Method and system for providing synchronization of directory data

• US 8,245,129 B2
• Filed: 10/30/2007
• Issued: 08/14/2012
• Est. Priority Date: 12/19/2005
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: Wilkinson, Anthony J, Benson, Mark
• Primary Examiner(s): HUYNH, CONG LAC T
• Application Number:
  US11/929,302
• Publication Number:
  US 20080147745A1
• Time in Patent Office: 1,750 Days
• Field of Search: 715/239, 715/236
• US Class Current: 715/236
• CPC Class Codes: G06F 16/282 Hierarchical databases, e.g. IMS, LDAP data stores or Lotus Notes
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/505 considering the load
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 61/4523 using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30
• CPC Class Codes: H04L 67/1023 based on a hash applied to IP addresses or costs
• CPC Class Codes: H04L 67/1031 Controlling of the operation of servers by a load balancer, e.g. adding or removing servers that serve requests
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context

Abstract

Methods and systems for providing synchronization of directory data between directory servers are provided. Example embodiments provide a Application Workspace System “AWS,” which enables users to access remote server-based applications using the same interface that they use to access local applications, without needing to know where the application is being accessed. In one embodiment of the AWS, every data entry in the LDAP is automatically replicated to the other directories using XLDAPS technology. In one embodiment, XLDAPS uses XSLT transformation rules to synchronize LDAP changes to different LDAP Directories which may have a different LDAP Schema and a different LDAP Directory Information Tree structure This abstract is provided to comply with rules requiring an abstract, and it is submitted with the intention that it will not be used to interpret or limit the scope or meaning of the claims.

Claims

1. A method in a computing system for performing automated electronic replication of a first directory data repository in a first data format to a second directory data repository in a second data format, wherein the first data format is different from the second data format, comprising:

providing and storing in a memory of a computing system an XSLT definition, the XSLT definition comprising a plurality of rules for transforming directory data in the first data format to a representation in the second data format;

upon detecting a change to at least one entry in the first directory data repository, automatically invoking an XSLT processor to retrieve the stored XSLT definition and process the XSLT definition to automatically generate, in the second data format, a log of the change to the at least one entry;

on a periodic basis, providing the log of the change to the at least one entry to an application service associated with the second directory data repository such that the change to the at least one entry in the first directory data repository can be automatically replicated in the second directory data repository in the second format; and

wherein the first directory data repository uses an LDAP protocol and the second directory data repository uses an Active Directory protocol and the method performs automatic replication of an LDAP directory to an Active Directory directory.

2. The method of claim 1 wherein the first and second directory data repositories are used to provide authentication services.

3. The method of claim 1 used to provide an audit log in a data format that is distinct from the first data format.

4. The method of claim 1 provided by a plug-in code module.

5. The method of claim 1 wherein the change to the at least one entry in the first directory data repository is at least one of an operation to add an entry, an operation to modify an entry, or an operation to delete an entry.

6. The method of claim 1 wherein attribute mappings are specified by the stored XSLT definition.

7. The method of claim 1 wherein the first directory data repository is stored in a first directory server and wherein the second directory data repository is stored in a second directory server.

8. The method of claim 1 wherein the change to the at least one entry in the first directory data repository is an LDAP Modify, and further comprising:

processing the LDAP Modify by performing XSLT processing only for LDAP attribute values that have been changed, and by not performing XSLT processing for LDAP attribute values that have not been changed.

9. The method of claim 1, further comprising:

parsing the XSLT definition, wherein the parsing of the XSLT definition is performed only at initialization time of a plug-in that performs the method.

10. The method of claim 1, further comprising:

decrypting encrypted parameters passed to the XSLT processor.

11. A computer-readable medium containing contents that, when executed, causes a computing system to perform a method comprising:

in response to detecting an operation performed on at least one entry of a first directory data repository, the operation specified in accordance with an input data format, automatically executing a processor, configured, when executed, to;

determine one or more stored XSLT stylesheet definitions for transforming directory data in the input data format to directory data in an output data format, the output data format being different from the input data format;

automatically generate a representation in the output data format of the operation performed on the at least one entry of the first directory data repository such that the operation can be automatically replicated using the output data format; and

wherein the input data format is specified in accordance with an LDAP directory protocol and the output data format is specified in accordance with an Active Directory protocol and the method performs automatic replication of an LDAP directory to an Active Directory directory.

12. The computer-readable medium of claim 11 wherein the computer-readable medium is a memory in a computing device.

13. The computer-readable medium of claim 11, the method performed by a first directory server, and wherein the method is used to replicate an LDAP directory in one or more other directory servers.

14. The computer-readable medium of claim 11, the method further comprising:

on a periodic basis, providing the generated representation in the output data format to an application service associated with a second directory data repository such that the at least one entry in the first directory data repository can be automatically replicated in the second directory data repository.

15. The computer-readable medium of claim 11 wherein the generated representation in the output data format is at least one of a change log, an audit log, a representation used to authenticate data, or a representation used to synchronize data.

16. The computer-readable medium of claim 11 wherein the operation performed on the at least one entry of the first directory data repository is at least one of a modify operation, an add operation, or a delete operation.

17. The computer-readable medium of claim 11 wherein the contents are configured to be executed by a software plug-in module, and the one or more stylesheet definitions can be modified to generate a new transformation transparent to the plug-in module.

18. The computer-readable medium of claim 11, wherein the method further comprises:

parsing the one or more XSLT stylesheet definitions, wherein the parsing of the one or more XSLT stylesheet definitions is performed only at initialization time of a plug-in that performs the method.

19. The computer-readable medium of claim 11, wherein the method further comprises:

decrypting encrypted parameters passed to an XSLT processor.

20. A computing system for providing automated replication of directory data in data repositories stored according to distinct data formats, comprising:

a first data repository configured to store therein directory data in a first data format; and

a memory having a directory services plug-in module stored thereon, configured, when executed, to;

retrieve an XSLT stylesheet that provides one or more definitions for transforming directory data in the first data format to a second data format;

upon detecting a change to directory data stored in the first data repository, invoke an XSLT processor with the retrieved stylesheet to provide in a second data format a record of the change in the directory data, the record configured to be automatically consumable by a software service connected with a second data repository; and

wherein the first directory data repository uses an LDAP protocol and the second directory data repository uses an Active Directory protocol and the directory services plug-in module performs automatic replication of an LDAP directory to an Active Directory directory.

21. The computing system of claim 20 wherein the stylesheet is modified to accommodate new configuration parameters in a manner that is transparent to the plug-in module.

22. The computing system of claim 20 wherein the first and second data repositories are used to provide authentication services.

23. The computing system of claim 20 wherein the record is used to provide an audit log.