US20050171958A9 - Method and system for implementing policies, resources and privileges for using services in LDAP - Google Patents
Method and system for implementing policies, resources and privileges for using services in LDAP Download PDFInfo
- Publication number
- US20050171958A9 US20050171958A9 US10/118,885 US11888502A US2005171958A9 US 20050171958 A9 US20050171958 A9 US 20050171958A9 US 11888502 A US11888502 A US 11888502A US 2005171958 A9 US2005171958 A9 US 2005171958A9
- Authority
- US
- United States
- Prior art keywords
- service
- organization
- role
- template
- attribute
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/08—Configuration management of networks or network elements
- H04L41/0893—Assignment of logical groups to network elements
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/08—Configuration management of networks or network elements
- H04L41/0894—Policy-based network configuration management
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/50—Network service management, e.g. ensuring proper service fulfilment according to agreements
- H04L41/5061—Network service management, e.g. ensuring proper service fulfilment according to agreements characterised by the interaction between service providers and their network customers, e.g. customer relationship management
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y10—TECHNICAL SUBJECTS COVERED BY FORMER USPC
- Y10S—TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y10S707/00—Data processing: database and file management or data structures
- Y10S707/99931—Database or file accessing
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y10—TECHNICAL SUBJECTS COVERED BY FORMER USPC
- Y10S—TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y10S707/00—Data processing: database and file management or data structures
- Y10S707/99931—Database or file accessing
- Y10S707/99939—Privileged access
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y10—TECHNICAL SUBJECTS COVERED BY FORMER USPC
- Y10S—TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y10S707/00—Data processing: database and file management or data structures
- Y10S707/99941—Database schema or data structure
- Y10S707/99943—Generating database or data structure, e.g. via user interface
Definitions
- the field of the invention relates to the field of data processing. More specifically, embodiments of the present invention relate to assigning service templates to particular roles and organizations in LDAP.
- Computer systems have evolved into extremely sophisticated devices that may be found in many different settings.
- Computer systems typically include a combination of hardware (e.g., semiconductors, circuit boards, etc.) and software (e.g., computer programs).
- hardware e.g., semiconductors, circuit boards, etc.
- software e.g., computer programs
- the information in the directory itself is stored as a information tree and is usually refered as Directory Information Tree (DIT).
- DIT Directory Information Tree
- FIG. 1 a simplified block diagram illustrating the complications involved in tree walking.
- the tree walking process begins when an application 204 makes a directory call to retrieve attributes for a particular user.
- the directory server 210 specifies the node from where the search should start from in the directory in order to obtain the application/service specific user's attributes.
- the application makes more and more directory calls.
- the application finally retrieves the specific attributes for a particular user.
- the tree walking process becomes more involved and becomes a hindrance on the performance of the directory server and the application.
- What is needed is an efficient method for retrieving user attributes for particular applications on a network without flooding the network with numerous directory calls.
- a method for retrieving user attributes without intensive directory searches and tree walking would reduce congestion on a network by reducing the number of directory calls needed to gather user specific attributes.
- the present invention implements policies for resources and privileges for using services by incorporating the use of iPlanet Directory Server's (iDS) Class of Service (CoS) feature developed by Sun Microsystems, Inc. Mountain view, Calif.
- iDS iPlanet Directory Server's
- CoS Class of Service
- the Class of Service (CoS) feature simplifies managing entries in a directory and reduces storage requirements by sharing attributes between entries in a way that is transparent to applications.
- the CoS feature allows every organization entry in a directory to have multiple registered services. Once a service is registered, a CoS definition (service definition) can be created for that service under the organization entry. Once a service gets activated, an associated CoS template (service template) can be created for that service using its service definition.
- the template entries contain a list of shared attribute values and changes to these values get automatically applied to all the entries sharing the attribute. By creating these service definitions and templates under an organization entry, all the service privileges can be made available to all entries under the organization. Similarly, policies for resources can be defined for an organization and policy specific attributes can be made applicable to all the entries in the organization.
- CoS templates that are based on roles can be used to create service templates and policy templates for different groups of users in the directory.
- Roles that are based CoS templates provide means to generate shared attribute values based on the role possessed by an entry.
- An embodiment of the present invention is directed to the application of the CoS feature in an LDAP directory server.
- the CoS feature allows user entries in a directory to be associated to service templates for multiple registered services in the LDAP directory.
- a CoS definition (service definition) can be created for that service under the organization entry.
- an associated CoS template (service template) can be created for that service using its service definition.
- the template entries contain a list of shared attribute values and changes to these values get automatically applied to all the entries sharing the attribute.
- policies for resources can be defined for an organization and policy specific attributes can be made applicable to all the entries in the organization.
- an embodiment of the present invention is directed to a system for providing service attribute information
- a directory server comprising a hierarchical data store associating users with service attributes through data inheritance, the hierarchical data store comprising an organization level and a role level and further comprising attribute templates defined with respect to services and levels an application for generating a query to the directory server for a service attribute of a particular user for the application; and wherein the directory server, in response to the query, is for using inheritance rules from the hierarchical data store to determine and report a service attribute for the particular user for the application.
- FIG. 1 is a prior art system illustrating the numerous directory calls each of them involving a searching the nodes of the directory.
- FIG. 2 is a block diagram illustrating the reduction of directory calls used to retrieve user attributes with the CoS feature.
- FIG. 3 is a logical block diagram of circuitry located within the exemplary directory server computer system of FIG. 2 .
- FIG. 4 is an illustration of the using the templates to share information per role and organization in a directory server.
- FIG. 5 is an example of service templates for four classes of service and four different services.
- FIG. 6 is a logical block diagram of how the CoS logic determines the application specific user attributes form the CoS templates using CoS definitions.
- FIG. 7 is an example of a service template for assigning two different service levels to two different organizations.
- FIG. 8 is a logical block diagram of the classification of users under organization one.
- FIG. 9 is an example of service templates for two different roles in organization one.
- FIG. 10 is an example of service templates for two different roles in organization two.
- FIG. 11 is an example of a CoS Template priority used to determine the service template that becomes applicable to user under a particular role and for a given organization.
- FIG. 12 is an example of the process the CoS logic uses to determine the service attributes for user 1 .
- FIG. 13 is a flow diagram of the process used to register a service in a directory server incorporating embodiments of the present invention.
- FIG. 14 is a flow diagram of the process used to assign users to roles in a directory server incorporating embodiments of the present invention.
- Class of service is a feature of a Directory Server that enables management of a group of service related attributes. These related attributes form a category or Class of Service. Once attributes have been defined, and new classes have been created in the directory, a Class of Service can be assigned to individual user entries. The benefit of assigning a class of service to a user entry is the elimination of having to store multiple service related attributes in each user entry in the directory. In addition, changes made to a class of service can be accomplished simply by changing the entry in the class of service template rather than changing the attribute in each user entry in the directory.
- FIG. 2 is a block diagram illustrating the reduction of directory calls needed to acquire user attributes for an application.
- the application 204 only needs to make one directory call to retrieve service attributes for a particular user.
- the reason for the reduction in the number of directory calls is because the CoS logic 206 in the directory server 201 does the job of determining the service attributes applicable to the user, the instead of the application performing the work. As a result, the number of directory calls made by the application are reduced to one call.
- utilizing the CoS logic 206 of the Directory Server would not only reduce the amount of data storage necessary to associate multiple service attributes to users, but also reduces traffic on the network.
- Directory server clients read attributes stored in user entries.
- a user entry typically contains attributes that describe the user's basic information such as name, department, phone number, etc.
- An entry can also contain a number of related service attributes.
- a user entry might include a number of attributes that describe the hosting services provided to the individual.
- the home page is the first page the user sees when they log into the company's internet service.
- the customer can configure the page to display information such as local news, stock quotes, and links to other sites that may be of special interest.
- the customer can also choose from four service plans related to level of service desired. When a customer signs up for a particular service plan, an administrator assigns the appropriate class of service to the user's role that is associated to the user's account.
- Computer system 201 includes an address/data bus 12 for communicating information, a central processor 1 coupled with bus 12 for processing information and instructions, a volatile memory unit 2 (e.g., random access memory, static RAM, dynamic RAM, etc.) coupled with bus 12 for storing information and instructions for central processor 1 and a non-volatile memory unit 3 (e.g., read only memory, programmable ROM, flash memory, EPROM, EEPROM, etc.) coupled with bus 12 for storing static information and instructions for processor 1 .
