Identifying dynamic groups

• US 7,613,794 B2
• Filed: 03/12/2007
• Issued: 11/03/2009
• Est. Priority Date: 07/11/2002
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Summers, Robert, Delaney, Shawn P.
• Primary Examiner(s): BATES, KEVIN T
• Application Number:
  US11/684,796
• Publication Number:
  US 20070168530A1
• Time in Patent Office: 967 Days
• Field of Search: 709/203, 709/219, 709/229, 707/9, 707/3
• US Class Current: 709/219
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

Technology is disclosed for identifying dynamic groups that correspond to a user of a system. A system partitions a set of dynamic groups into multiple test sets of dynamic groups. The system selects a test set and determines whether the user corresponds to the test set. In one implementation, the system combines the filters for the dynamic groups in each test set into a single test set filter. The test set filter is satisfied if the filter of any dynamic group in the test set is satisfied. This allows the system to perform a single comparison between the resulting test set filter and the user'"'"'s profile to determine whether the user is a member of any dynamic group in the test set. If the user is not a member of any dynamic group in the test set, the system eliminates all of the test set'"'"'s dynamic groups from consideration, based on the single comparison. Otherwise, the dynamic groups in the test set remain in a list of groups that may include the user. This process is repeated for each test set. After each test set has been evaluated, new test sets are repeatedly generated and evaluated in the above-described fashion using the dynamic groups that are still in consideration. In each iteration, each test set contains fewer dynamic groups. This continues until each test set only contains one dynamic group. After performing an iteration with each test set containing one dynamic group, the only remaining dynamic groups are the ones that include the user as a member.

Claims

1. A method of identifying dynamic groups corresponding to a user, the method comprising:

based on a rule that defines dynamic membership, partitioning, by a computer system, a set of dynamic groups including dynamic members, into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups and wherein said set of dynamic groups are configured to have the potential for said user to be a member, wherein said rule is stored in a dynamic rule attribute of an identity profile of said at least one dynamic group, and wherein said at least one dynamic group includes one or more static members and an identification of each of said static members is stored in a static member attribute for said identity profile of said at least one dynamic group;

selecting, by the computer system, a test set from the multiple test sets;

storing an identification of each of said dynamic members of said at least one dynamic group, wherein said identification of each of said dynamic members is stored in said static member attribute for said identity profile of said at least one dynamic group;

determining, by the computer system, whether said identity profile corresponds to the selected test set in said multiple test sets, wherein said test set includes multiple dynamic groups from said set of dynamic groups, wherein the determination of correspondence includes determining if said static member attributes within said identity profile meet the selected test set'"'"'s filter requirements; and

removing, by the computer system, the selected test set from the multiple test sets in response to the said static member attributes within said identity profile not meeting the selected test set'"'"'s filter requirements.

2. A method according to claim 1, wherein determining whether said user corresponds to a test set in said multiple test sets comprises:

setting matching criteria for said test set; and

determining whether said user satisfies said matching criteria.

3. A method according to claim 2, wherein each dynamic group in said test set corresponds to at least a portion of said matching criteria.

4. A method according to claim 2, wherein said matching criteria includes a logical OR of at least one filter from each dynamic group in said test set.

5. A method according to claim 2, wherein said matching criteria is satisfied if a filter for any dynamic group in said test set is satisfied.

6. A method according to claim 2, wherein:

said matching criteria is a rule including a filter component, and

said filter component is satisfied if any filter from a dynamic group in said test set is satisfied.

7. A method according to claim 6, wherein said filter component is a logical OR of a filter from each dynamic group in said test set.

8. A method according to claim 6, wherein:

said filter component is a logical OR of a filter defining each dynamic group in said test set.

9. A method according to claim 6, wherein:

said rule includes a searchbase component, and

said searchbase component corresponds to a subtree containing said user.

10. A method according to claim 6, wherein:

said rule includes a searchbase component, and

said searchbase component corresponds to said user.

