Identifying dynamic groups

• US 7,206,851 B2
• Filed: 12/23/2002
• Issued: 04/17/2007
• Est. Priority Date: 07/11/2002
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Summers, Robert, Delaney, Shawn P.
• Primary Examiner(s): Najjar; Saleh
• Assistant Examiner(s): Bates; Kevin T
• Application Number:
  US10/328,920
• Publication Number:
  US 20040010606A1
• Time in Patent Office: 1,576 Days
• Field of Search: 709/203, 709/219, 709/229, 707/9, 707/3
• US Class Current: 709/229
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

Technology is disclosed for identifying dynamic groups that correspond to a user of a system. A system partitions a set of dynamic groups into multiple test sets of dynamic groups. The system selects a test set and determines whether the user corresponds to the test set. In one implementation, the system combines the filters for the dynamic groups in each test set into a single test set filter. The test set filter is satisfied if the filter of any dynamic group in the test set is satisfied. This allows the system to perform a single comparison between the resulting test set filter and the user'"'"'s profile to determine whether the user is a member of any dynamic group in the test set. If the user is not a member of any dynamic group in the test set, the system eliminates all of the test set'"'"'s dynamic groups from consideration, based on the single comparison. Otherwise, the dynamic groups in the test set remain in a list of groups that may include the user. This process is repeated for each test set. After each test set has been evaluated, new test sets are repeatedly generated and evaluated in the above-described fashion using the dynamic groups that are still in consideration. In each iteration, each test set contains fewer dynamic groups. This continues until each test set only contains one dynamic group. After performing an iteration with each test set containing one dynamic group, the only remaining dynamic groups are the ones that include the user as a member.

Claims

1. A method of identifying dynamic groups corresponding to a user, the method comprising:

partitioning a set of dynamic groups into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups; and

for each test set in said multiple test sets, determining whether said user corresponds to said test set, wherein said test set includes multiple dynamic groups from said set of dynamic groups;

eliminating from said set of dynamic groups all dynamic groups in each test set in which it is determined that said user does not correspond to said test set;

partitioning said set of dynamic groups into multiple second test sets, wherein each test set in said multiple second test sets includes at least one dynamic group from said set of dynamic groups; and

determining whether said user corresponds to a test set in said multiple second test sets.

2. A method according to claim 1, wherein determining whether said user corresponds to a test set in said multiple test sets comprises:

setting matching criteria for said test set; and

determining whether said user satisfies said matching criteria.

3. A method according to claim 2, wherein each dynamic group in said test set corresponds to at least a portion of said matching criteria.

4. A method according to claim 2, wherein said matching criteria includes a logical OR of at least one filter from each dynamic group in said test set.

5. A method according to claim 2, wherein said matching criteria is satisfied if a filter for any dynamic group in said test set is satisfied.

6. A method according to claim 2, wherein:

said matching criteria is a rule including a filter component, and

said filter component is satisfied if any filter from a dynamic group in said test set is satisfied.

7. A method according to claim 6, wherein said filter component is a logical OR of a filter from each dynamic group in said test set.

8. A method according to claim 6, wherein:

said filter component is a logical OR of a filter defining each dynamic group in said test set.

9. A method according to claim 6, wherein:

said rule includes a searchbase component, and

said searchbase component corresponds to a subtree containing said user.

10. A method according to claim 6, wherein:

said rule includes a searchbase component, and

said searchbase component corresponds to said user.

11. A method according to claim 10, wherein said user is represented by a user profile in a directory.

12. A method according to claim 11, wherein determining whether said user satisfies said matching criteria comprises:

searching said directory using said rule.

13. A method according to claim 12, wherein searching said directory comprises a LDAP search.

14. A method according to claim 11, wherein said directory employs LDAP.

15. A method according to claim 14, wherein:

said rule includes a scope component; and

said scope component corresponds to a base object scope.

16. A method according to claim 15, wherein determining whether said user satisfies said matching criteria comprises:

searching said directory using said rule.

17. A method according to claim 11, wherein said directory is in communication with an Identity System.

18. A method according to claim 1, wherein determining whether said user corresponds to a test set in said multiple test sets comprises:

determining that all dynamic groups in a test set do not correspond to said user, based on a single directory search.

19. A method according to claim 1, wherein:

said method is performed as part of an Identity System.

20. A method according to claim 1, wherein:

said method is performed as part of an Access System.