- computer system 201 also contains a display device 5 coupled to bus 12 for displaying information to the computer user.
- computer system 201 also includes a data storage device 4 (e.g., memory stick) for storing information and instructions.
- a data storage device 4 e.g., memory stick
- Computer system 201 of FIG. 3 Also included in computer system 201 of FIG. 3 is an optional alphanumeric input device 6 which, in one implementation, is a handwriting recognition pad (“digitizer”). Device 6 can communicate information and command selections to central processor 1 .
- Computer system 201 also includes an optional cursor control or directing device 7 coupled to bus 12 for communicating user input information and command selections to central processor 1 .
- Computer system 201 also includes signal communication interface 8 , which is also coupled to bus 12 , and can be a serial port. Communication interface 8 can also include number of wireless communication mechanisms such as infrared or a Bluetooth protocol.
- computer system 201 described herein illustrates an exemplary configuration of an operational platform upon which embodiments of the present invention can be implemented. Nevertheless, other computer systems with differing configurations can also be used in place of computer system 201 within the scope of the present invention.
- FIG. 4 is an illustration of how service templates can be associated with roles and organizations in a directory server DIT.
- CoS logic uses service templates assigned to particular users, based on their roles to report the service attributes for a particular user.
- the root fo the DIT 21 has two branches, organization 22 and service 23 .
- organization 22 Associated to organization 22 is a first role one 24 and a second role two 25 .
- a service template one for service one 28 is associated to the organization 22 .
- template one for service two 26 and template two for service two 27 which are associated with roles 24 & 25 .
- service 23 On the other side of the root of the DIT 21 , associated to the service 23 is service one 29 and service two 30 .
- meta data 31 and meta data 32 is used to determine all the user attributes that are required to be defined for the particular service/application.
- a user can be assigned to a particular role or a particular organization therefore inheriting the user attributes associated to the role or the organization. For example, if a user were assigned to role one 24 , and was using service one 29 , the user would inherit the user attributes assigned by template one for service one 28 .
- FIG. 5 is an example of a service template 100 .
- the service template 100 can include attributes such as the cost of the service 101 , amount of storage space 102 , access to web mail 103 , and access to calendaring 104 .
- attributes such as the cost of the service 101 , amount of storage space 102 , access to web mail 103 , and access to calendaring 104 .
- users assigned to a particular class of service 99 will automatically inherit the specific attributes for each of these classes. Once the class of service 99 has been created, storing four different attributes per user is no longer necessary.
- a CoS attribute 99 can be stored that contains one of the following values: Premium 105 , Deluxe 106 , Promotional 107 , or Basic 108 .
- a user with the CoS 99 attribute Premium 105 has a cost 101 of $30 per month, a storage limit 102 of 30 MB, access to web mail 103 and access to the calendar service 104 .
- a template to the class of service can be associated to a user using a default organization CoS template or a role CoS template. Each template will hold values for each of the 4 attributes associated with a particular class of service.
- the class of service 99 can be changed from Premium 105 to Deluxe 106 by associating the user to role which holds that privilege.
- the CoS logic in the directory server generates the user attributes and are sent to the application and the values returned for these attributes are determined by the user's distinguished name (DN), and the templates that get associated with the user depending on his roles.
- DN distinguished name
- a Class of Service (CoS) allows attributes to be shared between entries in a way that is invisible to applications. With the CoS feature, some attribute values may not be stored within the user entry itself. Instead, user attributes can be generated by the Class of Service logic as the entry is sent to the client application.
- FIG. 6 is a logical block diagram 200 of a directory server 201 using the CoS logic 206 to return user attributes to an application 204 .
- the application When a user 220 accesses an application 204 , the application must retrieve the required attribute values to provide the correct service level for the user. Traditionally, the application would need to make numerous directory calls to retrieve all the requried attribute values for the user and associate him with the right attribute values based on his service level.
- the CoS feature allows an application to retrieve all of the user's applicable service attributes with one directory call.
- the CoS logic 206 determines the attributes to be sent to the application.
- the directory server 201 uses the CoS logic 206 , CoS definitions 205 , CoS service templates 203 , and a user database 207 .
- the application 204 makes a directory call to the directory server 201 , the user's identity is sent. The identity might be a login name, or another attribute used to distinguish the user from other users on the network.
- the CoS logic 206 picks up the attribute values from the right CoS template.
- the directory server 201 retrieves the user identity, the identity is used to determine the service attributes for that user.
- FIG. 7 is an example of a service template 300 for assigning two different classes of service to two different organizations.
- the four different classes of service are premium 105 , deluxe 106 , promotional 107 , and basic 108 .
- the two different organizations are organization one 250 and organization 2 270 .
- organization one has a service level of premium 105
- organization two has a service level of deluxe 106 .
- the attributes assigned to the service level are inherited by all of the users beloging to the organization. Referring back to FIG.
- the premium class of service 106 has a cost attribute 101 of $30/mo, a storage attribute 102 of 30 Mb, the use of web-mail 103 , and the use of the calendar service 104 . If a user is assigned to organization one, the user will inherit the attributes of the premium service level. Likewise, the users assigned to organization two will inherit the service attributes of the deluxe package.
- FIG. 8 is a logical block diagram 207 a of the classification of users under organization one.
- users are associated with an organization and a people container in addition, a user is associated with a particular role.
- user one 253 is associated to organization one 250 and role one 24 .
- user three 257 is associated with organization one 250 and role two 25 .
- the service attributes for role one 24 can be different than the service attributes for role two 25 .
- the user associated with role one 24 is users one 253 .
- the users associated with role one 24 and organization one 250 will have the same user attributes assigned to them.
- the Cos template 99 is associated defines the service attributes values for all other default users who are not assigned to any other roles, for example user 2 254 and user 4 258 .
- FIG. 9 is an example of a service template 400 for two different roles in organization one 250 .
- service attributes for a user can be assigned according to the organization the user is assigned to.
- a user is associated with a role in addition to an organization. For example, role one 24 is assigned a service level of deluxe 106 and role two 25 is assigned a service level of premium.
- An administrator can change the service level for all of the users associated to role one 24 and organization one 250 without changing the entries for all of the users associated with role one and organization one. This can be easily accomplished by changing the service template 400 .
- the service attributes are changed in the service template, all of the users will inherit the changed attributes. For example, if the service level for role two 25 was changed from premium 105 to deluxe 106 , all of the users classified under organization one and associated to role two would have the service level of deluxe 106 .
- FIG. 10 is an example of a service template 500 for two different roles associated with organization two 270 .
- the service template 500 assigns user attributes to the different roles associated with organization two 270 .
- the users that have a role of one 251 and an organization of two 270 share the user attributes of the deluxe 106 class of service 99 .
- the users with a role of three 271 and an organization of two 270 share the user attributes of the basic 108 class of service 99 .
- a user will usually be associated with a particular organization and a particular role. It is possible for the service attributes of a role to be different than the service attributes of an organization. For example, the users associated to role three 271 have a service level of basic 108 but the user is also under organization two 270 that has a service level of deluxe 106 . It is therefore necessary to have service priority that defines the priority given to the different categories a user can be associated with.
- FIG. 11 is an example of where CoS logic uses template priority 600 used to determine the template that needs to be used to pick up the service attributes.
- the role service template attributes take precedence over the organization service template attributes.
- the attribute priority 403 can be assigned to each and every service template that is created.
- the users associated to role three 271 have a service level of basic 108 but the user is also associated to organization two 270 that has a service level of deluxe 106 . Since the service attributes of the role take priority over the attributes of the organization, the users would inherit the service attributes of the basic service level.
- FIG. 12 is a computer implemented flow diagram of an example of the process 800 the CoS logic uses to determine the default attribute for user one 253 from FIG. 8 .
- the purpose of the CoS logic is to determine the service level for the user and return the service attributes associated with the service level 601 .
- the first step is to determine the role associated to user one 253 .
- the next step is to determine the organization of user one 253 .
- the CoS logic calls up the user database 207 from FIG. 6 and finds that user one is associated to role one 24 of organization one 250 .