11. A method according to claim 10, wherein said user is represented by a user profile in a directory.

12. A method according to claim 11, wherein said determining whether said user satisfies said matching criteria comprises:

searching said directory using said rule.

13. A method according to claim 12, wherein said directory is searched using a LDAP search.

14. A method according to claim 11, wherein said directory employs LDAP.

15. A method according to claim 14, wherein:

said rule includes a scope component; and

said scope component corresponds to a base object scope.

16. A method according to claim 15, wherein said determining whether said user satisfies said matching criteria comprises:

searching said directory using said rule.

17. A method according to claim 11, wherein said directory is in communication with an Identity System.

18. A method according to claim 1, further comprising:

eliminating all dynamic groups in said test set from said set of dynamic groups, if it is determined that said user does not correspond to said test set.

19. A method according to claim 18, wherein said determining whether said user corresponds to a test set in said multiple test sets and said eliminating all dynamic groups in said test set from said set of dynamic groups are performed for each test set in said multiple test sets.

20. A method according to claim 1, further comprising:

removing from said test set all dynamic groups in said test set that do not correspond to said user, if it is determined that said user does correspond to said test set.

21. A method according to claim 20, wherein said removing from said test set all dynamic groups in said test set that do not correspond to said user comprises:

removing from said set of dynamic groups said all dynamic groups in said test set that do not correspond to said user.

22. A method according to claim 20, further comprising:

eliminating all dynamic groups in said test set from said set of dynamic groups, if it is determined that said user does not correspond to said test set.

23. A method according to claim 22, wherein said determining whether said user corresponds to a test set in said multiple test sets, said removing from said set of dynamic groups all dynamic groups in said test set that do not correspond to said user, and said eliminating all dynamic groups in said test set from said set of dynamic groups, are performed for each test set in said multiple test sets.

24. A method according to claim 1, wherein said determining whether said user corresponds to a test set in said multiple test sets comprises:

determining that all dynamic groups in said test set do not correspond to said user, based on a single directory search.

25. A method according to claim 1, wherein:

said method is performed as part of an Identity System.

26. A method according to claim 1, wherein:

said method is performed as part of an Access System.

27. A method according to claim 1, wherein:

said method is performed as part of an integrated Access System and Identity System.

28. A method according to claim 1, wherein determining whether said user corresponds to a test set in said multiple test sets is performed without accessing a directory server.

29. A method according to claim 28, wherein said determining whether said user corresponds to a test set in said multiple test sets is performed using a filter tester.

30. A method according to claim 1, wherein determining whether said user corresponds to a test set in said multiple test sets is performed using an SQL command.

31. One or more processor readable storage devices having processor readable code embodied on said one or more processor readable storage devices, said processor readable code for programming one or more processors and comprising:

code for based on a rule that defines dynamic membership, partitioning, by a computer system, a set of dynamic groups including dynamic members, into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups and wherein said set of dynamic groups are configured to have the potential for said user to be a member, wherein said rule is stored in a dynamic rule attribute of an identity profile of said at least one dynamic group, and wherein said at least one dynamic group includes one or more static members and an identification of each of said static members is stored in a static member attribute for said identity profile of said at least one dynamic group;

code for selecting, by the computer system, a test set from the multiple test sets;

code for storing an identification of each of said dynamic members of said at least one dynamic group, wherein said identification of each of said dynamic members is stored in said static member attribute for said identity profile of said at least one dynamic group;

code for determining, by the computer system, whether said identity profile corresponds to the selected test set in said multiple test sets, wherein said test set includes multiple dynamic groups from said set of dynamic groups, wherein the determination of correspondence includes determining if said static member attributes within said identity profile meet the selected test set'"'"'s filter requirements; and

code for removing, by the computer system, the selected test set from the multiple test sets in response to the said static member attributes within said identity profile not meeting the selected test set'"'"'s filter requirements.

32. One or more processor readable storage devices according to claim 31, wherein said code for determining whether a user corresponds to a test set in said multiple test sets comprises:

code for setting matching criteria for said test set; and

code for determining whether said user satisfies said matching criteria.

