Enumerated roles in a directory system

• US 20030037044A1
• Filed: 05/29/2001
• Published: 02/20/2003
• Est. Priority Date: 05/29/2001
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Rowley, Peter, Boreham, David, Smith, Mark C.
• Granted Patent: US 7,016,907 B2
• Time in Patent Office: Days
• US Class Current: 707/3
• CPC Class Codes: G06F 16/10 File systems; File servers
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99942 Manipulating data structure, e.g. compression, compaction, compilation
• CPC Class Codes: Y10S 707/99943 Generating database or data structure, e.g. via user interface
• CPC Class Codes: Y10S 707/99945 Object-oriented database structure processing

Abstract

Role is a comprehensive grouping mechanism used in a directory server. In a client-server directory system, roles transfer some of the complexity to the directory server. A role is defined by its role definition entry. Assigning entries to roles enables applications to locate the roles of a target entry, rather than select a group and browse the members list. By changing a role definition, a user can change an entire organization with ease. Any client with appropriate access privileges can discover, identify and examine any role definition.

An enumerated role is one that contains a list of target entries as members. By simply searching for the membership of the enumerated role, a client application will obtain a list of all members that possess that enumerated role.

Claims

1. A method of grouping entries in a directory server, said directory server configured to contain roles, the method comprising the step of:

assigning an entry to an enumerated role, whereby the entry can be selected by selecting all entries that possess the enumerated role.

2. The method as in claim 1 wherein the enumerated role is possessed by an arbitrary number of entries.

3. The method as in claim 1, further comprising the step of:

if an entry that possesses the enumerated role is a nested role, then rejecting that entry without further processing of the entry.

4. The method of claim 1, further comprising the step of:

providing a set of expressions and boolean operations for use to match entries in a directory search.

5. The method of claim 4, wherein the expressions comprise any one or more of operands connected by the operators,

6. An apparatus comprising:

a directory server comprising;

a first component configured to assign an entry to a first enumerated role, whereby the entry can be selected by selecting all entries that possess the enumerated role.

7. The apparatus as in claim 6 wherein the first component assigns an arbitrary number of entries to said first enumerated role.

8. The apparatus as in claim 6, further comprising:

a second component coupled to the directory server configured to reject an entry without further processing if the entry that possesses the enumerated role is a nested role.

9. The apparatus of claim 6, further comprising:

a component to provide a set of expressions and boolean operations for use to match entries in a directory search.

10. The apparatus of claim 9, wherein the expressions comprise any one or more of operands connected by the operators,