- the service level for the users in role one 251 of organization one 250 is basic 108 ( FIG. 7 ) and the service level for the users of organization one 250 is premium 105 ( FIG. 7 ).
- the CoS logic Since the service levels are different for the two groups, the CoS logic must use a priority associated with the service template 600 to determine the service level of user one.
- the CoS template priorities 403 ( FIG. 11 ) tells the CoS logic that the role attributes are a higher priority than the organization attributes.
- the CoS logic uses the priority restraints to conclude that user four inherits the service attributes of the basic service level.
- the directory server 201 ( FIG. 6 ) then returns the service attributes associated with the basic service level. The attributes are retrieved from the service template 100 ( FIG. 5 ) that is stored as CoS templates in directory 201 ( FIG. 6 ).
- FIG. 13 is a flow chart illustrating the computer controlled process of configuring a service to use the CoS feature for an organization.
- the first step is to register the service 901 .
- the service is called service A.
- the next step is to create a service A CoS definition 902 that includes the different components that define the service.
- the CoS definitions are cost I 101 , storage 102 , web-mail 103 , and calendar 104 .
- the next step is to create a service template 903 .
- the service template defines the class of service provided to particular users associated with particular roles or organizations. Different service templates can be created for different levels of service and each of these templates can be assoicated an organization or role. In FIG. 5 , there are four different levels of service and the CoS template defines the attributes values for each class of service.
- the CoS template also defines the CoS priority as described in FIG. 11 .
- table 300 represents a CoS service template for two different organizations. In this service template, organization one 250 has a service class of premium 105 and organization two 270 has a service class of deluxe 106 . By creating multiple service templates, it is possible to provide a customized level of service even though the attributes of the users are defined by the templates.
- the cos template priority can be used when conflicting service levels are encountered.
- the last step is to configure the service for an organization.
- By configuring the service at an organizational level it is possible to provide different levels of service to users that belong to the same organization.
- FIG. 8 which illustrates how a service is configured for organization one 250 .
- the organization is associated to roles one 24 and two 25 . Since the organization was configured, the service level for all users in organization one would be premium 105 ( FIG. 7 ) unless they are over riden with higher priority role service template.
- the service template for the organization in combination with the cost priority the users associated to role one 24 in organization one 250 to the deluxe service level.
- a customized level of service is established by creating multiple service templates.
- FIG. 14 is a flow diagram 1000 of the process of assigning user policies to roles.
- the first step would be to create a customized role. Then the user can be assigned to a role.
- a role can be associated with policies by assigning a role with policies.
- Step 1003 is to assign the policy to the role.
- the policy templates can include the cos priority as described above in FIG. 11 .
- service template 400 defines service levels for role one 24 and role two 25 .
- Embodiments of the present invention a method and system for implementing policies, resources, and privileges for using services in LDAP, have been described. While the present invention has been described in particular embodiments, it should be appreciated that the present invention should not be construed as limited by such embodiments, but rather construed according to the following Claims.
Abstract
Description
- The field of the invention relates to the field of data processing. More specifically, embodiments of the present invention relate to assigning service templates to particular roles and organizations in LDAP.
- Computer systems have evolved into extremely sophisticated devices that may be found in many different settings. Computer systems typically include a combination of hardware (e.g., semiconductors, circuit boards, etc.) and software (e.g., computer programs). As advances in semiconductor processing and computer architecture push the performance of computer hardware higher, more sophisticated computer software has evolved to take advantage of the higher performance of the hardware, resulting in computer systems today that are much more powerful than just a few years ago.
- Other changes in technology have also profoundly affected how people use computers. For example, the widespread proliferation of computers prompted the development of computer networks that allow computers to communicate with each other. With the introduction of the personal computer (PC), computing became accessible to large numbers of people. Networks for personal computers were developed to allow individual users/applications to communicate with each other and also to obtain information/data from data repositories. In recent times, Light Weight Directory Access Protocol (LDAP) has become very popular because of its efficient and fast data access. Large number of applications/services are currently being developed which use Directory as their centralized data repository. A single Directory could potentially serve as a Centralized Data repository for numerous applications. Each application/service inturn would store its user specific information in the Directory.
- The information in the directory itself is stored as a information tree and is usually refered as Directory Information Tree (DIT). Some of the use specific information store by applications/services could be dependent on the organization or domain of the user. Hence, to avoid redundancy applications store them at the organization or domain nodes in the Directory. As a result of sharing a organization/domain specific information with numerous users, several directory calls must be made to retrieve service attributes of a user specific to the application. This process would typically involve searching the DIT to obtain the requested information and could have considerable overhead on the network.
- Referring to Prior Art
FIG. 1 , a simplified block diagram illustrating the complications involved in tree walking. As described above, the tree walking process begins when anapplication 204 makes a directory call to retrieve attributes for a particular user. Initially, the directory server 210 specifies the node from where the search should start from in the directory in order to obtain the application/service specific user's attributes. As the application makes more and more directory calls. As the process continues, the application finally retrieves the specific attributes for a particular user. As the tree structures become more complex to accommodate more users and a larger variety of applications, the tree walking process becomes more involved and becomes a hindrance on the performance of the directory server and the application. - What is needed is an efficient method for retrieving user attributes for particular applications on a network without flooding the network with numerous directory calls. A method for retrieving user attributes without intensive directory searches and tree walking would reduce congestion on a network by reducing the number of directory calls needed to gather user specific attributes.
- Accordingly, the present invention implements policies for resources and privileges for using services by incorporating the use of iPlanet Directory Server's (iDS) Class of Service (CoS) feature developed by Sun Microsystems, Inc. Mountain view, Calif. The Class of Service (CoS) feature simplifies managing entries in a directory and reduces storage requirements by sharing attributes between entries in a way that is transparent to applications.
- The CoS feature allows every organization entry in a directory to have multiple registered services. Once a service is registered, a CoS definition (service definition) can be created for that service under the organization entry. Once a service gets activated, an associated CoS template (service template) can be created for that service using its service definition. The template entries contain a list of shared attribute values and changes to these values get automatically applied to all the entries sharing the attribute. By creating these service definitions and templates under an organization entry, all the service privileges can be made available to all entries under the organization. Similarly, policies for resources can be defined for an organization and policy specific attributes can be made applicable to all the entries in the organization.
- By using roles in combination with the Class of Service feature, different types of users can be provided with different privileges and different policy attributes. CoS templates that are based on roles can be used to create service templates and policy templates for different groups of users in the directory. Roles that are based CoS templates provide means to generate shared attribute values based on the role possessed by an entry. By adding users to roles, service privileges and policies can be applied to the added users.
- All the service privileges and policy attributes for an entry get inherited from the parent organization. To address the particular needs of an individual sub-organization, additional service/policy templates can be created under them. Creating service/policy templates under multiple levels can provide flexibility in setting service privileges and policies. Conflicts arising as a result of more than one privilege/policy becoming applicable to a single user can be resolved by defining priorities for each template.
- An embodiment of the present invention is directed to the application of the CoS feature in an LDAP directory server. The CoS feature allows user entries in a directory to be associated to service templates for multiple registered services in the LDAP directory. In one embodiment, once a service is registered, a CoS definition (service definition) can be created for that service under the organization entry. In another embodiment, once a service gets activated, an associated CoS template (service template) can be created for that service using its service definition. The template entries contain a list of shared attribute values and changes to these values get automatically applied to all the entries sharing the attribute. By creating these service definitions and templates under an organization entry, all the service privileges can be made available to all entries under the organization. Similarly, policies for resources can be defined for an organization and policy specific attributes can be made applicable to all the entries in the organization. By applying CoS to roles and organizations to implement privileges for services and policies for resources, a solution with simplifies managing entries in the directories is provided. As a result, there are reduced storage requirements as well as greater flexibility and scalability of a directory server.
- More specifically, an embodiment of the present invention is directed to a system for providing service attribute information comprising a directory server comprising a hierarchical data store associating users with service attributes through data inheritance, the hierarchical data store comprising an organization level and a role level and further comprising attribute templates defined with respect to services and levels an application for generating a query to the directory server for a service attribute of a particular user for the application; and wherein the directory server, in response to the query, is for using inheritance rules from the hierarchical data store to determine and report a service attribute for the particular user for the application.
- The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments of the invention and, together with the description, serve to explain the principles of the invention.
