• Published: 08/28/2008
• Est. Priority Date: 02/27/2007
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Rowley, Peter Andrew
• Granted Patent: US 7,725,500 B2
• Time in Patent Office: Days
• US Class Current: 707/3
• CPC Class Codes: G06F 16/10 File systems; File servers

Abstract

A method and apparatus for managing role based groups in a directory server is described. In one embodiment, a role attribute is defined for one or more entries in the directory server. A group of entries in the directory server is defined with a group role. The group role comprises one or more role attributes of one or more entries. The role attribute of the entries are queried to determine which entry possesses the group role. Entries that possess the group role are provided to the client.

Claims

1. A computer-implemented method for managing a directory server, the method comprising:

defining a role attribute for at least one of a plurality of entries in the directory server;

defining a group of entries in the directory server with a group role, the group role comprising one or more role attributes of the at least one of the plurality of entries;

determining which of the plurality of entries possess the group role by querying the role attribute of the at least one of the plurality of entries; and

providing the plurality of entries that possess the group role to a client, the plurality of entries being within a scope of the group role.

2. The method of claim 1 further comprising:

receiving from the client, a query for determining members of the group; and

transparently using the role attribute of the at least one of the plurality of entries to internally fulfill the query.

3. The method of claim 1 wherein the client perceives the group of entries as a static group.

4. The method of claim 1 wherein the group of entries includes a dynamic group, the dynamic group comprising a search criteria for the entries in the directory server based on the role attribute.

5. The method of claim 1 wherein the directory server comprises a Lightweight Directory Access Protocol (LDAP) repository.

6. An apparatus comprising:

a directory server to define a role attribute for at least one of a plurality of entries in the directory server, to definite a group of entries in the directory server with a group role, the group role comprising one or more role attributes of the at least one of the plurality of entries, to determine which of the plurality of entries possess the group role by querying the role attribute of the at least one of the plurality of entries, and to provide the plurality of entries that possess the group role to a client, the plurality of entries being within a scope of the group role.

7. The apparatus of claim 6 wherein the directory server is to receive from the client, a query for determining members of the group, and to transparently use the role attribute of the at least one of the plurality of entries to internally fulfill the query.

8. The apparatus of claim 6 wherein the client perceives the group of entries as a static group.

9. The apparatus of claim 6 wherein the group of entries includes a dynamic group, the dynamic group comprising a search criteria for the entries in the directory server based on the role attribute.

10. The apparatus of claim 6 wherein the directory server comprises a Lightweight Directory Access Protocol (LDAP) repository.

11. An article of manufacture comprising:

a machine-accessible storage medium including data that, when accessed by a machine, cause the machine to perform a method comprising;

defining a role attribute for at least one of a plurality of entries in the directory server;

defining a group of entries in the directory server with a group role, the group role comprising one or more role attributes of the at least one of the plurality of entries.

determining which of the plurality of entries possess the group role by querying the role attribute of the at least one of the plurality of entries; and

providing the plurality of entries that possess the group role to a client, the plurality of entries being within a scope of the group role.

12. The article of manufacture of claim 11 wherein the method further comprises:

receiving from the client, a query for determining members of the group; and

transparently using the role attribute of the at least one of the plurality of entries to internally fulfill the query.

13. The article of manufacture of claim 11 wherein the client perceives the group of entries as a static group.

14. The article of manufacture of claim 11 wherein the group of entries includes a dynamic group, the dynamic group comprising a search criteria for the entries in the directory server based on the role attribute.

15. The article of manufacture of claim 11 wherein the directory server comprises a Lightweight Directory Access Protocol (LDAP) repository.

16. A computer-implemented method for managing a directory server, the method comprising:

associating a role with at least one or more entries in the directory server; and

defining at least one group in the directory server based on a group role, the group role corresponding to the role of the at least one or more entries.

17. The method of claim 16 further comprising:

receiving a group query from a client;

determining which entries in the directory server possess a group role associated with the group query; and

providing entries that possess the group role to the client.

18. The method of claim 17 wherein determining comprises:

evaluating the role attribute of the entries in the directory server; and

determining entries that are within a scope of the group role.

19. The method of claim 16 wherein the group query corresponds to a static or a dynamic group.

20. The method of claim 16 wherein the directory server comprises a Lightweight Directory Access Protocol (LDAP) repository.