System and method for enforcing quotas on object creation in a replicated directory service database

• US 7,290,053 B2
• Filed: 03/18/2005
• Issued: 10/30/2007
• Est. Priority Date: 06/19/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Nanda, Arun K., Hacherl, Donald J.
• Primary Examiner(s): Burgess; Glenton B.
• Assistant Examiner(s): Chea; Philip J.
• Application Number:
  US11/083,502
• Publication Number:
  US 20050165833A1
• Time in Patent Office: 956 Days
• Field of Search: 709/225, 709/223, 709/224, 707/102, 707103 R-103 Z, 707200-206
• US Class Current: 709/225
• CPC Class Codes: H04L 61/4523 using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 61/4553 Object oriented directories, e.g. common object request broker architecture [CORBA] name server
• CPC Class Codes: Y10S 707/99953 Recoverability
• CPC Class Codes: Y10S 707/99957 Garbage collection

Abstract

A system and method for managing the creation of objects in a distributed directory service system assigns quotas to entities (such as users, computers, groups) to limit the number of objects each entity is allowed to create and own. For purposes of enforcing the quotas, tombstones generated for deleted objects are taken into account in the calculation of a weighted total number of objects owned by an entity, with each tombstone counted as a configurable fraction of a regular object. When an entity requests a directory operation that will increase the number of objects owned by that entity, the number of system objects owned by that entity is added to the number of tombstones multiplied by the fractional tombstone factor to generate the weighted total, which is compared to the quota of that entity to determine when the requested operation should be performed.

Claims

1. In a distributed directory service system that includes a plurality of directory servers connectable to one another through a network so that directory service objects are replicated through a distributed database among the plurality of directory servers, and wherein at least one of the directory servers is responsible for assigning quotas to network entities that are allowed to create directory service objects, tracking quota consumption of objects by such network entities, and enforcing quota limits as to consumption of objects by such network entities, a method by which the network entities are managed by the at least one responsible directory server with respect to the object quotas for such network entities, the method comprising steps for:

sending from a first network entity to the at least one responsible server a request for a directory operation, the first entity having an object quota assigned to it by the at least one responsible server, and owning a plurality of system objects and tombstones for deleted system objects, and the requested directory operation changing the number of objects owned by the first entity if performed;

performing at the first network entity the requested directory operation, but only if it is determined that the quota of the entity will not be exceeded, said determination being performed by,

calculating a total number of objects as a sum of a number of said system objects of the first entity and a number of the tombstones owned by the first entity multiplied by a pre-selected, fractional tombstone factor, and

then comparing the calculated total number with the quota assigned to the first entity to determine whether the quota assigned to the first entity will be exceeded if the requested directory operation is performed.

2. The method of claim 1 further comprising:

tracking the number of system objects owned by the first entity; and

tracking the number of tombstones owned by the first entity.

3. The method of claim 1 further comprising:

maintaining a quota assignment object, the quota assignment object specifying a quota value for an entity of the directory service system permitted to create a system object.

4. In a distributed directory service system that includes a plurality of directory servers connectable to one another through a network so that directory service objects are replicated through a distributed database among the plurality of directory servers, and wherein at least one of the directory servers is responsible for assigning quotas to network entities that are allowed to create directory service objects, tracking quota consumption of objects by such network entities, and enforcing quota limits as to consumption of objects by such network entities, a computer program product comprised of a computer-readable medium having computer-executable instructions for implementing a method by which the network entities are managed by the at least one responsible directory server with respect to the object quotas for such network entities, and wherein the method is comprised of steps for:

receiving from the at the least one responsible server, at each of the plurality of entities, a quota on object creation;

sending to the at the least one responsible server a request from a first network entity for a directory operation;

performing at the first network entity the requested directory operation, but only if it is determined that the quota of the entity will not be exceeded, said determination being performed by,

calculating a total number of objects as a sum of a number of said system objects of the first entity and a number of the tombstones owned by the first entity multiplied by a pre-selected, fractional tombstone factor, and

then comparing the calculated total number with the quota assigned to the first entity to determine whether the quota assigned to the first entity will be exceeded if the requested directory operation is performed.

5. The computer-readable medium of claim 4 having further computer-executable instructions for:

tracking the number of system objects owned by the first entity; and

tracking the number of tombstones owned by the first entity.

6. The computer-readable medium of claim 4 having further computer-executable instructions for:

maintaining a quota assignment object, the quota assignment object specifying a quota value for an entity of the directory service system permitted to create a system object.