Method and system for grouping entries in a directory server by group memberships defined by roles

• US 7,130,839 B2
• Filed: 05/29/2001
• Issued: 10/31/2006
• Est. Priority Date: 05/29/2001
• Status: Expired due to Term

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Rowley, Peter, Boreham, David, Smith, Mark C.
• Primary Examiner(s): LE, UYEN T
• Application Number:
  US09/867,790
• Publication Number:
  US 20030105742A1
• Time in Patent Office: 1,981 Days
• Field of Search: 707/100, 707/101, 707/102, 707/200, 707 1- 10, 709/220, 709/225, 709/228
• US Class Current: 1/1
• CPC Class Codes: H04L 41/08 Configuration management of networks or network elements address allocation H04L61/50
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 61/4552 Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
• CPC Class Codes: H04L 61/4555 Directories for electronic mail or instant messaging
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching

Abstract

Role is a comprehensive grouping mechanism. In a client-server directory system, roles transfer some of the complexity to the directory server. A role is defined by its role definition entry. Assigning entries to roles enables applications to locate the roles of an entry, rather than select a group and browse the members list. Additionally, roles allow for support of generated attribute values, and directory server-performed membership verification for clients. By changing a role definition, a user can change an entire organization with ease. Any client with appropriate access privileges can discover, identify and examine any role definition.

Claims

1. A system for providing service attribute information comprising:

a directory server comprising a hierarchical data store associating a plurality of target entries with service attributes, said hierarchical data store comprising an organization level and a managed role level and further comprising attribute templates defined with respect to services and levels;

an application configured to designate a predefined service attribute in response to a query for said predefined service attribute associated with one of said plurality of target entries; and

wherein said directory server, in response to designating said predefined service attribute, is configured to search said hierarchical data store for target entries that comprise said predefined service attribute.

2. The system as recited in claim 1 wherein said predefined service attribute is associated with a role comprising one or more service attribute.

3. The system as recited in claim 2 wherein said predefined service attribute is associated with said managed role associated with an organization of said organization level.

4. The system as recited in claim 1 wherein said attribute templates comprise:

a first template defined with respect to a first service and a first managed role; and

a second template defined with respect to said first service and a second managed role.

5. The system as recited in claim 1 wherein said attribute templates further comprise a third template defined with respect to a second service and said first managed role.

6. The system as recited in claim 1 wherein said predefined attribute is nsRoleDN.

7. The system as recited in claim 1 wherein said directory server assigns said distinguished name of said managed role to said predefined service attribute if said one of said plurality of target entries belongs to said managed role.

8. A method for searching a tree structured hierarchical directory server, said directory server comprising a plurality of entries comprising at least one role, said role for grouping said plurality of entries comprising:

accessing a first role associated with one or more of said plurality of entries wherein said first role comprises a first identifiable attribute and a first distinguished name;

accessing a second role associated with one or more of said plurality of entries wherein said second role comprises a second identifiable attribute and a second distinguished name;

determining if one or more of said plurality of entries comprises said first identifiable attribute and said second identifiable attribute;

creating a third role comprising said first identifiable attribute and said second identifiable attribute; and

retrieving at least one of the plurality of entries using the third role.

9. The method as recited in claim 8 further comprising:

creating a nested role by encapsulating said first distinguished name and said second distinguished name wherein said nested role comprises said first attribute and said

second identifiable attribute and can be associated with one or more of said plurality of entries.

10. The method as recited in claim 9 further comprising:

encapsulating said first identifiable attribute and said second identifiable attribute into a third distinguished name.

11. The method as recited in claim 10 wherein said third distinguished name is nsRoleDN.

12. The method as recited in claim 8 wherein said first role is a dynamic role and wherein said first identifiable attribute is computed at the time of accessing said first role.

13. The method as recited in claim 8 wherein said first role is an enumerated role.

14. The method as recited in claim 8 wherein said first role is a filtered role.

15. The method as recited in claim 8 wherein said first role is a nested role.

16. A computer readable medium comprising instructions, that when executed, perform a method for searching a tree structured hierarchical directory server, said directory server comprising a plurality of entries comprising at least one role, said role for grouping said plurality of entries, said method comprising:

accessing a first role associated with one or more of said plurality of entries wherein said first role comprises a first identifiable attribute and a first distinguished name;

accessing a second role associated with one or more of said plurality of entries wherein said second role comprises a second identifiable attribute and a second distinguished name;

determining if one or more of said plurality of entries comprises said first identifiable attribute and said second identifiable attribute;

creating a nested role by encapsulating said first distinguished name and said second distinguished name wherein said nested role comprises said first identifiable attribute and said second identifiable attribute and can be associated with one or more of said plurality of entries; and

retrieving at least one of the plurality of entries using the nested role.

17. The computer readable medium as recited in claim 16 further comprising instructions for:

encapsulating said first identifiable attribute and said second identifiable attribute into a third distinguished name.

18. The computer readable medium as recited in claim 17 wherein said third distinguished name is nsRoleDN.

19. The computer readable medium as recited in claim 16 wherein said first role is a dynamic role and wherein said first identifiable attribute is computed at the time of accessing said first role.

20. The computer readable medium as recited in claim 16 wherein said first role is an enumerated role.

21. The computer readable medium as recited in claim 16 wherein said first role is a filtered role.

22. The computer readable medium as recited in claim 16 wherein said first role is a nested role.