Runtime modification of entries in an identity system

• US 7,349,912 B2
• Filed: 11/30/2001
• Issued: 03/25/2008
• Est. Priority Date: 12/22/2000
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Ahmed, Sajeed, Delany, Shawn P.
• Primary Examiner(s): Corrielus; Jean M
• Application Number:
  US09/997,409
• Publication Number:
  US 20020138763A1
• Time in Patent Office: 2,307 Days
• Field of Search: 707/3, 707/104.1, 707/102, 707/100, 707/2, 707/10, 707/101, 707/103.Y, 707/103.R, 709/203
• US Class Current: 707/694
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: Y10S 707/922 Communications
• CPC Class Codes: Y10S 707/955 Object-oriented
• CPC Class Codes: Y10S 707/99932 Access augmentation or optimizing
• CPC Class Codes: Y10S 707/99942 Manipulating data structure, e.g. compression, compaction, compilation
• CPC Class Codes: Y10S 707/99944 Object-oriented database structure
• CPC Class Codes: Y10S 707/99945 Object-oriented database structure processing

Abstract

The present invention is directed to technology for modifying groups or other types of entries after those entries have been created. In one embodiment, the invention includes modifying group objects that have already been instantiated by adding and/or removing auxiliary classes and their associated attributes. The present invention can be used with an Identity System that stores group objects in a directory. Alternatively, the present invention can be used with other types of entries, other types of systems and/or other types of data stores.

Claims

1. A computer-implemented method for modifying entries in an Identity System, comprising the steps of:

creating a first entry for said Identity System, said first entry includes a first set of attributes based on a first set of one or more classes; and

removing a subset of said first set of attributes from said entry after said step of creating said first entry wherein removing the subset of said first set of attributes comprises removing a first auxiliary class of one or more auxiliary classes associated with said subset of said first set of attributes and removing auxiliary classes that are superior to said first auxiliary class and that are not superior to any auxiliary classes that remain part of said entry.

2. A method according to claim 1, wherein:

said first set of one or more classes includes a structural class and a first set of one or more auxiliary classes.

3. A method according to claim 1, wherein:

said subset of said first set of attributes includes data stored in said attributes; and

said step of removing a subset of said first set of attributes includes removing said data.

4. A method according to claim 1, wherein said step of removing a subset of said first set of attributes includes the steps of:

identifying a set of auxiliary classes in a user interface;

receiving a selection of one or more of said auxiliary classes via said user interface; and

removing said selected one or more of said auxiliary classes.

5. A method according to claim 1, wherein said step of removing a subset of said first set of attributes includes the steps of:

identifying a set of attributes in a user interface;

receiving a selection of said subset of said first set of attributes via said user interface; and

removing said subset of said first set of attributes from said entry.

6. A method according to claim 1, further comprising the step of:

adding new attributes to said entry after said step of creating.

7. A method according to claim 6, wherein:

said step of adding new attributes includes adding one or more auxiliary classes associated with said new attributes to said entry.

8. A method according to claim 6, wherein said step of adding new attributes includes the steps of:

adding one or more auxiliary classes associated with said new attributes to said entry; and

adding classes to said entry that are not already part of said entry and are superior to said one or more auxiliary classes associated with said new attributes.

9. A method according to claim 6, wherein said step of adding new attributes includes the steps of:

identifying a set of auxiliary classes in a user interface;

receiving a selection of one or more of said auxiliary classes via said user interface; and

adding said selected one or more of said auxiliary classes.

10. A method according to claim 6, wherein said step of removing a subset of said first set of attributes includes the steps of:

identifying a set of attributes in a user interface;

receiving a selection of said new attributes via said user interface; and

adding one or more auxiliary classes associated with said new attributes to said entry.

11. A method according to claim 6, wherein:

said steps of creating, adding and removing are performed by an integrated identity and access system; and

said an integrated identity and access system is capable of evaluating said new attributes to authorize a user to access a resource.

12. A method according to claim 6, wherein:

said entry is a group entry; and

at least one of said new attributes stores a rule defining dynamic membership for said group entry.

13. A method according to claim 6, wherein:

said entry is a group entry; and

at least one of said new attributes stores a subscription policy for said group entry.

14. A method according to claim 1, wherein:

said steps of creating and removing are performed by an integrated identity and access system.

15. A method according to claim 1, wherein:

said entry is a group object; and

said step of creating includes instantiating said group object.

16. A method according to claim 15, wherein:

said step of removing includes a step of removing one or more auxiliary classes from said group object, said one or more auxiliary classes are associated with said subset of said first set of attributes.

17. A method according to claim 16 wherein said step of removing one or more auxiliary classes from said group object includes the steps of:

removing a first auxiliary class associated with said subset of said first set of attributes; and

removing classes that are superior to said first auxiliary class and that are not superior to any auxiliary classes that remain part of said entry.

18. The method of claim 17, wherein removing classes that are superior to said first auxiliary class and that are not superior to any other classes that remain part of said entry further comprises iteratively removing classes that are superior to said first auxiliary class and that are not superior to any other classes that remain part of said entry.

19. The method of claim 18, wherein iteratively removing classes that are superior to said first auxiliary class and that are not superior to any other classes that remain part of said entry continues to a root class.