-
FIG. 1 is a prior art system illustrating the numerous directory calls each of them involving a searching the nodes of the directory. -
FIG. 2 is a block diagram illustrating the reduction of directory calls used to retrieve user attributes with the CoS feature. -
FIG. 3 is a logical block diagram of circuitry located within the exemplary directory server computer system ofFIG. 2 . -
FIG. 4 is an illustration of the using the templates to share information per role and organization in a directory server. -
FIG. 5 is an example of service templates for four classes of service and four different services. -
FIG. 6 is a logical block diagram of how the CoS logic determines the application specific user attributes form the CoS templates using CoS definitions. -
FIG. 7 is an example of a service template for assigning two different service levels to two different organizations. -
FIG. 8 is a logical block diagram of the classification of users under organization one. -
FIG. 9 is an example of service templates for two different roles in organization one. -
FIG. 10 is an example of service templates for two different roles in organization two. -
FIG. 11 is an example of a CoS Template priority used to determine the service template that becomes applicable to user under a particular role and for a given organization. -
FIG. 12 is an example of the process the CoS logic uses to determine the service attributes foruser 1. -
FIG. 13 is a flow diagram of the process used to register a service in a directory server incorporating embodiments of the present invention. -
FIG. 14 is a flow diagram of the process used to assign users to roles in a directory server incorporating embodiments of the present invention. - In the following detailed description of the present invention, a method and system for implementing policies, resources, and privileges for using services in LDAP, specific details are set forth in order to provide a thorough understanding of the present invention. However, it will be recognized by one skilled in the art that the present invention may be practiced without these specific details or with equivalents thereof. In other instances, well-known methods, procedures, components, and circuits have not been described in detail as not to unnecessarily obscure aspects of the present invention.
- Some portions of the detailed descriptions (e.g., process 700) that follow are presented in terms of procedures, steps, logic blocks, processing, and other symbolic representations of operations on data bits within a computer memory. These descriptions and representations are the means used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. A procedure, computer executed step, logic block, process, etc., is here, and generally, conceived to be a self-consistent sequence of steps or instructions leading to a desired result. The steps are those that require physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared, and otherwise manipulated in a computer system. It has proven convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like.
- It should be borne in mind, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. Unless specifically stated otherwise as apparent from the following discussions, it is appreciated that throughout the present invention, discussions utilizing terms such as “receiving”, “posting”, “opening”, “sending”, “monitoring”, “examining” or the like, refer to the action and processes of a computer system (e.g., (Prior Art)
FIGS. 1A, 1B ,FIG. 6 ), or similar electronic computing device, that manipulates and transforms data represented as physical (electronic) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage, transmission or display devices. - Class of service (CoS) is a feature of a Directory Server that enables management of a group of service related attributes. These related attributes form a category or Class of Service. Once attributes have been defined, and new classes have been created in the directory, a Class of Service can be assigned to individual user entries. The benefit of assigning a class of service to a user entry is the elimination of having to store multiple service related attributes in each user entry in the directory. In addition, changes made to a class of service can be accomplished simply by changing the entry in the class of service template rather than changing the attribute in each user entry in the directory.
-
FIG. 2 is a block diagram illustrating the reduction of directory calls needed to acquire user attributes for an application. In this example, theapplication 204 only needs to make one directory call to retrieve service attributes for a particular user. The reason for the reduction in the number of directory calls is because theCoS logic 206 in thedirectory server 201 does the job of determining the service attributes applicable to the user, the instead of the application performing the work. As a result, the number of directory calls made by the application are reduced to one call. Thus, utilizing theCoS logic 206 of the Directory Server would not only reduce the amount of data storage necessary to associate multiple service attributes to users, but also reduces traffic on the network. - Directory server clients read attributes stored in user entries. A user entry typically contains attributes that describe the user's basic information such as name, department, phone number, etc. An entry can also contain a number of related service attributes. For example, a user entry might include a number of attributes that describe the hosting services provided to the individual. Suppose a company provides its customers with the tools to create their own home pages. The home page is the first page the user sees when they log into the company's internet service. The customer can configure the page to display information such as local news, stock quotes, and links to other sites that may be of special interest. The customer can also choose from four service plans related to level of service desired. When a customer signs up for a particular service plan, an administrator assigns the appropriate class of service to the user's role that is associated to the user's account.
- Referring now to
FIG. 3 , a block diagram of exemplary directoryserver computer system 201 is shown.Computer system 201 includes an address/data bus 12 for communicating information, acentral processor 1 coupled withbus 12 for processing information and instructions, a volatile memory unit 2 (e.g., random access memory, static RAM, dynamic RAM, etc.) coupled withbus 12 for storing information and instructions forcentral processor 1 and a non-volatile memory unit 3 (e.g., read only memory, programmable ROM, flash memory, EPROM, EEPROM, etc.) coupled withbus 12 for storing static information and instructions forprocessor 1. As described above,computer system 201 also contains adisplay device 5 coupled tobus 12 for displaying information to the computer user. Moreover,computer system 201 also includes a data storage device 4 (e.g., memory stick) for storing information and instructions. - Also included in
computer system 201 ofFIG. 3 is an optionalalphanumeric input device 6 which, in one implementation, is a handwriting recognition pad (“digitizer”).Device 6 can communicate information and command selections tocentral processor 1.Computer system 201 also includes an optional cursor control or directingdevice 7 coupled tobus 12 for communicating user input information and command selections tocentral processor 1.Computer system 201 also includessignal communication interface 8, which is also coupled tobus 12, and can be a serial port.Communication interface 8 can also include number of wireless communication mechanisms such as infrared or a Bluetooth protocol. - It is appreciated that
computer system 201 described herein illustrates an exemplary configuration of an operational platform upon which embodiments of the present invention can be implemented. Nevertheless, other computer systems with differing configurations can also be used in place ofcomputer system 201 within the scope of the present invention. -
FIG. 4 is an illustration of how service templates can be associated with roles and organizations in a directory server DIT. As described above, CoS logic uses service templates assigned to particular users, based on their roles to report the service attributes for a particular user. In this example, we observe that the root fo theDIT 21 has two branches,organization 22 andservice 23. Associated toorganization 22 is a first role one 24 and a second role two 25. In addition, a service template one for service one 28 is associated to theorganization 22. Also included is template one for service two 26 and template two for service two 27 which are associated withroles 24 & 25. On the other side of the root of theDIT 21, associated to theservice 23 is service one 29 and service two 30. Also included ismeta data 31 andmeta data 32. The meta data is used to determine all the user attributes that are required to be defined for the particular service/application. - A user can be assigned to a particular role or a particular organization therefore inheriting the user attributes associated to the role or the organization. For example, if a user were assigned to role one 24, and was using service one 29, the user would inherit the user attributes assigned by template one for service one 28.
-
FIG. 5 is an example of aservice template 100. Theservice template 100 can include attributes such as the cost of theservice 101, amount ofstorage space 102, access toweb mail 103, and access tocalendaring 104. With the class of service feature, users assigned to a particular class ofservice 99 will automatically inherit the specific attributes for each of these classes. Once the class ofservice 99 has been created, storing four different attributes per user is no longer necessary. With the use of the class of service feature, aCoS attribute 99 can be stored that contains one of the following values:Premium 105,Deluxe 106,Promotional 107, orBasic 108. For example, a user with theCoS 99attribute Premium 105 has acost 101 of $30 per month, astorage limit 102 of 30 MB, access toweb mail 103 and access to thecalendar service 104. Instead of storing four different attributes for each user entry, a template to the class of service can be associated to a user using a default organization CoS template or a role CoS template. Each template will hold values for each of the 4 attributes associated with a particular class of service. In addition, if the user decides that 20 MB of web space is sufficient, the class ofservice 99 can be changed fromPremium 105 toDeluxe 106 by associating the user to role which holds that privilege. - The CoS logic in the directory server generates the user attributes and are sent to the application and the values returned for these attributes are determined by the user's distinguished name (DN), and the templates that get associated with the user depending on his roles. A Class of Service (CoS) allows attributes to be shared between entries in a way that is invisible to applications. With the CoS feature, some attribute values may not be stored within the user entry itself. Instead, user attributes can be generated by the Class of Service logic as the entry is sent to the client application.
