Method and apparatus for selecting and managing wireless network services using a directory

• US 7,197,125 B1
• Filed: 03/06/2001
• Issued: 03/27/2007
• Est. Priority Date: 03/06/2001
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Golla, Ramprasad, Prasad, Ranjan, Lou, Max, Parthasarathy, Vijayaraghavan
• Primary Examiner(s): Hong; Harry S.
• Application Number:
  US09/800,646
• Time in Patent Office: 2,212 Days
• Field of Search: 37920102-20105, 379/201.12
• US Class Current: 379/201.02
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/5048 Automatic or semi-automatic definitions, e.g. definition templates
• CPC Class Codes: H04L 41/5058 Service discovery by the service manager
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A method and apparatus are disclosed for modifying a subscription of a subscriber to a telecommunications service based on subscriber information and service information that are stored in a directory repository. A directory-enabled service selection framework is coupled to the directory repository for receiving stored information therefrom. The directory-enabled service selection framework receives a request to identify one or more services to which a subscriber is subscribed, based on a prior request to modify the subscription of the subscriber to the telecommunications service. A list is generated of the one or more services to which the subscriber is currently subscribed, based on group membership of the subscriber, one or more roles occupied by the subscriber, and authorization information associated with the subscriber that is stored in the directory repository. Individual service information is generated for each of the one or more services in the list, based on subscriber information and service information that is stored in the directory repository, for use in automatically subscribing the subscriber to a service that is represented by the individual service information. Accordingly, using user information and service information in a directory, a user is automatically subscribed to network services and logged into services.

Claims

1. A method of modifying a subscription of a subscriber to one or more telecommunications services based on subscriber information and service information that are stored in a directory repository, the method comprising the computer-implemented steps of:

determining whether the subscriber is currently logged in, and if the subscriber is not currently logged in, directing the subscriber to log in through an authentication server and generating, by an authorization service, a privilege token associated with the authenticated subscriber that includes subscriber privilege information, wherein said authorization service is separate from said authentication server;

receiving a modification request to modify the subscription of the subscriber to the one or more telecommunication services;

determining, based on subscriber privilege information in the privilege token associated with the subscriber generated by the authorization service, whether the subscriber has privileges sufficient to carry out the requested modification;

if the subscriber is determined to have sufficient privileges, then performing the steps of;

receiving, from the directory repository, first subscriber information and first service information representing only such services for which the subscriber is then currently subscribed;

modifying the first subscriber information and first service information to reflect the modification;

sending the modified information to the directory repository, resulting in creating and storing, in the directory repository, second service information that reflects the modification;

generating an engagement request to engage the telecommunications service for the subscriber in order to fulfill the modification request.

2. A method as recited in claim 1, wherein the authorization service generates the privilege token by the steps of:

receiving a user name associated with the subscriber and mapping the user name to a distinguished name in the directory repository;

creating and storing as subscriber privilege information in the privilege token one or more roles occupied by the subscriber based on role information that is stored in the directory repository, said stored role information including mapping information that maps a role to one or more privileges that specify which telecommunications services a subscriber having that role can subscribe to.

3. A method as recited in claim 1, wherein the step of determining whether the subscriber is currently logged in comprises determining whether a host object that uniquely identifies the subscriber exists, and wherein the privilege token associated with the subscriber is stored with the host object that uniquely identifies the subscriber.

4. A method as recited in claim 1, wherein the step of generating an engagement request comprises the steps of subscribing the subscriber to the service by creating and storing a relation of a subscriber object that programmatically represents the subscriber to a service object that programmatically represents the service, and creating and storing one or more attribute values in the relation, wherein the attribute values define the subscription.

5. A method of modifying subscriptions of a group of subscribers to one or more telecommunications services based on information stored in a directory repository, the method comprising the computer-implemented steps of:

receiving from an administrator of the group, a request to modify the subscriptions of the group of subscribers to the one or more telecommunications services;

determining, based on subscriber privilege information in a privilege token that is associated with the administrator and is generated by an authorization service, whether the administrator has privileges sufficient to carry out the requested modification;

if the administrator is determined to have sufficient privileges, then performing the steps of;

receiving, from the directory repository, current subscriber information and current service information representing then-current services to which the group of subscribers are subscribed;

modifying the subscriber information and the service information to reflect the modifications, resulting in creating and storing, in the directory repository, updated service information that reflects the modifications;

generating one or more requests to subscribe a telecommunications service to the group of subscribers to fulfill the request of the administrator.