33. One or more processor readable storage devices according to claim 32, wherein:

said matching criteria is a rule including a filter component, and

said filter component is satisfied if a filter for any dynamic group in said test set is satisfied.

34. One or more processor readable storage devices according to claim 33, wherein:

said rule includes a searchbase component, and

said searchbase component corresponds to said user.

35. One or more processor readable storage devices according to claim 34, wherein said user is represented by a user profile in a directory.

36. One or more processor readable storage devices according to claim 35, wherein said code for determining whether said user satisfies said matching criteria comprises:

code for searching said directory using said rule.

37. One or more processor readable storage devices according to claim 36, wherein said code for searching said directory using said rule comprises code for searching using a LDAP search.

38. One or more processor readable storage devices according to claim 35, wherein:

said rule includes a scope component, and

said scope component corresponds to a base object scope.

39. One or more processor readable storage devices according to claim 38, wherein said code for determining whether said user satisfies said matching criteria comprises:

code for searching said directory using said rule.

40. One or more processor readable storage devices according to claim 31, wherein said processor readable code further comprises:

code for eliminating all dynamic groups in said test set from said set of dynamic groups, if it is determined that said user does not correspond to said test set.

41. One or more processor readable storage devices according to claim 40, wherein said processor readable code comprises, for each test set in said multiple test sets, code for determining whether said user corresponds to a test set in said multiple test sets and code for eliminating all dynamic groups in said test set from said set of dynamic groups.

42. One or more processor readable storage devices according to claim 31, wherein said processor readable code further comprises:

code for removing from said test set all dynamic groups in said test set that do not correspond to said user, if it is determined that said user does correspond to said test set.

43. One or more processor readable storage devices according to claim 42, wherein said code for removing from said test set all dynamic groups in said test set that do not correspond to said user comprises:

code for removing from said set of dynamic groups said all dynamic groups in said test set that do not correspond to said user.

44. One or more processor readable storage devices according to claim 31, wherein said code for determining whether a user corresponds to a test set in said multiple test sets comprises:

code for determining that all dynamic groups in said test set do not correspond to said user, based on a single directory search.

45. One or more processor readable storage devices according to claim 31, wherein:

said processor readable code is executable by an Identity System.

46. One or more processor readable storage devices according to claim 31, wherein:

said processor readable code is executable by an Access System.

47. One or more processor readable storage devices according to claim 31, wherein:

said processor readable code is executable by an integrated Access System and Identity System.

48. An apparatus, comprising:

one or more storage devices; and

one or more processors in communication with said one or more storage devices, said one or more storage devices comprising processor readable code for programming said one or more processors, said processor readable code comprising;

code for based on a rule that defines dynamic membership, partitioning, by a computer system, a set of dynamic groups including dynamic members, into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups and wherein said set of dynamic groups are configured to have the potential for said user to be a member, wherein said rule is stored in a dynamic rule attribute of an identity profile of said at least one dynamic group, and wherein said at least one dynamic group includes one or more static members and an identification of each of said static members is stored in a static member attribute for said identity profile of said at least one dynamic group;

code for selecting, by the computer system, a test set from the multiple test sets;

code for storing an identification of each of said dynamic members of said at least one dynamic group, wherein said identification of each of said dynamic members is stored in said static member attribute for said identity profile of said at least one dynamic group;

code for determining, by the computer system, whether said identity profile corresponds to the selected test set in said multiple test sets, wherein said test set includes multiple dynamic groups from said set of dynamic groups, wherein the determination of correspondence includes determining if said static member attributes within said identity profile meet the selected test set'"'"'s filter requirements; and

code for removing, by the computer system, the selected test set from the multiple test sets in response to the said static member attributes within said identity profile not meeting the selected test set'"'"'s filter requirements.

49. An apparatus according to claim 48, wherein said code for determining whether a user corresponds to a test set in said multiple test sets comprises:

code for setting matching criteria for said test set; and

code for determining whether said user satisfies said matching criteria.