-
FIG. 6 is a logical block diagram 200 of adirectory server 201 using theCoS logic 206 to return user attributes to anapplication 204. When a user 220 accesses anapplication 204, the application must retrieve the required attribute values to provide the correct service level for the user. Traditionally, the application would need to make numerous directory calls to retrieve all the requried attribute values for the user and associate him with the right attribute values based on his service level. In contrast, inFIG. 6 , the CoS feature allows an application to retrieve all of the user's applicable service attributes with one directory call. - After the
application 204 makes a directory call for the user's service attributes, theCoS logic 206 determines the attributes to be sent to the application. Thedirectory server 201 uses theCoS logic 206,CoS definitions 205,CoS service templates 203, and auser database 207. When theapplication 204 makes a directory call to thedirectory server 201, the user's identity is sent. The identity might be a login name, or another attribute used to distinguish the user from other users on the network. When theapplication 204 makes the initial directory call to receive the user attributes for a particular application, based on role and organization, theCoS logic 206 picks up the attribute values from the right CoS template. When thedirectory server 201 retrieves the user identity, the identity is used to determine the service attributes for that user. -
FIG. 7 is an example of aservice template 300 for assigning two different classes of service to two different organizations. In this particular case, the four different classes of service are premium 105, deluxe 106, promotional 107, and basic 108. The two different organizations are organization one 250 andorganization 2 270. In this case, organization one has a service level ofpremium 105 and organization two has a service level of deluxe 106. By assigning an organization a particular service level, the attributes assigned to the service level are inherited by all of the users beloging to the organization. Referring back toFIG. 5 , the premium class ofservice 106 has acost attribute 101 of $30/mo, astorage attribute 102 of 30 Mb, the use of web-mail 103, and the use of thecalendar service 104. If a user is assigned to organization one, the user will inherit the attributes of the premium service level. Likewise, the users assigned to organization two will inherit the service attributes of the deluxe package. -
FIG. 8 is a logical block diagram 207 a of the classification of users under organization one. In this figure, users are associated with an organization and a people container in addition, a user is associated with a particular role. For example, user one 253 is associated to organization one 250 and role one 24. On the other hand, user three 257 is associated with organization one 250 and role two 25. Even though the two users are associated with the same organization, their service attributes can be different. The service attributes for role one 24 can be different than the service attributes for role two 25. The user associated with role one 24 is users one 253. The users associated with role one 24 and organization one 250 will have the same user attributes assigned to them. When an application makes a call to the directory server for the user attributes of any of the users belonging to role one 24, the same user attributes will be returned. Likewise, the different users under role two 252 and organization one 250 all share the same user attributes. TheCos template 99 is associated defines the service attributes values for all other default users who are not assigned to any other roles, forexample user 2 254 anduser 4 258. -
FIG. 9 is an example of aservice template 400 for two different roles in organization one 250. As described above, service attributes for a user can be assigned according to the organization the user is assigned to. In addition to different service attributes for various organizations, there can be different service levels assigned to users within a particular organization. To accomplish this, a user is associated with a role in addition to an organization. For example, role one 24 is assigned a service level of deluxe 106 and role two 25 is assigned a service level of premium. - An administrator can change the service level for all of the users associated to role one 24 and organization one 250 without changing the entries for all of the users associated with role one and organization one. This can be easily accomplished by changing the
service template 400. When the service attributes are changed in the service template, all of the users will inherit the changed attributes. For example, if the service level for role two 25 was changed frompremium 105 to deluxe 106, all of the users classified under organization one and associated to role two would have the service level of deluxe 106. -
FIG. 10 is an example of aservice template 500 for two different roles associated with organization two 270. Theservice template 500 assigns user attributes to the different roles associated with organization two 270. For example, the users that have a role of one 251 and an organization of two 270 share the user attributes of the deluxe 106 class ofservice 99. In addition, the users with a role of three 271 and an organization of two 270 share the user attributes of the basic 108 class ofservice 99. - As a result of classifying users under two different user categories, there are conflicts in the user attributes assigned to a user. A user will usually be associated with a particular organization and a particular role. It is possible for the service attributes of a role to be different than the service attributes of an organization. For example, the users associated to role three 271 have a service level of basic 108 but the user is also under organization two 270 that has a service level of deluxe 106. It is therefore necessary to have service priority that defines the priority given to the different categories a user can be associated with.
-
FIG. 11 is an example of where CoS logic usestemplate priority 600 used to determine the template that needs to be used to pick up the service attributes. In this example, the role service template attributes take precedence over the organization service template attributes. Theattribute priority 403 can be assigned to each and every service template that is created. As stated above, the users associated to role three 271 have a service level of basic 108 but the user is also associated to organization two 270 that has a service level of deluxe 106. Since the service attributes of the role take priority over the attributes of the organization, the users would inherit the service attributes of the basic service level. -
FIG. 12 is a computer implemented flow diagram of an example of theprocess 800 the CoS logic uses to determine the default attribute for user one 253 fromFIG. 8 . As described above, the purpose of the CoS logic is to determine the service level for the user and return the service attributes associated with theservice level 601. The first step is to determine the role associated to user one 253. The next step is to determine the organization of user one 253. The CoS logic calls up theuser database 207 fromFIG. 6 and finds that user one is associated to role one 24 of organization one 250. The service level for the users in role one 251 of organization one 250 is basic 108 (FIG. 7 ) and the service level for the users of organization one 250 is premium 105 (FIG. 7 ). Since the service levels are different for the two groups, the CoS logic must use a priority associated with theservice template 600 to determine the service level of user one. The CoS template priorities 403 (FIG. 11 ) tells the CoS logic that the role attributes are a higher priority than the organization attributes. The CoS logic uses the priority restraints to conclude that user four inherits the service attributes of the basic service level. The directory server 201 (FIG. 6 ) then returns the service attributes associated with the basic service level. The attributes are retrieved from the service template 100 (FIG. 5 ) that is stored as CoS templates in directory 201 (FIG. 6 ). -
FIG. 13 is a flow chart illustrating the computer controlled process of configuring a service to use the CoS feature for an organization. When a new service is to be added to the directory server, the first step is to register theservice 901. In this example, the service is called service A. Then the next step is to create a serviceA CoS definition 902 that includes the different components that define the service. Referring back toFIG. 5 , the CoS definitions are cost I101,storage 102, web-mail 103, andcalendar 104. - The next step is to create a
service template 903. The service template defines the class of service provided to particular users associated with particular roles or organizations. Different service templates can be created for different levels of service and each of these templates can be assoicated an organization or role. InFIG. 5 , there are four different levels of service and the CoS template defines the attributes values for each class of service. The CoS template also defines the CoS priority as described inFIG. 11 . Referring back toFIG. 7 , table 300 represents a CoS service template for two different organizations. In this service template, organization one 250 has a service class ofpremium 105 and organization two 270 has a service class of deluxe 106. By creating multiple service templates, it is possible to provide a customized level of service even though the attributes of the users are defined by the templates. The cos template priority can be used when conflicting service levels are encountered. - The last step is to configure the service for an organization. By configuring the service at an organizational level, it is possible to provide different levels of service to users that belong to the same organization. Referring back to
FIG. 8 which illustrates how a service is configured for organization one 250. In this example, the organization is associated to roles one 24 and two 25. Since the organization was configured, the service level for all users in organization one would be premium 105 (FIG. 7 ) unless they are over riden with higher priority role service template. The service template for the organization in combination with the cost priority the users associated to role one 24 in organization one 250 to the deluxe service level. A customized level of service is established by creating multiple service templates. -
FIG. 14 is a flow diagram 1000 of the process of assigning user policies to roles. The first step would be to create a customized role. Then the user can be assigned to a role. A role can be associated with policies by assigning a role with policies.Step 1003 is to assign the policy to the role. The policy templates can include the cos priority as described above inFIG. 11 . Referring back toFIG. 9 ,service template 400 defines service levels for role one 24 and role two 25. - Embodiments of the present invention, a method and system for implementing policies, resources, and privileges for using services in LDAP, have been described. While the present invention has been described in particular embodiments, it should be appreciated that the present invention should not be construed as limited by such embodiments, but rather construed according to the following Claims.
