Root node for integrating NAS of different user name spaces

• US 7,761,552 B2
• Filed: 01/22/2008
• Issued: 07/20/2010
• Est. Priority Date: 09/18/2007
• Status: Expired due to Fees

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Yamasaki, Yasuo, Nakamura, Takaki, Kamei, Hitoshi
• Primary Examiner(s): SALAD, ABDULLAHI ELMI
• Application Number:
  US12/017,655
• Publication Number:
  US 20090077201A1
• Time in Patent Office: 910 Days
• Field of Search: 709/217, 709/219, 709/245, 709220-224, 709/229, 726/6
• US Class Current: 709/223
• CPC Class Codes: H04L 2101/365 Application layer names, e.g. buddy names, unstructured names chosen by a user or home appliance name
• CPC Class Codes: H04L 61/2596 Translation of addresses of the same type other than IP, e.g. translation from MAC to MAC addresses
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

A computer apparatus which integrates at least two or more services of user management domains has a processor, a memory and an interface. The processor receives an access request, specifies an access source domain, specifies an access target domain, and judges whether the specified access source domain matches the specified access target domain. If the access source domain is different from the access target domain, the processor extracts a user ID of the specified access source domain from the received access request, and refers to ID conversion information indicating correspondence of user IDs between the user management domains whose services are integrated to convert the extracted user ID of the access source domain into a user ID of the specified access target domain. Thus, loads of configuration at the time of service integration are reduced.

Claims

1. A computer apparatus for integrating at least two or more services of user management domains which are user management units, comprising:

a processor;

a memory; and

an interface,

wherein the processor is configured to;

receive an access request;

specify a user management domain to which a request source of the received access request belongs as an access source domain;

specify a user management domain to which an access target of the received access request belongs as an access target domain;

judge whether the specified access source domain matches the specified access target domain;

execute a process according to the received access request, in the case of which the access source domain matches the access target domain;

extract a user ID of the specified access source domain from the received access request, in the case of which the access source domain is different from the access target domain;

refer to ID conversion information indicating correspondence of user IDs between the user management domains whose services are integrated in order to convert the extracted user ID of the access source domain into a user ID of the specified access target domain;

substitute the user ID included in the received access request with the converted user ID; and

execute a process according to the user ID substituted access request, wherein;

the ID conversion information further indicates correspondence of group IDs between the user management domains whose services are integrated; and

the processor is further configured to;

extract a group ID of the specified access source domain from the received access request, in the case of which the access source domain is different from the access target domain;

refer to the ID conversion information to convert the extracted group ID of the access source domain into a group ID of the specified access target domain;

substitute the group ID included in the received access request with the converted group ID; and

execute a process according to the user ID and group ID substituted access request.

2. The computer apparatus according to claim 1, wherein:

the services to be integrated are file share services; and

the access request is a file access request.

3. The computer apparatus according to claim 1, wherein the processor is further configured to:

judge whether a user ID of the specified access target domain corresponding to the extracted user ID of the access source domain has been registered in the ID conversion information, in the case of converting the user ID;

convert the extracted user ID of the access source domain into the registered user ID of the access target domain, in the case of which the user ID has been registered in the ID conversion information;

specify an unused user ID of the specified access target domain, in the case of which the user ID has not been registered in the ID conversion information;

convert the extracted user ID of the access source domain into the unused user ID of the specified access target domain; and

register correspondence between the extracted user ID of the access source domain and the unused user ID of the specified access target domain in the ID conversion information.

4. The computer apparatus according to claim 3, wherein the processor is further configured to:

judge whether the received access request concerns a process for updating an access target user ID, in the case of registering the correspondence between the extracted user ID of the access source domain and the unused user ID of the specified access target domain in the ID conversion information;

register the correspondence between the extracted user ID of the access source domain and the unused user ID of the specified access target domain as permanent information in the ID conversion information, in the case of which the received access request concerns the process for updating the access target user ID; and

register the correspondence between the extracted user ID of the access source domain and the unused user ID of the specified access target domain as temporary information in the ID conversion information in the case of which the received access request does not concern the process for updating the access target user ID.

5. The computer apparatus according to claim 3, wherein the processor is further configured to:

obtain a user ID used in the user management domain from a management computer which manages the user management domain; and

specify an unused user ID of the user management domain based on the obtained used user ID.

6. The computer apparatus according to claim 1, wherein the processor is further configured to:

specify the access source domain based on one of information regarding connection between the request source of the received access request and the computer apparatus, IP address information of the request source of the received access request, and information regarding a network port of the computer apparatus; and

specify the access target domain based on one of an access target directory path included in the received access request, information regarding an access target file system of the received access request, and information regarding an apparatus which manages an access target file of the access request.

7. The computer apparatus according to claim 1, wherein the processor is further configured to:

extract the user ID of the specified access target domain from a result with respect to the received access request, in the case of which the access source domain is different from the access target domain;

refer to the ID conversion information in order to convert the extracted user ID of the access target domain into the user ID of the specified access source domain; and

transmit a result including the converted user ID to the request source of the received access request.

8. The computer apparatus according to claim 7, wherein:

the ID conversion information further indicates correspondence of group IDs between the user management domains whose services are integrated; and

the processor is further configured to;

extract a group ID of the specified access target domain from a result with respect to the received access request, in the case of which the access source domain is different from the access target domain;

refer to the ID conversion information to convert the extracted group ID of the access target domain into a group ID of the specified access source domain; and

transmit a result containing the converted user ID and the converted group ID to the request source of the received access request.