50. An apparatus according to claim 49, wherein:

said matching criteria is a rule including a filter component, and

said filter component is satisfied if a filter for any dynamic group in said test set is satisfied.

51. An apparatus according to claim 50, wherein:

said rule includes a searchbase component, and

said searchbase component corresponds to said user.

52. An apparatus according to claim 51, wherein said user is represented by a user profile in a directory.

53. An apparatus according to claim 52, wherein said code for determining whether said user satisfies said matching criteria comprises:

code for searching said directory using said rule.

54. An apparatus according to claim 52, wherein:

said rule includes a scope component; and

said scope component corresponds to a base object scope.

55. An apparatus according to claim 54, wherein said code for determining whether said user satisfies said matching criteria comprises:

code for searching said directory using said rule.

56. An apparatus according to claim 48, wherein said processor readable code further comprises:

code for eliminating all dynamic groups in said test set from said set of dynamic groups, if it is determined that said user does not correspond to said test set.

57. An apparatus according to claim 48, wherein said processor readable code further comprises:

code for removing from said test set all dynamic groups in said test set that do not correspond to said user, if it is determined that said user does correspond to said test set; and

code for eliminating all dynamic groups in said test set from said set of dynamic groups, if it is determined that said user does not correspond to said test set.

58. An apparatus according to claim 48, wherein said code for determining whether a user corresponds to a test set in said multiple test sets comprises:

code for determining that all dynamic groups in said test set do not correspond to said user, based on a single directory search.

59. An apparatus according to claim 48, wherein:

said processor readable code is executable by an Identity System.

60. An apparatus according to claim 48, wherein:

said processor readable code is executable by an Access System.

61. A method of identifying dynamic profiles corresponding to an entity, the method comprising:

based on a rule that defines dynamic membership, partitioning, by a computer system, a set of dynamic groups including dynamic members, into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups and wherein said set of dynamic groups are configured to have the potential for said entity to be a member, wherein said rule is stored in a dynamic rule attribute of an identity profile of said at least one dynamic group, and wherein said at least one dynamic group includes one or more static members and an identification of each of said static members is stored in a static member attribute for said identity profile of said at least one dynamic group;

selecting, by the computer system, a test set from the multiple test sets;

storing an identification of each of said dynamic members of said at least one dynamic group, wherein said identification of each of said dynamic members is stored in said static member attribute for said identity profile of said at least one dynamic group;

determining, by the computer system, whether said identity profile corresponds to the selected test set in said multiple test sets, wherein said test set includes multiple dynamic groups from said set of dynamic groups, wherein the determination of correspondence includes determining if said static member attributes within said identity profile meet the selected test set'"'"'s filter requirements; and

removing, by the computer system, the selected test set from the multiple test sets in response to the said static member attributes within said identity profile not meeting the selected test set'"'"'s filter requirements.

62. A method according to claim 61, wherein said determining whether said entity corresponds to a test set in said multiple test sets comprises:

setting matching criteria for said test set; and

determining whether said entity satisfies said matching criteria.

63. A method according to claim 62, wherein said matching criteria is satisfied if a filter for any dynamic profile in said test set is satisfied.

64. A method according to claim 62, wherein:

said matching criteria is a rule including a filter component, and

said filter component is satisfied if any filter from a dynamic group in said test set is satisfied.

65. A method according to claim 64, wherein:

said rule includes a searchbase component;

said searchbase component corresponds to said entity;

said rule includes a scope component; and

said scope component corresponds to a base object scope.

66. A method according to claim 65, wherein said entity is represented by a profile in a directory, wherein said determining whether said entity satisfies said matching criteria comprises:

code for searching said directory using said rule.

67. A method according to claim 61, wherein said entity is represented by a user profile and said set of dynamic profiles includes dynamic group profiles.

68. A method according to claim 61, further comprising:

eliminating all dynamic profiles in said test set from said set of dynamic profiles, if it is determined that said entity does not correspond to said test set.

