Dynamic rights assignment apparatus and method using network directory services

• US 6,061,726 A
• Filed: 11/13/1997
• Issued: 05/09/2000
• Est. Priority Date: 05/27/1997
• Status: Expired due to Term

• Current Assignee: EMC Corporation (Dell Technologies Inc.)
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Cook, Randall R., Bodine, Bill Guy, Franklin, Nicholas Huston, Gaisford, Calvin R., Brooks, Matthew G.
• Primary Examiner(s): Burgess, Glenton B.
• Assistant Examiner(s): SALAD, ABDULLAHI ELMI
• Application Number:
  US08/970,173
• Time in Patent Office: 908 Days
• Field of Search: 709/200, 709/201, 709/223, 709/224, 709/225, 709/226, 709/229, 707/200, 707/201, 707/205
• US Class Current: 709/226
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register

Abstract

A directory services system includes a resource object, such as an application object for accessing an actual resource associated with the resource object. Rights attributes of the resource object reflects information for controlling rights of a user (or entity) to access the actual resource. The rights attributes may include criteria for distribution. The rights attributes may be used to rapidly, dynamically, remotely, and easily define and control access to available instances of a resource object based on certain criteria, such as organization, membership, etc. A utility (snap-in) module may be relied upon to manage the values of the attribute. Application programming interfaces (executables) in a dynamically linked library may be provided to "consume" (use) the attributes in the resource objects stored in directory services database.

Claims

1. An apparatus for dynamically managing file rights using a directory services system, the apparatus comprising:

a network comprising interconnected computers;

a processor in the network for executing executable data structures;

a memory device operably connected to the processor for storing the executable data structures and operational data structures associated therewith, the executable and operational data structures comprising;

a directory services system for storing and managing directory services objects and relationships there between;

a resource object, of the directory services objects, corresponding to a resource selectively available over the network in accordance with file rights;

the resource object, further comprising a rights attribute for defining selected file rights associated with the resource and selected from the file rights; and

a consumer object, of the directory services objects, corresponding to an entity for using the resource in accordance with the selected file rights.

2. The apparatus of claim 1, wherein the executable data structures further comprise a rights executable programmed to use the rights attribute to link the selected file rights to the consumer object.

3. The apparatus of claim 2, wherein the rights executable is contained in a dynamic link library.

4. The apparatus of claim 2, wherein the rights executable is an application programming interface associated with a launcher for launching the resource.

5. The apparatus of claim 1, wherein the executable data structures further comprise a rights utility for managing a value of the rights attribute.

6. The apparatus of claim 5, wherein the rights utility is comprised within a network administration module.

7. The apparatus of claim 6, wherein the rights utility is a snap-in module.

8. The apparatus of claim 1, wherein the operational data structures further comprise binding data linking the consumer object to the selected file rights with respect to the resource.

9. The apparatus of claim 1, wherein the executable and operational data structures further comprise a consuming executable, executable by the processor and effective use the selected file rights to link the resource object to the consumer object, and to convey to the consumer object the selected rights.

10. The apparatus of claim 1, wherein the resource is an application.

11. An apparatus for managing file rights in a computer network having at least one processor and a memory device operably connected thereto for storing executable data structures and operational data structures associated therewith, the executable and operational data structures comprising:

a directory services system storing and managing resource objects, consumer objects, and links there between;

a plurality resource objects, each corresponding to a resource providing a function to nodes connected to the network;

a resource object of the plurality of resource objects, comprising a file rights attribute;

a consumer object of the consumer objects in the directory services system;

a rights utility, executable by the processor to manage the values of the rights attributes to reflect access rights available with respect to the resource corresponding to the resource object; and

a consuming executable, executable to use the rights attribute to link the consumer object to the resource object and to provide the access rights thereto for the consumer object.

12. A method for managing file rights over a network, the method comprising:

providing a directory services system for managing and relating objects;

providing, in the directory services system, a resource object corresponding to a resource available over the network;

providing, in the directory services system, a consumer object corresponding to a node in the network for using the resource; and

providing a rights attribute in the resource object for defining rights available in association with the resource.

13. The method of claim 12, further comprising:

selecting the resource object;

selecting file rights to be associated with the resource object; and

assigning values to the rights attribute therein, corresponding to the selected file rights.

14. The method of claim 13, further comprising:

providing a launcher for launching the resource;

requesting to the launcher on behalf of the consumer object a launch of the resource for providing a function for the node;

linking the resource object to the consumer object; and

providing, to the node, the selected rights with respect to the resource, in association with the linking.

15. The method of claim 14, further comprising extending the linking to other resource objects equivalent to the resource object.

16. The method of claim 14, further comprising extending the linking to other consumer objects.

17. The method of claim 14, further comprising modifying the rights attribute.

18. The method of claim 14 further comprising:

providing an management executable for managing the values of the rights attribute; and

providing a consuming executable for using the rights attribute to link the consumer object to selected rights, with respect to the resource object, upon association of the resource object with the consumer object.

19. The method of claim 14, further comprising dynamically linking the selected rights to the consumer object upon association.

20. The method of claim 14, further comprising dynamically linking the selected rights to the consumer object at run time.