Nested exception roles

• US 20080209191A1
• Filed: 02/27/2007
• Published: 08/28/2008
• Est. Priority Date: 02/27/2007
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Rowley, Peter Andrew
• Granted Patent: US 7,725,564 B2
• Time in Patent Office: Days
• US Class Current: 712/244
• CPC Class Codes: H04L 61/4523 using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 61/4552 Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories

Abstract

A method and apparatus for managing a nested EXCEPTION role in a directory server is described. In one embodiment, a plurality of entries is defined in the directory server. At least one of the plurality of entries possesses a role. An entry is queried to determine its possessed role. A nested EXCEPTION role possesses at least two roles. An entry possesses the nested EXCEPTION role by possessing none of the roles within the nested EXCEPTION role.

Claims

1. A computer-implemented method for managing a directory server, the method comprising:

defining a plurality of entries in the directory server, at least one of the plurality of entries possessing a role;

querying an entry to determine its possessed role; and

providing entries that possess the nested EXCEPTION role to a client, the provided entries possessing none of the roles in the nested EXCEPTION role, the nested EXCEPTION role comprising at least two roles.

2. The method of claim 1 further comprising:

defining a nested EXCEPTION role entry corresponding to the nested EXCEPTION role, the nested EXCEPTION role entry comprising at least two role entries, each role entry associated with a corresponding role.

3. The method of claim 1 wherein each role of the nested EXCEPTION role comprises a plurality of group member attributes, and entries associated with the plurality of the group member attributes in the corresponding role entry.

4. The method of claim 1 further comprising:

receiving from the client, a request for determining if an entry of the directory server possesses the nested EXCEPTION role, the request comprising a nsRoleDN attribute for each role.

5. The method of claim 1 wherein the directory server comprises a Lightweight Directory Access Protocol (LDAP) repository.

6. An apparatus comprising:

a directory server to define a plurality of entries in the directory server, at least one of the plurality of entries possessing a role, to query an entry to determine its possessed role, and to provide entries that possess the nested EXCEPTION role to a client, the provided entries possessing none of the roles in the nested EXCEPTION role, the nested EXCEPTION role comprising at least two roles.

7. The apparatus of claim 6 wherein the directory server is to define a nested EXCEPTION role entry corresponding to the nested EXCEPTION role, the nested EXCEPTION role entry comprising at least two role entries, each role entry associated with a corresponding role.

8. The apparatus of claim 6 wherein each role of the nested EXCEPTION role comprises a plurality of group member attributes, and entries associated with the plurality of the group member attributes in the corresponding role entry.

9. The apparatus of claim 6 wherein the server is to receive from the client, a request for determining if an entry of the directory server possesses the nested EXCEPTION role, the request comprising a nsRoleDN attribute for each role.

10. The apparatus of claim 6 wherein the directory server comprises a Lightweight Directory Access Protocol (LDAP) repository.

11. An article of manufacture comprising:

a machine-accessible storage medium including data that, when accessed by a machine, cause the machine to perform a method comprising;

defining a plurality of entries in the directory server, at least one of the plurality of entries possessing a role;

querying an entry to determine its possessed role; and

providing entries that possess the nested EXCEPTION role to a client, the provided entries possessing none of the roles in the nested EXCEPTION role, the nested EXCEPTION role comprising at least two roles.

12. The article of manufacture of claim 11 wherein the method further comprises:

defining a nested EXCEPTION role entry corresponding to the nested EXCEPTION role, the nested EXCEPTION role entry comprising at least two role entries, each role entry associated with a corresponding role.

13. The article of manufacture of claim 11 wherein each role of the nested EXCEPTION role comprises a plurality of group member attributes, and entries associated with the plurality of the group member attributes in the corresponding role entry.

14. The article of manufacture of claim 11 wherein the method further comprises:

receiving from the client, a request for determining if an entry of the directory server possesses the nested EXCEPTION role, the request comprising a nsRoleDN attribute for each role.

15. The article of manufacture of claim 11 wherein the directory server comprises a Lightweight Directory Access Protocol (LDAP) repository.

16. A computer-implemented method for managing a directory server, the method comprising:

defining two or more roles in the directory server, each role comprising membership attributes for entries in the directory server; and

defining a nested EXCEPTION role as comprising at least two roles,

wherein entries, that possess none of the roles in the nested EXCEPTION role, possess the nested EXCEPTION role.

17. The method of claim 16 further comprising:

receiving a nested EXCEPTION role query from a client;

querying an entry to determine its possessed role; and

providing entries that possess the nested EXCEPTION role to the client.

18. The method of claim 16 wherein one or more role of the nested EXCEPTION role comprises another nested role, another nested EXCEPTION role, a nested AND role, or a nested EXCEPTION role.

19. The method of claim 17 wherein each role is associated with a corresponding nsRoleDN attribute.

20. The method of claim 16 wherein the directory server comprises a Lightweight Directory Access Protocol (LDAP) repository.