69. A method according to claim 61, wherein said determining whether said entity corresponds to a test set in said multiple test sets comprises:

determining that all dynamic profiles in said test set do not correspond to said entity, based on a single directory search.

70. One or more processor readable storage devices having processor readable code embodied on said one or more processor readable storage devices, said processor readable code for programming one or more processors and comprising:

code for based on a rule that defines dynamic membership, partitioning, by a computer system, a set of dynamic groups including dynamic members, into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups and wherein said set of dynamic groups are configured to have the potential for said entity to be a member, wherein said rule is stored in a dynamic rule attribute of an identity profile of said at least one dynamic group, and wherein said at least one dynamic group includes one or more static members and an identification of each of said static members is stored in a static member attribute for said identity profile of said at least one dynamic group;

code for selecting, by the computer system, a test set from the multiple test sets;

code for storing an identification of each of said dynamic members of said at least one dynamic group, wherein said identification of each of said dynamic members is stored in said static member attribute for said identity profile of said at least one dynamic group;

code for determining, by the computer system, whether said identity profile corresponds to the selected test set in said multiple test sets, wherein said test set includes multiple dynamic groups from said set of dynamic groups, wherein the determination of correspondence includes determining if said static member attributes within said identity profile meet the selected test set'"'"'s filter requirements; and

code for removing, by the computer system, the selected test set from the multiple test sets in response to the said static member attributes within said identity profile not meeting the selected test set'"'"'s filter requirements.

71. One or more processor readable storage devices according to claim 70, wherein said code for determining whether said entity corresponds to a test set in said multiple test sets comprises:

code for setting matching criteria for said test set; and

code for determining whether said entity satisfies said matching criteria, wherein said matching criteria is satisfied if a filter for any dynamic profile in said test set is satisfied.

72. One or more processor readable storage devices according to claim 71, wherein:

said matching criteria is a rule;

said rule includes a filter component;

said filter component is satisfied if a filter for any dynamic profile in said test set is satisfied;

said rule includes a searchbase component;

said searchbase component corresponds to said entity;

said rule includes a scope component; and

said scope component corresponds to a base object scope.

73. One or more processor readable storage devices according to claim 72, wherein said entity is represented by a profile in a directory, wherein said code for determining whether said entity satisfies said matching criteria comprises:

code for searching said directory using said rule.

74. One or more processor readable storage devices according to claim 70, wherein said processor readable code further comprises:

code for eliminating all dynamic profiles in said test set from said set of dynamic profiles, if it is determined that said entity does not correspond to said test set.

75. One or more processor readable storage devices according to claim 70, wherein said code for determining whether said entity corresponds to a test set in said multiple test sets comprises:

code for determining that all dynamic profiles in said test set do not correspond to said entity, based on a single directory search.

76. An apparatus, comprising:

one or more storage devices; and

one or more processors in communication with said one or more storage devices, said one or more storage devices comprising processor readable code for programming said one or more processors, said processor readable code comprising;

code for based on a rule that defines dynamic membership, partitioning, by a computer system, a set of dynamic groups including dynamic members, into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups and wherein said set of dynamic groups are configured to have the potential for said entity to be a member, wherein said rule is stored in a dynamic rule attribute of an identity profile of said at least one dynamic group, and wherein said at least one dynamic group includes one or more static members and an identification of each of said static members is stored in a static member attribute for said identity profile of said at least one dynamic group;

code for selecting, by the computer system, a test set from the multiple test sets;

code for storing an identification of each of said dynamic members of said at least one dynamic group, wherein said identification of each of said dynamic members is stored in said static member attribute for said identity profile of said at least one dynamic group;

code for determining, by the computer system, whether said identity profile entity corresponds to the selected test set in said multiple test sets, wherein said test set includes multiple dynamic groups from said set of dynamic groups, wherein the determination of correspondence includes determining if said static member attributes within said identity profile meet the selected test set'"'"'s filter requirements; and

code for removing, by the computer system, the selected test set from the multiple test sets in response to the said static member attributes within said identity profile not meeting the selected test set'"'"'s filter requirements.