6. A method as recited in claim 5, wherein the group of subscribers is defined explicitly by creating and storing a named group that contains one or more subscribers as group members.

7. A method as recited in claim 5, wherein the group of subscribers is defined implicitly such that the group comprises one or more subscribers in an object tree of the directory repository who are subordinate in the tree to a container node of the tree.

8. A method as recited in claim 5, further comprising the steps of subscribing one of the subscribers in the group to the telecommunications service by creating and storing a relation of a subscriber object that programmatically represents the subscriber to a service object that programmatically represents the telecommunications service, and creating and storing one or more attribute values in the relation, wherein the attribute values define the subscription.

9. A method of automatically logging in a subscriber to all telecommunications services subscribed to by the subscriber based on subscriber information and service information that are stored in a directory repository, the method comprising the computer-implemented steps of:

receiving a request from the subscriber to log in to the telecommunications services;

authenticating the subscriber by an authentication server;

generating a privilege token associated with the subscriber by an authorization service, said privilege token including subscriber privilege information, wherein said authorization service is separate from said authentication server;

determining whether the subscriber is allowed to automatically log into the telecommunication services, said determination based on subscriber privilege information in the privilege token associated with the subscriber;

if the subscriber is allowed to automatically log into the telecommunications services, receiving, from the directory repository, a list of all services for which the subscriber is then currently subscribed, and automatically logging the subscriber into all services identified in the list.

10. A method as recited in claim 9, wherein automatically logging the subscriber into all services identified in the list comprises the steps of:

for each of the services identified in the list;

obtaining service information that describes the services from the directory repository;

creating and storing a relation between a service object in the directory repository that uniquely identifies and represents each of the services and privileges of the subscriber, and a subscriber object that uniquely represents the subscriber.

11. A method as recited in claim 10, further comprising the steps of storing the privilege token in a service selection gateway for use in subsequent authorization processes relating to the subscriber.

12. A method of automatically subscribing a subscriber to a telecommunications service based on information stored in a directory repository, the method comprising the computer-implemented steps of:

receiving a request from the subscriber to obtain a list of available telecommunications services;

generating a list of only those telecommunications services for which the subscriber has privileges to subscribe to, based on privilege information and service information that is stored in the directory repository and associated with the subscriber, said privilege information associated with the subscriber specifying what telecommunications services the subscriber has privileges to subscribe to;

receiving a subscriber selection of one of the telecommunications services from the generated list of telecommunications services;

verifying that the subscriber has privileges that permit the subscriber to subscribe to the selected telecommunications service;

creating and storing updated subscription information in the directory repository;

generating a request to subscribe the subscriber to the selected telecommunications service based on the updated subscription information.

13. A method as recited in claim 12, wherein said privilege information associated with the subscriber is comprised of a privilege token for the subscriber that identifies a role of the subscriber, wherein the privileges of the subscriber to subscribe to a telecommunications service is determined by the role in the privilege token for the subscriber.

14. A method as recited in claim 12, wherein generating the list of only those telecommunications services for which the subscriber has privileges to subscribe to includes the step of generating and providing to the subscriber a custom display page that identifies only those telecommunications services for which the subscriber has privileges to subscribe to.

15. A computer-readable medium carrying one or more sequences of instructions for modifying a subscription of a subscriber to one or more telecommunications services based on subscriber information and service information that are stored in a directory repository, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

determining whether the subscriber is currently logged in, and if the subscriber is not currently logged in, directing the subscriber to log in through an authentication server and generating, by an authorization service, a privilege token associated with the authenticated subscriber that includes subscriber privilege information, wherein said authorization service is separate from said authentication server;

receiving a modification request to modify the subscription of the subscriber to the one or more telecommunications services;

determining, based on subscriber privilege information in the privilege token associated with the subscriber generated by the authorization service, whether the subscriber has privileges sufficient to carry out the requested modification;

if the subscriber is determined to have sufficient privileges, the one or more sequences of instructions which, when executed, further cause the one or more processors to carry out the steps of;

receiving, from the directory repository, first subscriber information and first service information representing only such services for which the subscriber is then currently subscribed;

modifying the first subscriber information and first service information to reflect the modification;

sending the modified information to the directory repository, resulting in creating and storing, in the directory repository, second service information that reflects the modification;

generating an engagement request to engage the telecommunications service for the subscriber in order to fulfill the modification request.