21. A method according to claim 1, wherein:

said method is performed as part of an integrated Access System and Identity System.

22. A method according to claim 1, wherein determining whether said user corresponds to a test set is performed without accessing a directory server.

23. A method according to claim 22, wherein determining whether said user corresponds to a test set is performed using a filter tester.

24. A method according to claim 1, wherein determining whether said user corresponds to a test set is performed using an SQL command.

25. A method of identifying dynamic groups corresponding to a user, the method comprising:

partitioning a set of dynamic groups into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups;

for each test set in said multiple test sets, determining whether said user corresponds to said test set, wherein said test set includes multiple dynamic groups from said set of dynamic groups;

if it is determined that said user does not correspond to a first test set, removing from said first test set all dynamic groups that do not correspond to said user;

partitioning said first test set into multiple second test sets, wherein each test set in said multiple second test sets includes at least one dynamic group from said first test set; and

determining whether said user corresponds to a test set in said multiple second test sets.

26. A method according to claim 25, wherein said method further comprises:

eliminating all dynamic groups in said first test set from said set of dynamic groups, if it is determined that said user does not correspond to said test set.

27. A method according to claim 26, wherein determining whether said user corresponds to a test set, removing from said test set all dynamic groups in said test set that do not correspond to said user, and eliminating all dynamic groups in said test set from said set of dynamic groups are performed for each test set in said multiple test sets.

28. One or more processor readable storage devices having processor readable code embodied on said one or more processor readable storage devices, said processor readable code for programming one or more processors and comprising:

code for partitioning a set of dynamic groups into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups;

for each test set in said multiple test sets, code for determining whether a user corresponds to said test set, wherein said test set includes multiple dynamic groups from said set of dynamic groups;

code for eliminating from said set of dynamic groups all dynamic groups in each test set in which it is determined that said user does not correspond to said test set;

code for partitioning said set of dynamic groups into multiple second test sets, wherein each test set in said multiple second test sets includes at least one dynamic group from said set of dynamic groups; and

code for determining whether said user corresponds to a test set in said multiple second test sets.

29. One or more processor readable storage devices according to claim 28, wherein said code for determining whether a user corresponds to a test set comprises:

code for setting matching criteria for said test set; and

code for determining whether said user satisfies said matching criteria.

30. One ore more processor readable storage devices according to claim 29, wherein:

said matching criteria is a rule including a filter component, and

said filter component is satisfied if a filter for any dynamic group in said test set is satisfied.

31. One or more processor readable storage devices according to claim 30, wherein:

said rule includes a searchbase component, and

said searchbase component corresponds to said user.

32. One or more processor readable storage devices according to claim 31, wherein said user is represented by a user profile in a directory.

33. One or more processor readable storage devices according to claim 32, wherein said code for determining whether said user satisfies said matching criteria comprises:

code for searching said directory using said rule.

34. One or more processor readable storage devices according to claim 33, wherein said code for searching said directory using said rule comprises code for performing a LDAP search.

35. One or more processor readable storage devices according to claim 32, wherein:

said rule includes a scope component, and

said scope component corresponds to a base object scope.

36. One or more processor readable storage devices according to claim 35, wherein said code for determining whether said user satisfies said matching criteria comprises:

code for searching said directory using said rule.

37. One or more processor readable storage devices according to claim 28, wherein said processor readable code further comprises:

code for removing from a test set all dynamic groups in said test set that do not correspond to said user, if it is determined that said user does correspond to said test set.

38. One or more processor readable storage devices according to claim 37, wherein said code for removing from said test set all dynamic groups in said test set that do not correspond to said user

code for removing from said set of dynamic groups said all dynamic groups in said test set that do not correspond to said user.

39. One or more processor readable storage devices according to claim 28, wherein said processor readable code comprises:

code for removing all dynamic groups that do not correspond to said user from each test set in which it is determined that said user does not correspond to the test set.

40. One or more processor readable storage devices according to claim 28, wherein said code for determining whether a user corresponds to a test set comprises:

code for determining that all dynamic groups in said test set do not correspond to said user, based on a single directory search.

41. One or more processor readable storage devices according to claim 28, wherein:

said processor readable code is executable by an Identity System.

42. One or more processor readable storage devices according to claim 28, wherein:

said processor readable code is executable by an Access System.

43. One or more processor readable storage devices according to claim 28, wherein:

said processor readable code is executable by an integrated Access System and Identity System.

