Lightweight directory access protocol, (LDAP) trusted processing of unique identifiers

• US 6,714,930 B1
• Filed: 05/31/2000
• Issued: 03/30/2004
• Est. Priority Date: 05/31/2000
• Status: Expired due to Fees

• Current Assignee: Snap, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Garrison, John Michael, Skibbie, Donna E.
• Primary Examiner(s): Homere, Jean R.
• Assistant Examiner(s): Wong, Leslie
• Application Number:
  US09/583,409
• Time in Patent Office: 1,399 Days
• Field of Search: 707/9, 707/10, 707/3, 707/4, 713/170, 713/201, 714/42, 709/206, 709/207, 709/223, 709/225, 709/229, 709/203, 709/219
• US Class Current: 1/1
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

A trusted process for use with a hierarchical directory service such as LDAP for enabling different security systems to store and retrieve unique identifiers that are shared or common to the entire directory. The trusted process allows LDAP users to store and to retrieve unique identifiers on LDAP using standard LDAP interfaces. It also allows security systems to share unique identifier information. The trusted process generates or verifies a unique identifier, guarantees the uniqueness of a unique identifier within the entire directory (rather than just within a single security system), and guarantees that any unique identifier returned to an LDAP user is a trusted unique identifier.

Claims

1. A computer-implemented method of configuring a unique identifier that may be shared by a plurality of users of a hierarchical directory, the method comprising:

intercepting a call to access a unique identifier attribute of an entry in the hierarchical directory;

in response to intercepting a call, verifying that a unique identifier specified in the call is unique to the hierarchical directory;

if the unique identifier specified in the call is unique to the hierarchical directory, storing the unique identifier in a trusted unique identifier attribute of the entry in the hierarchical directory; and

setting an access control on the entry so that the entry cannot be modified.

2. The method as described in claim 1 further including the step of generating a unique identifier if the call does not specify any such unique identifier.

3. The method as described in claim 1 wherein the entry is a child entry of an object class used to create the child entry.

4. The method as described in claim 3 wherein the child entry is under an entry having the unique identifier attribute.

5. The method as described in claim 1 wherein the hierarchical directory is LDAP.

6. The method as described in claim 1 further including the step of issuing a notification that the unique identifier may be obtained by issuing calls to the unique identifier attribute.

7. The method as described in claim 1 further including the step of restricting access to the trusted unique identifier attribute except by a given process.

8. The method as described in claim 7 wherein the given process verifies the unique identifier and stores the unique identifier in the trusted unique identifier attribute.

9. The method as described in claim 1 wherein the access control is a set of access control lists (ACLs).

10. A computer-implemented method of managing a unique identifier that may be shared by a plurality of users of an LDAP directory, comprising:

storing a unique identifier in a trusted unique identifier attribute of an entry in the LDAP directory;

setting an access control so that the trusted unique identifier attribute cannot be modified; and

notifying users of the LDAP directory that the unique identifier can be obtained by issuing calls to a unique identifier attribute.

11. The method as described in claim 10 further including the steps of:

intercepting a call to access the unique identifier attribute;

in response to intercepting a call, verifying that a trusted process created an entry or a given object class that contains the trusted unique identifier attribute; and

upon verification, retrieving the unique identifier from the trusted unique identifier attribute.

12. The method as described in claim 11 further including the step of returning the unique identifier to an entity that issued the call.

13. A computer-implemented method of retrieving a unique identifier that may be shared by a plurality of users of an LDAP directory, comprising:

intercepting a call to access a unique identifier attribute of an entry in the hierarchical directory;

in response to intercepting a call, verifying that a trusted process created an entry of a given object class that contains a trusted unique identifier attribute;

upon verification, retrieving the unique identifier from the trusted unique identifier attribute; and

returning the unique identifier to an entity that issued the call.

14. A computer program product useable in an LDAP directory service, comprising:

an object class that contains a trusted unique identifier attribute used to store a unique identifier; and

a trusted process for creating a child entry of the object class, for storing the unique identifier in the trusted unique identifier attribute, for setting an access control on the child entry so that the child entry cannot be modified, and for intercepting and processing calls to access a unique identifier attribute.

15. The computer program product as described in claim 14 wherein the trusted process processes calls by returning the unique identifier retrieved from the trusted unique identifier attribute.

16. The computer program product as described in claim 14 wherein the access control is a set of access control lists (ACLs).

17. The computer program product as described in claim 14 wherein the child entry is under an entry having the unique identifier attribute.

18. A computer program product in a computer-useable medium for use in an LDAP directory service, comprising:

code for storing a unique identifier in an entry of an object class having a trusted unique identifier attribute;

code for setting an access control so that the trusted unique identifier attribute cannot be modified; and

code for intercepting a call to access a unique identifier attribute and retrieving the unique identifier from the trusted unique identifier attribute.

19. The computer program product as described in claim 18 wherein the code for intercepting includes:

code for verifying that the entry of the object class contains the trusted unique identifier attribute.

20. The computer program product as described in claim 18 wherein the entry is under an entry having the unique identifier attribute.

21. An LDAP directory service, comprising:

an LDAP directory;

an object class that contains a trusted unique identifier attribute used to store a unique identifier; and

a trusted process for creating a child entry of the object class in the LDAP directory, for storing the unique identifier in the trusted unique identifier attribute, for setting an access control on the child entry so that the child entry cannot be modified, and for intercepting calls to access a unique identifier attribute and, in response, returning the unique identifier retrieved from the trusted unique identifier attribute.