16. An apparatus for modifying a subscription of a subscriber to one or more telecommunications services based on subscriber information and service information that are stored in a directory repository, comprising:

means for determining whether the subscriber is currently logged in, and if the subscriber is not currently logged in, means for directing the subscriber to log in through an authentication server and means for generating a privilege token associated with the authenticated subscriber by an authorization service, said privilege token including subscriber privilege information, wherein said authorization service is separate from said authentication server;

means for receiving a modification request to modify the subscription of the subscriber to the one or more telecommunications services;

means for determining, based on subscriber privilege information in the privilege token associated with the subscriber generated by the authorization service, whether the subscriber has privileges sufficient to carry out the requested modification;

means for receiving, from the directory repository, first subscriber information and first service information representing only such services for which the subscriber is then currently subscribed;

means for modifying the first subscriber information and first service information to reflect the modification;

means for sending the modified information to the directory repository, resulting in creating and storing, in the directory repository, second service information that reflects the modification;

means for generating an engagement request to engage the telecommunications service for the subscriber in order to fulfill the modification request.

42. An apparatus as recited in claim 16, wherein the means for generating the privilege token by the authorization service comprise:

means for receiving a user name associated with the subscriber and mapping the user name to a distinguished name in the directory repository; and

means for creating and storing as subscriber privilege information in the privilege token one or more roles occupied by the subscriber based on role information that is stored in the directory repository, said stored role information including mapping information that maps a role to one or more privileges that specify which telecommunications services a subscriber having that role can subscribe to.

43. An apparatus as recited in claim 16, wherein the means for determining whether the subscriber is currently logged in comprise means for determining whether a host object that uniquely identifies the subscriber exists, wherein the privilege token associated with the subscriber is stored with the host object that uniquely identifies the subscriber.

44. An apparatus as recited in claim 16, wherein the means for generating the engagement request comprise means for subscribing the subscriber to the service by creating and storing a relation of a subscriber object the programmatically represents the subscriber to a service object that programmatically represents the service, and creating and storing one or more attribute values in the relation, wherein the attribute values define the subscription.

17. An apparatus for modifying a subscription of a subscriber to one or more telecommunications services based on subscriber information and service information that are stored in a directory repository, comprising:

a network interface that is coupled to a data network that includes the directory repository for receiving information therefrom;

a processor;

one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of;

determining whether the subscriber is currently logged in, and if the subscriber is not currently logged in, directing the subscriber to log in through an authentication server and generating, by an authorization service, a privilege token associated with the authenticated subscriber that includes subscriber privilege information, wherein said authorization service is separate from said authentication server;

receiving a modification request to modify the subscription of the subscriber to the one or more telecommunications services;

determining, based on subscriber privilege information in the privilege token associated with the subscriber that is generated by the authorization service, whether the subscriber has privileges sufficient to carry out the requested modification;

if the subscriber is determined to have sufficient privileges, the one or more sequences of instructions which, when executed, further cause the processor to;

receiving, from the directory repository, first subscriber information and first service information representing only such services for which the subscriber is then currently subscribed;

modifying the first subscriber information and first service information to reflect the modification;

sending the modified information to the directory repository, resulting in creating and storing, in the directory repository, second service information that reflects the modification;

generating an engagement request to engage the telecommunications service for the subscriber in order to fulfill the modification request.

45. An apparatus as recited in claim 17, wherein the instructions that cause generating the privilege token by the authorization service comprise:

instructions which, when executed by the processor, cause receiving a user name associated with the subscriber and mapping the user name to a distinguished name in the directory repository; and

instructions which, when executed by the processor, cause creating and storing as subscriber privilege information in the privilege token one or more roles occupied by the subscriber based on role information that is stored in the directory repository, said stored role information including mapping information that maps a role to one or more privileges that specify which telecommunications services a subscriber having that role can subscribe to.