44. An apparatus, comprising:

one or more storage devices; and

one or more processors in communication with said one or more storage devices, said one or more storage devices comprising processor readable code for programming said one or more processors, said processor readable code comprising;

code for partitioning a set of dynamic groups into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups;

for each test set in said multiple test sets, code for determining whether a user corresponds to said test set, wherein said test set includes multiple dynamic groups from said set of dynamic groups;

code for eliminating from said set of dynamic groups all dynamic groups in each test set in which it is determined that said user does not correspond to said test set;

code for partitioning said set of dynamic groups into multiple second test sets, wherein each test set in said multiple second test sets includes at least one dynamic group from said set of dynamic groups; and

code for determining whether said user corresponds to a test set in said multiple second test sets.

45. An apparatus according to claim 44, wherein said code for determining whether a user corresponds to a test set comprises:

code for setting matching criteria for said test set; and

code for determining whether said user satisfies said matching criteria.

46. An apparatus according to claim 45, wherein:

said matching criteria is a rule including a filter component, and

said filter component is satisfied if a filter for any dynamic group in said test set is satisfied.

47. An apparatus according to claim 46, wherein:

said rule includes a searchbase component, and

said searchbase component corresponds to said user.

48. An apparatus according to claim 47, wherein said user is represented by a user profile in a directory.

49. An apparatus according to claim 48, wherein said code for determining whether said user satisfies said matching criteria comprises:

code for searching said directory using said rule.

50. An apparatus according to claim 48, wherein:

said rule includes a scope component; and

said scope component corresponds to a base object scope.

51. An apparatus according to claim 50, wherein said code for determining whether said user satisfies said matching criteria comprises:

code for searching said directory using said rule.

52. An apparatus according to claim 44, wherein said processor readable code further comprises:

code for removing all dynamic groups that do not correspond to said user from each test set in which it is determined that said user does correspond to the test set.

53. An apparatus according to claim 44, wherein said code for determining whether a user corresponds to a test set comprises:

code for determining that all dynamic groups in said test set do not correspond to said user, based on a single directory search.

54. An apparatus according to claim 44, wherein:

said processor readable code is executable by an Identity System.

55. An apparatus according to claim 44, wherein:

said processor readable code is executable by an Access System.

56. A method of identifying dynamic profiles corresponding to an entity, the method comprising:

partitioning a set of dynamic profiles into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic profile from said set of dynamic profiles;

for each test said in said multiple test sets, determining whether said entity corresponds to said test set, wherein said test set includes multiple dynamic profiles from said set of dynamic profiles;

eliminating from said set of dynamic profiles all dynamic profiles in each test set in which it is determined that said entity does not correspond to said test set;

partitioning said set of dynamic profiles into multiple second test sets, wherein each test set in said multiple second test sets includes at least one dynamic profile from said set of dynamic profiles; and

determining whether said entity corresponds to a test set in said multiple second test sets.

57. A method according to claim 56, wherein determining whether an entity corresponds to a test set comprises:

setting matching criteria for said test set; and

determining whether said entity satisfies said matching criteria.

58. A method according to claim 57, wherein said matching criteria is satisfied if a filter for any dynamic profile in said test set is satisfied.

59. A method according to claim 57, wherein:

said matching criteria is a rule including a filter component, and

said filter component is satisfied if any filter from a dynamic group in said test set is satisfied.

60. A method according to claim 59, wherein:

said rule includes a searchbase component;

said searchbase component corresponds to said entity;

said rule includes a scope component; and

said scope component corresponds to a base object scope.

61. A method according to claim 60, wherein said entity is represented by a profile in a directory, wherein determining whether said entity satisfies said matching criteria comprises:

searching said directory using said rule.

62. A method according to claim 56, wherein said entity is represented by a user profile and said set of dynamic profiles includes dynamic group profiles.

63. A method according to claim 56, wherein determining whether an entity corresponds to a test set comprises:

determining that all dynamic profiles in said test set do not correspond to said entity, based on a single directory search.