9. The computer apparatus according to claim 7, wherein the processor is further configured to:

judge whether a user ID of the specified access source domain corresponding to the extracted user ID of the access target domain has been registered in the ID conversion information, in the case of converting the user ID;

convert the extracted user ID of the access target domain into the registered user ID of the access source domain, in the case of which the user ID has been registered in the ID conversion information;

specify an unused user ID of the specified access source domain, in the case of which the user ID has not been registered in the ID conversion information;

convert the extracted user ID of the access target domain into the specified unused user ID of the access source domain; and

register correspondence between the extracted user ID of the access target domain and the specified unused user ID of the access source domain in the ID conversion information.

10. A computer system comprising:

a plurality of client computers belonging to user management domains which are user management units; and

a server apparatus for integrating at least two or more services of the user management domains,

wherein the server apparatus comprises a processor, a memory and an interface,

wherein the server apparatus is configured to;

receive an access request from one of the plurality of client computers;

specify a user management domain to which the client computer of a request source of the received access request belongs as an access source domain;

specify a user management domain to which an access target of the received access request belongs as an access target domain;

judge whether the specified access source domain matches the specified access target domain;

execute a process according to the received access request, in the case of which the access source domain matches the access target domain;

extract a user ID of the specified access source domain from the received access request, in the case of which the access source domain is different from the access target domain;

refer to ID conversion information indicating correspondence of user IDs between the user management domains whose services are integrated in order to convert the extracted user ID of the access source domain into a user ID of the specified access target domain;

substitute the user ID included in the received access request with the converted user ID; and

execute a process according to the user ID substituted access request, wherein;

the ID conversion information further indicates correspondence of group IDs between the user management domains whose services are integrated; and

the server apparatus is further configured to;

extract a group ID of the specified access source domain from the received access request, in the case of which the access source domain is different from the access target domain;

refer to the ID conversion information to convert the extracted group ID of the access source domain into a group ID of the specified access target domain;

substitute the group ID included in the received access request with the converted group ID; and

execute a process according to the user ID and group ID substituted access request.

11. The computer system according to claim 10, wherein:

the services to be integrated are file share services; and

the access request is a file access request.

12. The computer system according to claim 10, wherein the server apparatus is further configured to:

judge whether a user ID of the specified access target domain corresponding to the extracted user ID of the access source domain has been registered in the ID conversion information, in the case of converting the user ID;

convert the extracted user ID of the access source domain into the registered user ID of the access target domain, in the case of which the user ID has been registered in the ID conversion information;

specify an unused user ID of the specified access target domain, in the case of which the user ID has not been registered in the ID conversion information;

convert the extracted user ID of the access source domain into the unused user ID of the specified access target domain; and

register correspondence between the extracted user ID of the access source domain and the unused user ID of the specified access target domain in the ID conversion information.

13. The computer system according to claim 12, wherein the server apparatus is further configured to:

judge whether the received access request concerns a process for updating an access target user ID, in the case of registering the correspondence between the extracted user ID of the access source domain and the unused user ID of the specified access target domain in the ID conversion information;

register the correspondence between the extracted user ID of the access source domain and the unused user ID of the specified access target domain as permanent information in the ID conversion information, in the case of which the received access request concerns the process for updating the access target user ID; and

register the correspondence between the extracted user ID of the access source domain and the unused user ID of the specified access target domain as temporary information in the ID conversion information, in the case of which the received access request does not concern the process for updating the access target user ID.

14. The computer system according to claim 12, further comprising a management computer for managing the user management domain,

wherein the server apparatus is further configured to:

obtain a user ID used in the user management domain from the management computer; and

specify an unused user ID of the user management domain based on the obtained used user ID.

15. The computer system according to claim 10, wherein the server apparatus is further configured to:

specify the access source domain based on one of information regarding connection between the client computer of the request source of the received access request and the server apparatus, IP address information of the client computer of the request source of the received access request, and information regarding a network port of the server apparatus; and

specify the access target domain based on one of an access target directory path included in the received access request, information regarding an access target file system of the received access request, and information regarding an apparatus which manages an access target file of the access request.

16. The computer system according to claim 10, wherein the server apparatus is further configured to:

extract the user ID of the specified access target domain from a result with respect to the received access request, in the case of which the access source domain is different from the access target domain;

refer to the ID conversion information in order to convert the extracted user ID of the access target domain into the user ID of the specified access source domain; and

transmit a result including the converted user ID to the client computer of the request source of the received access request.

17. The computer system according to claim 16,

wherein the ID conversion information further indicates correspondence of group IDs between the user management domains whose services are integrated, and

wherein the server apparatus is further configured to:

extract a group ID of the specified access target domain from a result with respect to the received access request, in the case of which the access source domain is different from the access target domain;

refer to the ID conversion information to convert the extracted group ID of the access target domain into a group ID of the specified access source domain; and

transmit a result containing the converted user ID and the converted group ID to the client computer of the request source of the received access request.

18. The computer system according to claim 16, wherein the server apparatus is further configured to:

judge whether a user ID of the specified access source domain corresponding to the extracted user ID of the access target domain has been registered in the ID conversion information, in the case of converting the user ID;

convert the extracted user ID of the access target domain into the registered user ID of the access source domain, in the case of which the user ID has been registered in the ID conversion information;

specify an unused user ID of the specified access source domain, in the case of which the user ID has not been registered in the ID conversion information;

convert the extracted user ID of the access target domain into the specified unused user ID of the access source domain; and

register correspondence between the extracted user ID of the access target domain and the specified unused user ID of the access source domain in the ID conversion information.