Novell, Inc.

Randal Earl Childers

Dale Robert Olds

Kevin W Kingdon

DeeAnne Barker Higley

Christopher Jenkins

Methods and systems are provided for caching information in a distributed computer system such as a directory service system. Tuples in a client cache contain component identifiers and corresponding location identifiers. Tuples may contain a list of network addresses specifying at least one server containing additional location or object information, as well as replica flags which distinguish between read-only replicas, read-write replicas, and a master replica. Requests to access an object may be serviced by using cached information rather than making one or more attempts to obtain location information from servers. Tuples may be modified or invalidated such that read operations tend to be performed using read-only replicas. Cached tuples which contain a component identifier that is no longer valid because an object was moved or renamed may be invalidated. The cache may also be modified to redirect operations from a master replica to a non-master replica.

System and method for caching identification and location information in

A method and apparatus for providing access control to objects in a distributed network directory employing static resolution to resolve object attributes. A first object has a Security Equals attribute and a second object has an Equivalent To Me attribute. Upon receiving a request for the first object to access the second object, authorization of such access is verified by checking if the two attributes are synchronized. The attributes are synchronized when the Security Equals attribute of the first object includes the second object, and the Equivalent To Me attribute of the second object includes the first object. A method of synchronizing the two attributes is also disclosed.

Method and apparatus to secure distributed digital directory object

A method of providing authoritative access control to computer networks that employs a distributed network directory using a static means of resolving object attributes is disclosed. The method employs the existing directories and an authentication procedure for each server. A first object that is under the physical control of the administrator of one partition of the distributed network directory requests access to a second object that is under the physical control of the administrator of another partition of the distributed network directory. The directory verifies that the access control list of the first object includes the second object. The access control list of the second object is then checked to verify that it includes a reference to the first object as an object that is permitted access to the second object. As a result, access is only granted in response to requests from objects that appear in the access control list of the second object. A method of synchronizing the access control lists based upon an authoritative access control list is also disclosed.

Growing community of inventors

Orem, UT, United States of America

Randal Earl Childers