46. An apparatus as recited in claim 17, wherein the instructions that cause determining whether the subscriber is currently logged in comprise instructions which, when executed by the processor, cause determining whether a host object that uniquely identifies the subscriber exists, wherein the privilege token associated with the subscriber is stored with the host object that uniquely identifies the subscriber.

47. An apparatus as recited in claim 17, wherein the instructions that cause generating an engagement request comprise instructions which, when executed by the processor, cause subscribing the subscriber to the service by creating and storing a relation of a subscriber object that programmatically represents the subscriber to a service object that programmatically represents the service, and creating and storing one or more attribute values in the relation, wherein the attribute values define the subscription.

18. A method of modifying a subscription of a subscriber to a telecommunications service based on information stored in a directory repository, the method comprising the computer-implemented steps of:

receiving a request to identify one or more services to which the subscriber is subscribed, based on a prior request to modify the subscription of the subscriber to the telecommunications service;

generating a list of the one or more services to which the subscriber is currently subscribed, based on group membership of the subscriber, one or more roles occupied by the subscriber, and authorization information associated with the subscriber that is stored in the directory repository, wherein said one or more roles are mapped to one or more privileges that specify which telecommunications services a subscriber having that role can subscribe to;

generating individual service information for each of the one or more services in the list, based on subscriber information and service information that is stored in the directory repository, for use in automatically subscribing the subscriber to a service that is represented by the individual service information.

19. A computer-readable medium carrying one or more sequences of instructions for modifying a subscription of a subscriber to a telecommunications service based on information stored in a directory repository, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

receiving a request to identify one or more services to which the subscriber is subscribed, based on a prior request to modify the subscription of the subscriber to the telecommunications service;

generating a list of the one or more services to which the subscriber is currently subscribed, based on group membership of the subscriber, one or more roles occupied by the subscriber, and authorization information associated with the subscriber that is stored in the directory repository, wherein said one or more roles are mapped to one or more privileges that specify which telecommunications services a subscriber having that role can subscribe to;

generating individual service information for each of the one or more services in the list, based on subscriber information and service information that is stored in the directory repository, for use in automatically subscribing the subscriber to a service that is represented by the individual service information.

20. An apparatus for modifying a subscription of a subscriber to a telecommunications service based on information stored in a directory repository, comprising:

means for receiving a request to identify one or more services to which the subscriber is subscribed, based on a prior request to modify the subscription of the subscriber to the telecommunications service;

means for generating a list of the one or more services to which the subscriber is currently subscribed, based on group membership of the subscriber, one or more roles occupied by the subscriber, and authorization information associated with the subscriber that is stored in the directory repository, wherein said one or more roles are mapped to one or more privileges that specify which telecommunications services a subscriber having that role can subscribe to;

means for generating individual service information for each of the one or more services in the list, based on subscriber information and service information that is stored in the directory repository, for use in automatically subscribing the subscriber to a service that is represented by the individual service information.

21. An apparatus for modifying a subscription of a subscriber to a telecommunications service based on information stored in a directory repository, comprising:

a directory-enabled service selection framework that is coupled to the directory repository for receiving stored information therefrom;

a processor;

one or more stored sequences of instructions in the framework which, when executed by the processor, cause the processor to carry out the steps of;

receiving a request to identify one or more services to which the subscriber is subscribed, based on a prior request to modify the subscription of the subscriber to the telecommunications service;

generating a list of the one or more services to which the subscriber is currently subscribed, based on group membership of the subscriber, one or more roles occupied by the subscriber, and authorization information associated with the subscriber that is stored in the directory repository, wherein said one or more roles are mapped to one or more privileges that specify which telecommunications services a subscriber having that role can subscribe to;

generating individual service information for each of the one or more services in the list, based on subscriber information and service information that is stored in the directory repository, for use in automatically subscribing the subscriber to a service that is represented by the individual service information.

