Nested XOR roles

• US 7,774,433 B2
• Filed: 02/27/2007
• Issued: 08/10/2010
• Est. Priority Date: 02/27/2007
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Rowley, Peter Andrew
• Primary Examiner(s): Backer; Firmin
• Assistant Examiner(s): ALGIBHAH, HAMZA N
• Application Number:
  US11/712,293
• Publication Number:
  US 20080208810A1
• Time in Patent Office: 1,260 Days
• Field of Search: 709/219
• US Class Current: 709/219
• CPC Class Codes: G06F 16/10 File systems; File servers

Abstract

A method and apparatus for managing a nested XOR role in a directory server is described. In one embodiment, a plurality of entries is defined in the directory server. At least one of the plurality of entries possesses a role. An entry is queried to determine its possessed role. A nested XOR role possesses at least two roles. An entry possesses the nested XOR role by possessing only one of the roles within the nested XOR role.

Claims

1. A computer-implemented method for managing a directory server, the method comprising:

creating an object class to which a nested XOR role comprising at least two constituent roles belongs, the object class defining the nested XOR role as a result of a logical XOR operation on all of the constituent roles within the nested XOR role, the nested XOR role declaring itself as a member of the object class by including an identifier of the object class without indicating the logical XOR operation;

defining a plurality of entries in the directory server, at least one of the plurality of entries possessing the nested XOR role by possessing only one of the constituent roles within the nested XOR role;

querying each of the entries to determine whether the entry possesses the nested XOR role by performing the logical XOR operation on a plurality of results, each result indicating whether the entry possesses a corresponding one of the constituent roles of the nested XOR role; and

in response to querying, providing entries that possess the nested XOR role to a client.

2. The method of claim 1 wherein each role of the nested XOR role comprises a plurality of group member attributes, and entries associated with the plurality of the group member attributes in the corresponding role entry.

3. The method of claim 1 further comprising:

receiving from the client, a request for determining if an entry of the directory server possesses the nested XOR role, the request comprising a nsRoleDN attribute for each role.

4. The method of claim 1 wherein the directory server comprises a Lightweight Directory Access Protocol (LDAP) repository.

15. The method of claim 1 wherein one or more constituent role of the nested XOR role comprises another nested role, another nested XOR role, a nested AND role, or a nested EXCEPTION role.

5. A directory server comprising:

a processing device;

a storage device coupled to the processing device, the storage device comprising a directory repository defining a plurality of entries in the directory server, at least one of the plurality of entries possessing a nested XOR role by possessing only one of a plurality of constituent roles within the nested XOR role, the directory repository further defining an object class to which the nested XOR role belongs, the object class to define the nested XOR role as a result of a logical XOR operation on all of the constituent roles within the nested XOR role, wherein the nested XOR role declares itself as a member of the object class by including an identifier of the object class without indicating the logical XOR operation;

a nested role management module coupled to the processing device, the nested role management module to query each of the entries to determine whether the entry possesses the nested XOR role, the nested role management module to perform the logical XOR operation on a plurality of results, with each result to indicate whether the entry possess a corresponding one of the constituent rolels of the nested XOR role, and to provide entries that possess the nested XOR role to a client.

6. The directory server of claim 5 wherein the directory server is to define an object class of an entry as a nested XOR role.

7. The directory server of claim 5 wherein each role of the nested XOR role comprises a plurality of group member attributes, and entries associated with the plurality of the group member attributes in the corresponding role entry.

8. The directory server of claim 5 wherein the server is to receive from the client, a request for determining if an entry of the directory server possesses the nested XOR role, the request comprising a nsRoleDN attribute for each role.

9. The directory server of claim 5 wherein the directory server comprises a Lightweight Directory Access Protocol (LDAP) repository.

10. A computer-readable storage medium, having instructions stored therein, which when executed cause a computer system to perform a method comprising:

creating an object class to which a nested XOR role comprising at least two constituent roles belongs, the object class defining the nested XOR role as a result of a logical XOR operation on all of the constituent roles within the nested XOR role, the nested XOR role declaring itself as a member of the object class by including an identifier of the object class without indicating the logical XOR operation;

defining a plurality of entries in the directory server, at least one of the plurality of entries possessing the nested XOR role by possessing only one of the constituent roles within the nested XOR role;

querying each of the entries to determine whether the entry possesses the nested XOR role by performing the logical XOR operation on a plurality of results, each result indicating whether the entry possesses a corresponding one of the constituent roles of the nested XOR role; and

in response to querying, providing entries that possess the nested XOR role to a client.

11. The computer-readable storage medium of claim 10 wherein the method further comprises:

defining an object class of an entry as a nested XOR role.

12. The computer-readable storage medium of claim 10 wherein each role of the nested XOR role comprises a plurality of group member attributes, and entries associated with the plurality of the group member attributes in the corresponding role entry.

13. The computer-readable storage medium of claim 10 wherein the method further comprises:

receiving from the client, a request for determining if an entry of the directory server possesses the nested XOR role, the request comprising a nsRoleDN attribute for each role.

14. The The computer-readable storage medium of claim 10 wherein the directory server comprises a Lightweight Directory Access Protocol (LDAP) repository.