20. A method according to claim 15, further comprising the step of:

adding new attributes to said entry after said step of creating, said step of adding new attributes includes adding one or more auxiliary classes associated with said new attributes to said entry.

21. A method according to claim 15, wherein:

said group object is stored in an LDAP directory.

22. One or more processor readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code when executed by one or more processors cause the one or more processors to manage Identity System entries by performing the steps of:

creating a first entry for said Identity System, said first entry includes a first set of attributes based on a first set of one or more classes; and

removing a subset of said first set of attributes from said entry after said step of creating said first entry wherein removing the subset of said first set of attributes comprises removing a first auxiliary class of one or more auxiliary classes associated with said subset of said first set of attributes and removing auxiliary classes that are superior to said first auxiliary class and that are not superior to any auxiliary classes that remain part of said entry.

23. One or more processor readable storage devices according to claim 22, wherein said method further comprises the step of:

adding new attributes to said entry after said step of creating, said step of adding new attributes includes adding one or more auxiliary classes associated with said new attributes to said entry.

24. One or more processor readable storage devices according to claim 23, wherein said step of adding new attributes includes the steps of:

adding one or more auxiliary classes associated with said new attributes to said entry; and

adding classes to said entry that are not already part of said entry and are superior to said one or more auxiliary classes associated with said new attributes.

25. One or more processor readable storage devices according to claim 22, wherein:

said steps of creating and removing are performed by an integrated identity and access system.

26. One or more processor readable storage devices according to claim 22, wherein:

said entry is a group object; and

said step of creating includes instantiating said group object.

27. One or more processor readable storage devices-according to claim 26, wherein:

said step of removing includes a step of removing one or more auxiliary classes from said group object, said one or more auxiliary classes are associated with said subset of said first set of attributes.

28. One or more processor readable storage devices according to claim 27, wherein said step of removing one or more auxiliary classes from said group object includes the steps of:

removing a first auxiliary class associated with said subset of said first set of attributes; and

removing classes that are superior to said first auxiliary class and that are not superior to any auxiliary classes that remain part of said entry.

29. The one or more processor readable storage devices of claim 28, wherein removing classes that are superior to said first auxiliary class and that are not superior to any other classes that remain part of said entry further comprises iteratively removing classes that are superior to said first auxiliary class and that are not superior to any other classes that remain, part of said entry.

30. The one or more processor readable storage devices of claim 29, wherein iteratively removing classes that are superior to said first auxiliary class and that are not superior to any other classes that remain part of said entry continues to a root class.

31. One or more processor readable storage devices according to claim 26, wherein said method further comprises the step of:

adding new attributes to said entry after said step of creating, said step of adding new attributes includes adding one or more auxiliary classes associated with said new attributes to said entry.

32. One or more processor readable storage devices according to claim 26, wherein:

said group object is stored in an LDAP directory.

33. An apparatus that can be used to manage Identity System entries, comprising:

a communication interface; and

one or more processors in communication with said communication interface, said one or more processors perform a method comprising the steps of;

creating a first entry for said Identity System, said first entry includes a first set of attributes based on a first set of one or more classes, and

removing a subset of said first set of attributes from said entry after said step of creating said first entry wherein removing the subset of said first set of attributes comprises removing a first auxiliary class of one or more auxiliary classes associated with said subset of said first set of attributes and removing auxiliary classes that are superior to said first auxiliary class and that are not supenor to any auxiliary classes that remain part of said entry.

34. An apparatus according to claim 33, wherein said method further comprises the step of:

adding new attributes to said entry after said step of creating, said step of adding new attributes includes adding one or more auxiliary classes associated with said new attributes to said entry.

35. An apparatus according to claim 34, wherein said step of adding new attributes includes the steps of:

adding one or more auxiliary classes associated with said new attributes to said entry; and

adding auxiliary classes to said entry that are not already part of said entry and are superior to said one or more auxiliary classes associated with said new attributes.

36. An apparatus according to claim 33, wherein:

said steps of creating and removing are performed by an integrated identity and access system.

37. An apparatus according to claim 33, wherein:

said entry is a group object; and

said step of creating includes instantiating said group object.

38. An apparatus according to claim 37, wherein:

said step of removing includes a step of removing one or more auxiliary classes from said group object, said one or more auxiliary classes are associated with aid subset of said first set of attributes.

39. An apparatus according to claim 38 wherein said step of removing one or more auxiliary classes from said group object includes the steps of:

removing a first auxiliary class associated with said subset of said first set of attributes; and

removing auxiliary classes that are superior to said first auxiliary class and that are not superior to any auxiliary classes that remain part of said entry.

40. The apparatus of claim 39, wherein removing classes that are superior to said first auxiliary class and that are not superior to any other classes that remain part of said entry further comprises iteratively removing classes that are superior to said first auxiliary class and that are not supenor to any other classes that remain part of said entry.

41. The apparatus of claim 40, wherein iteratively removing classes that are superior to said first auxiliary class and that are not superior to any other classes that remain part of said entry continues to a root class.

42. An apparatus according to claim 37, wherein said method further comprises the step of:

adding new attributes to said entry after said step of creating, said step of adding new attributes includes adding one or more auxiliary classes associated with said new attributes to said entry.

43. An apparatus according to claim 37, wherein said group object is stored in an LDAP directory.