Novell, Inc.

Carlos A Nevarez

Stephen R Carter

Glenn Ricart

Grant G Echols

Chris Andrew

Lyle Bate

Kenneth Paul White

Methods, signals, devices, and systems are provided for locating and retrieving files, objects, and other items in a network. Nametags are distributed through the network with the items. Each nametag may hold logical names identifying the item, names of the volatile copies of the item, and/or names of nonvolatile copies of the item. Thus, nametags may include names form multiple name spaces, and cached items can be identified expressly.

Multiple storage class distributed nametags for locating items in a distributed computing system

Methods, signals, devices, and systems are provided for locating and retrieving files, objects, and other items in a network. Nametags are distributed through the network with the items. Each nametag may hold logical names identifying the item, names of the volatile copies of the item, and/or names of nonvolatile copies of the item. Thus, nametags may include names from multiple name spaces, and cached items can be identified expressly.

A system and method for caching and accessing rights in a distributed computing system is disclosed. An agent, that is located on a Distributed Deputization Point (DPP) parses a directory service. The agent then updates the rights to an Access Control List (ACL) cache. The ACL cache then receives, from an authenticated user, a request for the rights. The ACL cache retrieves the rights and forwards them to the user. The user may now access certain resources based on the rights it has obtained the first time it accesses these resources. Additionally, if the user attempts to access certain resources that are not contained in the ACL cache, a resource manger is invoked which provides the access control rights for the missing resources to the ACL cache.

Caching and accessing rights in a distributed computing system

Methods, signals, devices, and systems are provided for delegating rights in a distributed computer system from a principal to one or more deputies. The deputies have identities separate from the principal. This allows the deputies to persist after the principal logs off the system, and permits deputization across boundaries imposed by namespaces and particular network protocols. A deputy may also delegate rights to additional deputies. Deputization is accomplished using certificates, domain/realm-specific credentials, public and private keys, process creation, and other tools and techniques.

Deputization in a distributed computing system

Methods, configured media, and systems are provided for connecting disparate software components in a network or other computer system. A language adapter maps programming language constructs to a general object-oriented interface. An object model adapter maps the general object-oriented interface to specific object models such as the Java/RMI model or a CORBA model. The system dynamically wraps non-object components, such as scripts, in a object wrapper as needed to make them accessible through the language adapter and the object model adapter. In this manner, a language-vendor-independent bridge is provided between components written in different programming languages, and the components also gain access to objects written in object models favored by various vendors.

Component architecture in a computer system

Methods, signals, devices, and systems are provided for delegating rights in a distributed computer system from a principal to one or more deputies. The deputies have identities separate from the principal. This allows the deputies to persist after the principal logs off the system, and permits deputization across boundaries imposed by namespaces and particular network protocols. A deputy may also delegate rights to additional deputies. Deputization is accomplished using certificates, credentials, public and private keys, process creation, and other tools and techniques.

Methods, systems, and devices are provided for delegating security rights to Java servlets and other executable tasks by using secure operating system queues. In particular embodiments, the invention allows secure loading of Java servlets on a Novell NetWare server. The invention allows users to run servlets from various locations with the same rights, namely, the user's rights. The servlet submitted by a given user runs in the context of that user's rights. A system according to the invention verifies that the user has the right to submit the task to a given task queue; the queue is managed by the system, and the user is authenticated to the system. Queue servers which receive tasks from the queue and service them by executing the tasks are likewise authenticated by the system. When a queue server attempts to service a task in a queue, the system verifies that the queue server has rights to service that queue and that job. This two way verification&mdash;that a user has rights to submit the task, and that the queue server has rights to service the task&mdash;allows the user and the queue server to establish a trusted relationship using the operating system's trusted queues. Moreover, existing user rights databases and access control systems can be used to determine and enforce rights and trust levels.

Authority delegation with secure operating system queues

A system and method for integrating additional functionality into a login system which includes registering a login extension operative to receive notification of an event generated by the login system. The login extension provides additional functionality and response to the received notification. The login extension is registered by the login system and authenticated to ensure that the login extension has proper access rights. An event manager of the login system communicates login events to the registered login extension which then provides additional desired functionality.

Method and system for integrating additional functionality into a login

The present invention provides a definition, format, and structure of extended attributes for managing, maintaining, and controlling file systems. This is accomplished by creating a database containing management, maintenance, control, and other user-defined data that are associated with a directory entry of the file system. The database is stored inside the extended attribute or sets of extended attributes. According to the present invention, each extended attribute includes a header for defining the extended attribute that comprises a first plurality of fields. It also includes a plurality of records for storing data. In turn, each record of the plurality of records comprises a second plurality of fields. The extended attribute is identified by a string stored in a directory entry of a directory entry table for the file system. The string comprises a predetermined substring denoting the extended attribute having the database architecture of the present invention. The first plurality of fields of the extended attribute includes fields for storing a length of the header, a version number of the header, a revision number of the header, the number of extended attributes in the database, and the number of records in the plurality of records in the database. The second plurality of fields includes fields for storing a name of a record, data, a record length, a length of the record name, and a length of the data. Both the name and data are stored as strings.

Methods for storing a database in extended attributes of a file system

The present invention provides a definition, format, and structure of extended attributes for managing, maintaining, and controlling file systems. This is accomplished by creating a database containing management, maintenance, control, and other user-defined data that are associated with a directory entry of the file system. The database is stored inside the extended attribute or sets of extended attributes. According to the present invention, each extended attribute includes a header for defining the extended attribute that comprises a first plurality of fields. It also includes a plurality of records for storing data. In turn, each record of the pluraity of records comprises a second plurality of fields. The extended attribute is identified by a string stored in a directory entry of a directory entry table for the file system. The string comprises a predetermined substring denoting the extended attribute having the database architecture of the present invention. The first plurality of fields of the extended attribute includes fields for storing a length of the header, a version number of the header, a revision number of the header, the number of extended attributes in the database, and the number of records in the plurality of records in the database. The second plurality of fields includes fields for storing a name of a record, data, a record length, a length of the record name, and a length of the data. Both the name and data are stored as strings.

Growing community of inventors

Orem, UT, United States of America

Carlos A Nevarez