22. An apparatus for modifying subscriptions of a group of subscribers to one or more telecommunications services based on information stored in a directory repository, comprising:

a network interface that is coupled to a data network that includes the directory repository for receiving information therefrom;

a processor; and

one or more stored sequences of instructions which, when executed by the processor, cause;

receiving from an administrator of the group, a request to modify the subscriptions of the group of subscribers to the one or more telecommunications services;

determining, based on subscriber privilege information in a privilege token that is associated with the administrator and is generated by an authorization service, whether the administrator has privileges sufficient to carry out the requested modifications; and

if the administrator is determined to have sufficient privileges, then performing the steps of;

receiving, from the directory repository, current subscriber information and current service information representing then-current services to which the group of subscribers are subscribed;

modifying the subscriber information and the service information to reflect the modifications, resulting in creating and storing, in the directory repository, updated service information that reflects the modifications; and

generating one or more requests to subscribe a telecommunications service to the group of subscribers to fulfill the request of the administrator.

23. An apparatus as recited in claim 22, wherein the group of subscribers is defined explicitly by creating and storing a named group that contains one or more subscribers as group members.

24. An apparatus as recited in claim 22, wherein the group of subscribers is defined implicitly such that the group comprises one or more subscribers in an object tree of the directory repository who are subordinate in the tree to a container node of the tree.

25. An apparatus as recited in claim 22, wherein the one or more stored sequences of instructions further comprise instructions which, when executed by the processor cause subscribing one of the subscribers in the group to the telecommunications service by creating and storing a relation of a subscriber object that programmatically represents the subscriber to a service object that programmatically represents the telecommunications service, and creating and storing one or more attribute values in the relation, wherein the attribute values define the subscription.

26. An apparatus for modifying subscriptions of a group of subscribers to one or more telecommunications services based on information stored in a directory repository, comprising:

means for receiving from an administrator of the group, a request to modify the subscriptions of the group of subscribers to the one or more telecommunications services;

means for determining, based on subscriber privilege information in a privilege token that is associated with the administrator and is generated by an authorization service, whether the administrator has privileges sufficient to carry out the requested modification;

means for receiving, from the directory repository, current subscriber information and current service information representing then-current services to which the group of subscribers are subscribed;

means for modifying the subscriber information and the service information to reflect the modifications, resulting in creating and storing, in the directory repository, updated service information that reflects the modifications; and

means for generating one or more requests to subscribe a telecommunications service to the group of subscribers to fulfill the request of the administrator.

27. An apparatus as recited in claim 26, wherein the group of subscribers is defined explicitly by creating and storing a named group that contains one or more subscribers as group members.

28. An apparatus as recited in claim 26, wherein the group of subscribers is defined implicitly such that the group comprises one or more subscribers in an object tree of the directory repository who are subordinate in the tree to a container node of the tree.

29. An apparatus as recited in claim 26, further comprising means for subscribing one of the subscribers in the group to the service by creating and storing a relation of a subscriber object that programmatically represents the subscriber to a service object that programmatically represents the service, and means for creating and storing one or more attribute values in the relation, wherein the attribute values define the subscription.

30. An apparatus for automatically logging in a subscriber to all telecommunications services subscribed to by the subscriber based on subscriber information and service information that are stored in a directory repository, comprising:

a network interface that is coupled to a data network that includes the directory repository for receiving information therefrom;

a processor; and

one or more stored sequences of instructions which, when executed by the processor, cause;

receiving a request from the subscriber to log in to the telecommunications services;

authenticating the subscriber by an authentication server;

generating a privilege token associated with the subscriber by an authorization service, said privilege token including subscriber privilege information, wherein said authorization service is separate from said authentication server;

determining whether the subscriber is allowed to automatically log into the telecommunication services, said determination based on subscriber privilege information in the privilege token associated with the subscriber; and

if the subscriber is allowed to automatically log into the telecommunications services, receiving, from the directory repository, a list of all services for which the subscriber is then currently subscribed, and automatically logging the subscriber into all services identified in the list.

31. An apparatus as recited in claim 30, wherein the instructions that cause automatically logging the subscriber into all services identified in the list further comprise instructions which, when executed by the processor, cause for each of the services identified in the list:

obtaining service information that describes the services from the directory repository; and

creating and storing a relation between a service object in the directory repository that uniquely identifies and represents each of the services and privileges of the subscriber, and a subscriber object that uniquely represents the subscriber.

