Netscape Communications Corporation

America Online, Inc.

Prasanta Behera

Terry N Hayes

A domain specification system for an LDAP ACI entry provides a system for specifying an ACI domain entry in an access control command line that controls access to a resource. The access control command specifies resources using a Universal Resource Locator (URL) format that contains the name of the resource. A target scope value specifies the scope of access to be granted to a user which can be limited to a single entry, a subtree, or a single level. A search filter is part of the resource specification. The ACI applies only to entries in the subtree rooted at the resource name that match the filter. A list of attributes is also contained in the resource specification and the ACI applies only to attributes in the resource that are named in the list. The access control command specifies the type of access to be granted to a user which includes, but is not limited to: deny, read, write, and any other privileges that the system supports. The access control command also specifies the required user attributes for access to a resource. The directory server matches the required attributes with the accessing user's attributes and grants the type of access listed only if the user has the required attributes.

Domain specification system for an LDAP ACI entry

A simplified LDAP access language system provides user-defined attributes that tell the directory system who the user wants to give read or write access to a specific set of his attributes. The read and write attributes are separate lists and may, in fact, differ, thereby giving the user the flexibility to better manage access to his attributes. The value of the read and write attributes are in an LDAP Filter format which is an Internet standard (RFC 2254) which allows the user to specify not only users local to his intranet, but users across the Internet as well. Access control lists (ACL) are created by the System Administrators and list the specific attributes that the user is allowed to control read or write access, giving the Administrators full control of what information the user can give out. The ACLs are stored in the directory along with the entries. When a user accesses an entry in a directory, the server checks the ACL specified for the attributes being accessed. The read or write attribute for the owner of the attributes being accessed are used by the server when it checks the ACL. The combination of the read or write attribute and the ACL determine whether the user has permission to perform the read or write access to the attribute being accessed.

Simplified LDAP access control language system

An access control via properties system provides ACL rules based on the properties associated with the entries, thereby taking advantage of the fact that there are inherent properties associated with each entry and does not require any changes to the schema. Once the server supports the invention, the system administrator creates a few simple ACL rules and is done. The invention structures the ACL rule such that it indicates the attributes that the administrator has selected for user access and specifies the type of access to be granted to a user which can include: read, write, or any other privileges that the system supports. The desired attributes that the user must have to be granted such access is also listed along with the attribute fieldname associated with the desired attributes. The directory server will match the desired attributes within the specified attribute fieldname with the user's attributes and allows access to the directory entry only if the user has the desired attribute values. Alternatively, a match function can be specified for the desired attributes where the directory server matches the desired attributes with the user and the owner of the list of attributes and allows access to the directory entry only if the both the user and the owner have the desired attribute values. When a user accesses a directory entry, the directory server selects and analyzes a specific access control command according to the attribute being accessed.

Growing community of inventors

Fremont, CA, United States of America

Prasanta Behera