- The foregoing descriptions of specific embodiments of the present invention have been presented for purposes of illustration and description. They are not intended to be exhaustive or to limit the invention to the precise forms disclosed, and obviously many modifications and variations are possible in light of the above teaching. The embodiments were chosen and described in order to best explain the principles of the invention and its practical application, to thereby enable others skilled in the art to best utilize the invention and various embodiments with various modifications as are suited to the particular use contemplated. It is intended that the scope of the invention be defined by the Claims appended hereto and their equivalents.
Claims (19)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US10/118,885 US7031967B2 (en) | 2001-08-06 | 2002-04-08 | Method and system for implementing policies, resources and privileges for using services in LDAP |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US31052801P | 2001-08-06 | 2001-08-06 | |
US10/118,885 US7031967B2 (en) | 2001-08-06 | 2002-04-08 | Method and system for implementing policies, resources and privileges for using services in LDAP |
Publications (3)
Publication Number | Publication Date |
---|---|
US20030191763A1 US20030191763A1 (en) | 2003-10-09 |
US20050171958A9 true US20050171958A9 (en) | 2005-08-04 |
US7031967B2 US7031967B2 (en) | 2006-04-18 |
Family
ID=34810877
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US10/118,885 Expired - Lifetime US7031967B2 (en) | 2001-08-06 | 2002-04-08 | Method and system for implementing policies, resources and privileges for using services in LDAP |
Country Status (1)
Country | Link |
---|---|
US (1) | US7031967B2 (en) |
Cited By (30)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20020169700A1 (en) * | 2001-05-11 | 2002-11-14 | Huffman Lon Joseph | Digital content subscription conditioning system |
US20030217109A1 (en) * | 2001-05-15 | 2003-11-20 | Ordille Joann J. | Method and apparatus for automatic notification and response |
US20040083367A1 (en) * | 2002-10-25 | 2004-04-29 | Praerit Garg | Role-based authorization management framework |
US20050198111A1 (en) * | 2002-05-21 | 2005-09-08 | Lamb Peter C. | Distributed transaction event matching |
US20050208941A1 (en) * | 2004-03-18 | 2005-09-22 | Ordille Joann J | Method and apparatus for a publish-subscribe system with third party subscription delivery |
US20080133480A1 (en) * | 2006-11-30 | 2008-06-05 | Rowley Peter A | Flexible LDAP templates |
US20080177705A1 (en) * | 2007-01-22 | 2008-07-24 | Red Hat, Inc. | Virtual attribute configuration source virtual attribute |
US20080189304A1 (en) * | 2007-02-06 | 2008-08-07 | Red Hat, Inc. | Linked LDAP attributes |
US20080195616A1 (en) * | 2007-02-13 | 2008-08-14 | Red Hat, Inc. | Multi-master attribute uniqueness |
US20080208810A1 (en) * | 2007-02-27 | 2008-08-28 | Peter Andrew Rowley | Nested XOR roles |
US20090030936A1 (en) * | 2004-03-18 | 2009-01-29 | Avaya Inc. | Method and Apparatus for a Publish-Subscribe System with Access Controls |
US20090055427A1 (en) * | 2007-08-21 | 2009-02-26 | Alcatel Lucent | Cloning policy using templates and override cloned policy |
US7725563B2 (en) * | 2007-02-27 | 2010-05-25 | Red Hat, Inc. | Nested AND roles |
US7725564B2 (en) * | 2007-02-27 | 2010-05-25 | Red Hat, Inc. | Nested exception roles |
US7827595B2 (en) | 2003-08-28 | 2010-11-02 | Microsoft Corporation | Delegated administration of a hosted resource |
US20110023123A1 (en) * | 2009-07-24 | 2011-01-27 | Oracle International Corporation | Licensed feature enablement manager |
US7895123B1 (en) | 2001-06-12 | 2011-02-22 | Accenture Global Services Limited | Digital content publication |
US8375113B2 (en) * | 2002-07-11 | 2013-02-12 | Oracle International Corporation | Employing wrapper profiles |
US10516672B2 (en) | 2016-08-05 | 2019-12-24 | Oracle International Corporation | Service discovery for a multi-tenant identity and data security management cloud service |
US10530578B2 (en) | 2016-08-05 | 2020-01-07 | Oracle International Corporation | Key store service |
US10581820B2 (en) | 2016-05-11 | 2020-03-03 | Oracle International Corporation | Key generation and rollover |
US10579367B2 (en) | 2016-08-05 | 2020-03-03 | Oracle International Corporation | Zero down time upgrade for a multi-tenant identity and data security management cloud service |
US10585682B2 (en) | 2016-08-05 | 2020-03-10 | Oracle International Corporation | Tenant self-service troubleshooting for a multi-tenant identity and data security management cloud service |
US10693861B2 (en) | 2016-05-11 | 2020-06-23 | Oracle International Corporation | Task segregation in a multi-tenant identity and data security management cloud service |
US10721237B2 (en) | 2016-08-05 | 2020-07-21 | Oracle International Corporation | Hierarchical processing for a virtual directory system for LDAP to SCIM proxy service |
US10735394B2 (en) | 2016-08-05 | 2020-08-04 | Oracle International Corporation | Caching framework for a multi-tenant identity and data security management cloud service |
US10791087B2 (en) * | 2016-09-16 | 2020-09-29 | Oracle International Corporation | SCIM to LDAP mapping using subtype attributes |
US10848543B2 (en) | 2016-05-11 | 2020-11-24 | Oracle International Corporation | Security tokens for a multi-tenant identity and data security management cloud service |
US10878079B2 (en) | 2016-05-11 | 2020-12-29 | Oracle International Corporation | Identity cloud service authorization model with dynamic roles and scopes |
US11088993B2 (en) | 2016-05-11 | 2021-08-10 | Oracle International Corporation | Policy enforcement point for a multi-tenant identity and data security management cloud service |
Families Citing this family (19)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7016893B2 (en) * | 2001-05-29 | 2006-03-21 | Sun Microsystems, Inc. | Method and system for sharing entry attributes in a directory server using class of service |
EP1298515A3 (en) * | 2001-09-26 | 2004-02-04 | Siemens Aktiengesellschaft | Method for controlling access to resources of a data processing system |
US20030088678A1 (en) * | 2001-11-06 | 2003-05-08 | Boreham David W. | Virtual attribute service in a directory server |
KR100830940B1 (en) * | 2002-07-10 | 2008-05-20 | 엘지전자 주식회사 | Remote control system for home network using universal plug and play |
US7181445B2 (en) * | 2003-09-05 | 2007-02-20 | Bellsouth Intellectual Property Corporation | Aggregating, retrieving, and providing access to document visuals |
US7284000B2 (en) * | 2003-12-19 | 2007-10-16 | International Business Machines Corporation | Automatic policy generation based on role entitlements and identity attributes |
KR100842294B1 (en) * | 2006-12-11 | 2008-06-30 | 한국전자통신연구원 | Apparatus and method for providing the personalized service using web |
US20090012987A1 (en) * | 2007-07-05 | 2009-01-08 | Kaminsky David L | Method and system for delivering role-appropriate policies |
CN102084620B (en) * | 2007-11-21 | 2015-09-30 | 阿尔卡特朗讯 | The method of implementation strategy and service management system in a network |
JP5494653B2 (en) * | 2009-04-10 | 2014-05-21 | 日本電気株式会社 | Access control policy template generation apparatus, system, method and program |
WO2010127433A1 (en) * | 2009-05-03 | 2010-11-11 | Research In Motion Limited | Systems and methods for mobility server administration |
US8285822B2 (en) * | 2009-10-23 | 2012-10-09 | Novell, Inc. | Policy configuration and simulation |
US9253113B2 (en) | 2012-09-07 | 2016-02-02 | Oracle International Corporation | Customizable model for throttling and prioritizing orders in a cloud environment |
US9838370B2 (en) | 2012-09-07 | 2017-12-05 | Oracle International Corporation | Business attribute driven sizing algorithms |
US9792338B2 (en) | 2012-09-07 | 2017-10-17 | Oracle International Corporation | Role assignments in a cloud infrastructure |