32. An apparatus as recited in claim 30, wherein the one or more stored sequences of instructions further comprise instructions which, when executed by the processors, cause storing the privilege token in a service selection gateway for use in subsequent authorization processes relating to the subscriber.

33. An apparatus for automatically logging in a subscriber to all telecommunications services subscribed to by the subscriber based on subscriber information and service information that are stored in a directory repository, comprising:

means for receiving a request from the subscriber to log in to the telecommunications services;

means for authenticating the subscriber by an authentication server;

means for generating a privilege token associated with the subscriber by an authorization service, said privilege token including subscriber privilege information, wherein said authorization service is separate from said authentication server;

means for determining whether the subscriber is allowed to automatically log into the telecommunication services, said determination based on subscriber privilege information in the privilege token associated with the subscriber; and

means for receiving, from the directory repository, a list of all services for which the subscriber is then currently subscribed when the subscriber is allowed to automatically log into the telecommunications services, and means for automatically logging the subscriber into all services identified in the list.

34. An apparatus as recited in claim 33, wherein the means for automatically logging the subscriber into all services identified in the list comprises:

means for obtaining service information that describes the services from the directory repository for each of the services identified in the list; and

means for creating and storing a relation between a service object in the directory repository that uniquely identifies and represents each of the services and privileges of the subscriber, and a subscriber object that uniquely represents the subscriber.

35. An apparatus as recited in claim 33, further comprising means for storing the privilege token in a service selection gateway for use in subsequent authorization processes relating to the subscriber.

36. An apparatus for automatically subscribing a subscriber to a telecommunications service based on information stored in a directory repository, comprising:

a network interface that is coupled to a data network that includes the directory repository for receiving information therefrom;

a processor; and

one or more stored sequences of instructions which, when executed by the processor, cause;

receiving a request from the subscriber to obtain a list of available telecommunications services;

generating a list of only those telecommunications services for which the subscriber has privileges to subscribe to, based on privilege information and service information that is stored in the directory repository and is associated with the subscriber, said privilege information associated with the subscriber specifying what telecommunications services the subscriber has privileges to subscribe to;

receiving a subscriber selection of one of the telecommunications services from the generated list of telecommunications services;

verifying that the subscriber has privileges that permit the subscriber to subscribe to the selected telecommunications service;

creating and storing updated subscription information in the directory repository; and

generating a request to subscribe the subscriber to the selected telecommunications service based on the updated subscription information.

37. An apparatus as recited in claim 36, wherein said privilege information associated with the subscriber comprises a privilege token for the subscriber that identifies a role of the subscriber, wherein the privileges of the subscriber to subscribe to a telecommunications service is determined by the role in the privilege token for the subscriber.

38. An apparatus as recited in claim 36, wherein the instructions that cause generating the list of only those telecommunications services for which the subscriber has privileges to subscribe to include instructions which, when executed by the processor, cause generating and providing to the subscriber a custom display page that identifies only those telecommunications services for which the subscriber has privileges to subscribe to.

39. An apparatus for automatically subscribing a subscriber to a telecommunications service based on information stored in a directory repository comprising:

means for receiving a request from the subscriber to obtain a list of available telecommunications services;

means for generating a list of only those telecommunications services for which the subscriber has privileges to subscribe to, based on privilege information and service information that is stored in the directory repository and is associated with the subscriber, said privilege information associated with the subscriber specifying what telecommunications services the subscriber has privileges to subscribe to;

means for receiving a subscriber selection of one of the telecommunications services from the generated list of telecommunications services;

means for verifying that the subscriber has privileges that permit the subscriber to subscribe to the selected telecommunications service;

means for creating and storing updated subscription information in the directory repository; and

means for generating a request to subscribe the subscriber to the selected telecommunications service based on the updated subscription information.

40. An apparatus as recited in claim 39, wherein said privilege information associated with the subscriber comprises a privilege token for the subscriber that identifies a role of the subscriber, wherein the privileges of the subscriber to subscribe to a telecommunications service is determined by the role in the privilege token for the subscriber.

41. An apparatus as recited in claim 39, wherein the means for generating the list of only those telecommunications services for which the subscriber has privileges to subscribe to includes means for generating and providing to the subscriber a custom display page that identifies only those telecommunications services for which the subscriber has privileges to subscribe to.