64. One or more processor readable storage devices having processor readable code embodied on said one or more processor readable storage devices, said processor readable code for programming one or more processors and comprising:

code for partitioning a set of dynamic profiles into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic profile from said set of dynamic profiles;

for each test said in said multiple test sets, code for determining whether said entity corresponds to said test set, wherein said test set includes multiple dynamic profiles from said set of dynamic profiles;

code for eliminating from said set of dynamic profiles all dynamic profiles in each test set in which it is determined that said entity does not correspond to said test set;

code for partitioning said set of dynamic profiles into multiple second test sets, wherein each test set in said multiple second test sets includes at least one dynamic profile from said set of dynamic profiles; and

code for determining whether said entity corresponds to a test set in said multiple second test sets.

65. One or more processor readable storage devices according to claim 64, wherein said code for determining whether an entity corresponds to a test set comprises:

code for setting matching criteria for said test set; and

code for determining whether said entity satisfies said matching criteria, wherein said matching criteria is satisfied if a filter for any dynamic profile in said test set is satisfied.

66. One or more processor readable storage devices according to claim 65, wherein:

said matching criteria is a rule;

said rule includes a filter component;

said filter component is satisfied if a filter for any dynamic profile in said test set is satisfied;

said rule includes a searchbase component;

said searchbase component corresponds to said entity;

said rule includes a scope component; and

said scope component corresponds to a base object scope.

67. One or more processor readable storage devices according to claim 66, wherein said entity is represented by a profile in a directory, wherein said code for determining whether said entity satisfies said matching criteria,

code for searching said directory using said rule.

68. One or more processor readable storage devices according to claim 64, wherein said code for determining whether an entity corresponds to a test set comprises:

determining that all dynamic profiles in said test set do not correspond to said entity, based on a single directory search.

69. An apparatus, comprising:

one or more storage devices; and

one or more processors in communication with said one or more storage devices, said one or more storage devices comprising processor readable code for programming said one or more processors, said processor readable code comprising;

code for partitioning a set of dynamic groups into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups;

for each test set in said multiple test sets, code for determining whether said user corresponds to said test set, wherein said test set includes multiple dynamic groups from said set of dynamic groups;

if it is determined that said user does not correspond to a first test set, code for removing from said first test set all dynamic groups that do not correspond to said user;

code for partitioning said first test set into multiple second test sets, wherein each test set in said multiple second test sets includes at least one dynamic group from said first test set; and

code for determining whether said user corresponds to a test set in said multiple second test sets.

70. One or more processor readable storage devices having processor readable code embodied on said one or more processor readable storage devices, said processor readable code for programming one or more processors and comprising:

code for partitioning a set of dynamic groups into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups;

for each test set in said multiple test sets, code for determining whether said user corresponds to said test set, wherein said test set includes multiple dynamic groups from said set of dynamic groups;

if it is determined that said user does not correspond to a first test set, code for removing from said first test set all dynamic groups that do not correspond to said user;

code for partitioning said first test set into multiple second test sets, wherein each test set in said multiple second test sets includes at least one dynamic group from said first test set; and

code for determining whether said user corresponds to a test set in said multiple second test sets.

71. An apparatus, comprising:

one or more storage devices; and

one or more processors in communication with said one or more storage devices, said one or more storage devices comprising processor readable code for programming said one or more processors, said processor readable code comprising;

code for partitioning a set of dynamic profiles into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic profile from said set of dynamic profiles;

for each test said in said multiple test sets, code for determining whether said entity corresponds to said test set, wherein said test set includes multiple dynamic profiles from said set of dynamic profiles;

code for eliminating from said set of dynamic profiles all dynamic profiles in each test set in which it is determined that said entity does not correspond to said test set;

code for partitioning said set of dynamic profiles into multiple second test sets, wherein each test set in said multiple second test sets includes at least one dynamic profile from said set of dynamic profiles; and

code for determining whether said entity corresponds to a test set in said multiple second test sets.

72. One or more processor readable storage devices having processor readable code embodied on said one or more processor readable storage devices, said processor readable code for programming one or more processors and comprising:

code for partitioning a set of dynamic profiles into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic profile from said set of dynamic profiles;

for each test said in said multiple test sets, code for determining whether said entity corresponds to said test set, wherein said test set includes multiple dynamic profiles from said set of dynamic profiles;

code for eliminating from said set of dynamic profiles all dynamic profiles in each test set in which it is determined that said entity does not correspond to said test set;

code for partitioning said set of dynamic profiles into multiple second test sets, wherein each test set in said multiple second test sets includes at least one dynamic profile from said set of dynamic profiles; and

code for determining whether said entity corresponds to a test set in said multiple second test sets.