US9542400B2 (en) | 2012-09-07 | 2017-01-10 | Oracle International Corporation | Service archive support |
US10521746B2 (en) | 2012-09-07 | 2019-12-31 | Oracle International Corporation | Recovery workflow for processing subscription orders in a computing infrastructure system |
US9621435B2 (en) | 2012-09-07 | 2017-04-11 | Oracle International Corporation | Declarative and extensible model for provisioning of cloud based services |
US9608958B2 (en) | 2013-03-12 | 2017-03-28 | Oracle International Corporation | Lightweight directory access protocol (LDAP) join search mechanism |
Citations (10)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6366913B1 (en) * | 1998-10-21 | 2002-04-02 | Netscape Communications Corporation | Centralized directory services supporting dynamic group membership |
US20020107859A1 (en) * | 2001-01-12 | 2002-08-08 | Tsuyuki Software Laboratory | Associating information management system, program for associating information management, and recording medium |
US20020129135A1 (en) * | 2000-12-22 | 2002-09-12 | Delany Shawn P. | Determining group membership |
US20020147801A1 (en) * | 2001-01-29 | 2002-10-10 | Gullotta Tony J. | System and method for provisioning resources to users based on policies, roles, organizational information, and attributes |
US6490619B1 (en) * | 1999-12-07 | 2002-12-03 | International Business Machines Corporation | Method and system for managing multiple lightweight directory access protocol directory servers |
US20030037052A1 (en) * | 2001-08-06 | 2003-02-20 | Roger Kitain | Method and system for managing a directory with a template |
US20030131113A1 (en) * | 2002-01-04 | 2003-07-10 | Reeves Drue A. | Method and apparatus for increasing the functionality and ease of use of lights out management in a directory enabled environment |
US6768988B2 (en) * | 2001-05-29 | 2004-07-27 | Sun Microsystems, Inc. | Method and system for incorporating filtered roles in a directory system |
US6785686B2 (en) * | 2001-05-29 | 2004-08-31 | Sun Microsystems, Inc. | Method and system for creating and utilizing managed roles in a directory system |
US6836794B1 (en) * | 1998-09-21 | 2004-12-28 | Microsoft Corporation | Method and system for assigning and publishing applications |
-
2002
- 2002-04-08 US US10/118,885 patent/US7031967B2/en not_active Expired - Lifetime
Patent Citations (10)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6836794B1 (en) * | 1998-09-21 | 2004-12-28 | Microsoft Corporation | Method and system for assigning and publishing applications |
US6366913B1 (en) * | 1998-10-21 | 2002-04-02 | Netscape Communications Corporation | Centralized directory services supporting dynamic group membership |
US6490619B1 (en) * | 1999-12-07 | 2002-12-03 | International Business Machines Corporation | Method and system for managing multiple lightweight directory access protocol directory servers |
US20020129135A1 (en) * | 2000-12-22 | 2002-09-12 | Delany Shawn P. | Determining group membership |
US20020107859A1 (en) * | 2001-01-12 | 2002-08-08 | Tsuyuki Software Laboratory | Associating information management system, program for associating information management, and recording medium |
US20020147801A1 (en) * | 2001-01-29 | 2002-10-10 | Gullotta Tony J. | System and method for provisioning resources to users based on policies, roles, organizational information, and attributes |
US6768988B2 (en) * | 2001-05-29 | 2004-07-27 | Sun Microsystems, Inc. | Method and system for incorporating filtered roles in a directory system |
US6785686B2 (en) * | 2001-05-29 | 2004-08-31 | Sun Microsystems, Inc. | Method and system for creating and utilizing managed roles in a directory system |
US20030037052A1 (en) * | 2001-08-06 | 2003-02-20 | Roger Kitain | Method and system for managing a directory with a template |
US20030131113A1 (en) * | 2002-01-04 | 2003-07-10 | Reeves Drue A. | Method and apparatus for increasing the functionality and ease of use of lights out management in a directory enabled environment |
Cited By (57)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20020169700A1 (en) * | 2001-05-11 | 2002-11-14 | Huffman Lon Joseph | Digital content subscription conditioning system |
US7505936B2 (en) | 2001-05-11 | 2009-03-17 | Accenture Global Services Gmbh | Digital content subscription conditioning system |
US9449299B2 (en) | 2001-05-11 | 2016-09-20 | Accenture Global Services Limited | Digital content subscription conditioning system |
US20030217109A1 (en) * | 2001-05-15 | 2003-11-20 | Ordille Joann J. | Method and apparatus for automatic notification and response |
US8868659B2 (en) | 2001-05-15 | 2014-10-21 | Avaya Inc. | Method and apparatus for automatic notification and response |
US20110047079A1 (en) * | 2001-06-12 | 2011-02-24 | Du L Garren | Digital content publication |
US7895123B1 (en) | 2001-06-12 | 2011-02-22 | Accenture Global Services Limited | Digital content publication |
US8510392B2 (en) | 2002-05-14 | 2013-08-13 | Avaya Inc. | Method and apparatus for automatic notification and response |
US20050198111A1 (en) * | 2002-05-21 | 2005-09-08 | Lamb Peter C. | Distributed transaction event matching |
US7552205B2 (en) * | 2002-05-21 | 2009-06-23 | Accenture Global Services Gmbh | Distributed transaction event matching |
US9124643B2 (en) | 2002-06-26 | 2015-09-01 | Avaya Inc. | Method and apparatus for a publish-subscribe system with templates for role-based view of subscriptions |
US8375113B2 (en) * | 2002-07-11 | 2013-02-12 | Oracle International Corporation | Employing wrapper profiles |
US20090260056A1 (en) * | 2002-10-25 | 2009-10-15 | Microsoft Corporation | Role-Based Authorization Management Framework |
US8533772B2 (en) | 2002-10-25 | 2013-09-10 | Microsoft Corporation | Role-based authorization management framework |
US20040083367A1 (en) * | 2002-10-25 | 2004-04-29 | Praerit Garg | Role-based authorization management framework |
US7546633B2 (en) * | 2002-10-25 | 2009-06-09 | Microsoft Corporation | Role-based authorization management framework |
US7827595B2 (en) | 2003-08-28 | 2010-11-02 | Microsoft Corporation | Delegated administration of a hosted resource |
US20050249337A1 (en) * | 2004-03-18 | 2005-11-10 | Ordille Joann J | Method and apparatus for just in time education |
US20090030936A1 (en) * | 2004-03-18 | 2009-01-29 | Avaya Inc. | Method and Apparatus for a Publish-Subscribe System with Access Controls |
US8516045B2 (en) | 2004-03-18 | 2013-08-20 | Avaya Inc. | Method and apparatus for automatic notification and response based on communication flow expressions having dynamic context |
US8566311B2 (en) | 2004-03-18 | 2013-10-22 | Avaya, Inc. | Method and apparatus for notifying a user of a predefined changes to dynamic attributes |
US7734731B2 (en) | 2004-03-18 | 2010-06-08 | Avaya Inc. | Method and apparatus for a publish-subscribe system with third party subscription delivery |
US8495163B2 (en) * | 2004-03-18 | 2013-07-23 | Avaya, Inc. | Method and apparatus for a publish-subscribe system with templates for role-based view of subscriptions |
US20050223070A1 (en) * | 2004-03-18 | 2005-10-06 | Ordille Joann J | Method and apparatus for automatic notification and response based on communication flow expressions having dynamic context |
US20050210062A1 (en) * | 2004-03-18 | 2005-09-22 | Ordille Joann J | Method and apparatus for a publish-subscribe system with templates for role-based view of subscriptions |
US20050208941A1 (en) * | 2004-03-18 | 2005-09-22 | Ordille Joann J | Method and apparatus for a publish-subscribe system with third party subscription delivery |
US20080133480A1 (en) * | 2006-11-30 | 2008-06-05 | Rowley Peter A | Flexible LDAP templates |
US8041689B2 (en) * | 2006-11-30 | 2011-10-18 | Red Hat, Inc. | Flexible LDAP templates |
US8145616B2 (en) * | 2007-01-22 | 2012-03-27 | Red Hat, Inc. | Virtual attribute configuration source virtual attribute |
US20080177705A1 (en) * | 2007-01-22 | 2008-07-24 | Red Hat, Inc. | Virtual attribute configuration source virtual attribute |
US20080189304A1 (en) * | 2007-02-06 | 2008-08-07 | Red Hat, Inc. | Linked LDAP attributes |
US9286375B2 (en) | 2007-02-06 | 2016-03-15 | Red Hat, Inc. | Linked lightweight directory access protocol (LDAP) attributes |
US8600933B2 (en) | 2007-02-13 | 2013-12-03 | Red Hat, Inc. | Multi-master attribute uniqueness |
US20080195616A1 (en) * | 2007-02-13 | 2008-08-14 | Red Hat, Inc. | Multi-master attribute uniqueness |
US8090686B2 (en) | 2007-02-13 | 2012-01-03 | Red Hat, Inc. | Multi-master attribute uniqueness |
US20080208810A1 (en) * | 2007-02-27 | 2008-08-28 | Peter Andrew Rowley | Nested XOR roles |
US7725564B2 (en) * | 2007-02-27 | 2010-05-25 | Red Hat, Inc. | Nested exception roles |
US7774433B2 (en) * | 2007-02-27 | 2010-08-10 | Red Hat, Inc. | Nested XOR roles |
US7725563B2 (en) * | 2007-02-27 | 2010-05-25 | Red Hat, Inc. | Nested AND roles |
US20090055427A1 (en) * | 2007-08-21 | 2009-02-26 | Alcatel Lucent | Cloning policy using templates and override cloned policy |
US8301741B2 (en) * | 2007-08-21 | 2012-10-30 | Alcatel Lucent | Cloning policy using templates and override cloned policy |
US8656508B2 (en) * | 2009-07-24 | 2014-02-18 | Oracle International Corporation | Licensed feature enablement manager |
US20110023123A1 (en) * | 2009-07-24 | 2011-01-27 | Oracle International Corporation | Licensed feature enablement manager |
US10693861B2 (en) | 2016-05-11 | 2020-06-23 | Oracle International Corporation | Task segregation in a multi-tenant identity and data security management cloud service |
US11088993B2 (en) | 2016-05-11 | 2021-08-10 | Oracle International Corporation | Policy enforcement point for a multi-tenant identity and data security management cloud service |
US10581820B2 (en) | 2016-05-11 | 2020-03-03 | Oracle International Corporation | Key generation and rollover |
US10878079B2 (en) | 2016-05-11 | 2020-12-29 | Oracle International Corporation | Identity cloud service authorization model with dynamic roles and scopes |
US10848543B2 (en) | 2016-05-11 | 2020-11-24 | Oracle International Corporation | Security tokens for a multi-tenant identity and data security management cloud service |
US10516672B2 (en) | 2016-08-05 | 2019-12-24 | Oracle International Corporation | Service discovery for a multi-tenant identity and data security management cloud service |
US10721237B2 (en) | 2016-08-05 | 2020-07-21 | Oracle International Corporation | Hierarchical processing for a virtual directory system for LDAP to SCIM proxy service |
US10735394B2 (en) | 2016-08-05 | 2020-08-04 | Oracle International Corporation | Caching framework for a multi-tenant identity and data security management cloud service |
US10585682B2 (en) | 2016-08-05 | 2020-03-10 | Oracle International Corporation | Tenant self-service troubleshooting for a multi-tenant identity and data security management cloud service |
US10579367B2 (en) | 2016-08-05 | 2020-03-03 | Oracle International Corporation | Zero down time upgrade for a multi-tenant identity and data security management cloud service |
US10530578B2 (en) | 2016-08-05 | 2020-01-07 | Oracle International Corporation | Key store service |
US11356454B2 (en) | 2016-08-05 | 2022-06-07 | Oracle International Corporation | Service discovery for a multi-tenant identity and data security management cloud service |
US11601411B2 (en) | 2016-08-05 | 2023-03-07 | Oracle International Corporation | Caching framework for a multi-tenant identity and data security management cloud service |
US10791087B2 (en) * | 2016-09-16 | 2020-09-29 | Oracle International Corporation | SCIM to LDAP mapping using subtype attributes |
Also Published As
Publication number | Publication date |
---|---|
US20030191763A1 (en) | 2003-10-09 |
US7031967B2 (en) | 2006-04-18 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US7031967B2 (en) | Method and system for implementing policies, resources and privileges for using services in LDAP | |
US6553368B2 (en) | Network directory access mechanism | |
US6768988B2 (en) | Method and system for incorporating filtered roles in a directory system | |
US6785686B2 (en) | Method and system for creating and utilizing managed roles in a directory system | |
US7016893B2 (en) | Method and system for sharing entry attributes in a directory server using class of service | |
US7020662B2 (en) | Method and system for determining a directory entry's class of service based on the value of a specifier in the entry | |
US7613794B2 (en) | Identifying dynamic groups | |
US7167918B2 (en) | Macro-based access control | |
US6470332B1 (en) | System, method and computer program product for searching for, and retrieving, profile attributes based on other target profile attributes and associated profiles | |
US7016907B2 (en) | Enumerated roles in a directory system | |
US7130839B2 (en) | Method and system for grouping entries in a directory server by group memberships defined by roles | |
US7620630B2 (en) | Directory system | |
US7165182B2 (en) | Multiple password policies in a directory server system | |
US20040267749A1 (en) | Resource name interface for managing policy resources | |
US20030105978A1 (en) | Filter-based attribute value access control | |
US7774472B2 (en) | System and method for cross-authoritative configuration management | |
US20040064721A1 (en) | Securing uniform resource identifier namespaces | |
US8117179B2 (en) | Method and apparatus for presenting, searching, and viewing directories | |
US20060074894A1 (en) | Multi-language support for enterprise identity and access management | |
US20060173869A1 (en) | Method and apparatus for requestor sensitive role membership lookup | |
US20030078937A1 (en) | Method and system for nesting roles in a directory system | |
US7194472B2 (en) | Extending role scope in a directory server system | |
US7657925B2 (en) | Method and system for managing security policies for databases in a distributed system | |
US20030055917A1 (en) | Method and system for determining a directory entry's class of service in an indirect manner | |
US20030061347A1 (en) | Method and system for determining a directory entry's class of service by pointing to a single template entry |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: SUN MICROSYSTEMS, INC., CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:CHENG, QINGWEN;HSU, HENG-MING;ARCOT, RAJESH KUMAR;AND OTHERS;REEL/FRAME:012787/0897;SIGNING DATES FROM 20020403 TO 20020408 Owner name: SUN MICROSYSTEMS, INC., CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:CHENG, QINGWEN;HSU, HENG-MING;ARCOT, RAJESH KUMAR;AND OTHERS;SIGNING DATES FROM 20020403 TO 20020408;REEL/FRAME:012787/0897 |
|
AS | Assignment |
Owner name: SUN MICROSYSTEMS, INC., CALIFORNIA Free format text: CORRECTIVE ASSIGNMENT TO CORRECT THE LAST ASSIGNOR'S NAME PREVIOUSLY RECORDED ON REEL 012787 FRAME 0897;ASSIGNORS:CHENG, QINGWEN;HSU, HENG-MING;ARCOT, RAJESH KUMAR;AND OTHERS;REEL/FRAME:013298/0461;SIGNING DATES FROM 20020403 TO 20020408 Owner name: SUN MICROSYSTEMS, INC., CALIFORNIA Free format text: CORRECTIVE ASSIGNMENT TO CORRECT THE LAST ASSIGNOR'S NAME PREVIOUSLY RECORDED ON REEL 012787 FRAME 0897 ASSIGOR HEREBY CONFIRMS THE ASSIGNMENT OF THE ENTIRE INTEREST;ASSIGNORS:CHENG, QINGWEN;HSU, HENG-MING;ARCOT, RAJESH KUMAR;AND OTHERS;SIGNING DATES FROM 20020403 TO 20020408;REEL/FRAME:013298/0461 |
|
STCF | Information on status: patent grant |
Free format text: PATENTED CASE |
|
CC | Certificate of correction | ||
CC | Certificate of correction | ||
FPAY | Fee payment |
Year of fee payment: 4 |
|
FPAY | Fee payment |
Year of fee payment: 8 |
|
AS | Assignment |
Owner name: ORACLE AMERICA, INC., CALIFORNIA Free format text: MERGER AND CHANGE OF NAME;ASSIGNORS:ORACLE USA, INC.;SUN MICROSYSTEMS, INC.;ORACLE AMERICA, INC.;REEL/FRAME:037280/0221 Effective date: 20100212 |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 12TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1553) Year of fee payment: 12 |