Cisco Technology, Inc.

Novell, Inc.

Ranjan Prasad

Dale Robert Olds

Ramprasad Golla

Layne C Izatt

Serge Zloto

Bo Li

Joshua B Littlefield

David Bainbridge

Vinod Dashora

Thomas Alan Parker

Vijayaraghavan Parthasarathy

Max Lou

A method and apparatus for tracking an identity of a user associated with a network lease is disclosed. The IP lease is correlated to user information by storing a user ID with lease information in a manner in which the user information is associated with the lease information. In an embodiment, the user ID is a Global User ID (GUID). In an embodiment the user ID is unique to a specified domain. In an embodiment, the user ID is given to only one user and never changes.

Associating network address lease information with user data

A role based access control system is described that assigns roles, which otherwise are mutually exclusive, to users based on detecting designated conditions when the user initiates actions or operations on the network. The assignment of the role to a particular user may be conditional upon one or more such designated conditions occurring. In particular, two roles that are mutually exclusive of one another may be occupied by one user for purpose of performing specified operations upon designated conditions being detected when the user initiates one or more of the specified operations. Business rules specify conditions for assigning the conditional roles.

Method and apparatus for using a role based access control system on a network

A method and apparatus are disclosed for modifying a subscription of a subscriber to a telecommunications service based on subscriber information and service information that are stored in a directory repository. A directory-enabled service selection framework is coupled to the directory repository for receiving stored information therefrom. The directory-enabled service selection framework receives a request to identify one or more services to which a subscriber is subscribed, based on a prior request to modify the subscription of the subscriber to the telecommunications service. A list is generated of the one or more services to which the subscriber is currently subscribed, based on group membership of the subscriber, one or more roles occupied by the subscriber, and authorization information associated with the subscriber that is stored in the directory repository. Individual service information is generated for each of the one or more services in the list, based on subscriber information and service information that is stored in the directory repository, for use in automatically subscribing the subscriber to a service that is represented by the individual service information. Accordingly, using user information and service information in a directory, a user is automatically subscribed to network services and logged into services.

Method and apparatus for selecting and managing wireless network services using a directory

A method is disclosed for managing network resources in multiple administrative domains. According to the method, a user is authenticated in a first administrative domain. A token is generated for the user that identifies the user as being assigned a role. The token is configured to identify the user by the role to a component of a second administrative domain. When the user requests a resource of the second administrative domain, its component examines the token and the role to determine whether to grant access to the resource. As a result, the second administrative domain may grant the user access to its resources without re-authenticating the user in the second administrative domain.

Method and apparatus for managing network resources for externally authenticated users

A method is provided to configure access to a plurality of data repositories. The data repositories each provide data objects for applications operated by users. A request is received to access data objects in the plurality of data repositories. The request may specify a parameter. Metadata is retrieved that characterizes a portion of the data objects stored in each data repository. One or more objects are selected from the data repositories using the parameter in the request and the metadata.

Method and apparatus for configuring access to a plurality of data repositories

A system and method for synchronizing database information over a communications network distributed among a plurality of servers. The system allows each server to track the state of a replica on each of the servers, and changes to the servers are communicated between the servers along with their states. The states may be stored as an array of timestamps, the timestamps each indicating a time at which the replica on each server was updated. In a network wherein two servers (a first and third server) cannot communicate directly, a first network server transmits a change to an intermediate (a second) server including its state information. The second server transmits the change to the third server, and the third server updates its replica. The third server transmits its state information to the second server, and the timestamp information is conveyed to the first server. The state information of the third server may be transmitted to the second server during later updates of the third server's replica. The first server, by receiving the third server's state information, can determine that the change in replica information was performed on the third server. The synchronization system and method may be used to transmit changes, such as those involved in a partitioning operation.

System and method for synchronizing database information

A method and apparatus for reorganizing a distributed directory is disclosed. A source logical group, such as a partition, is identified for reorganization. A destination object is selected to which the source logical group will become subordinate. Multiple simultaneous reorganizations of the distributed directory can be handled.

Method and apparatus for moving subtrees in a distributed network

Methods and systems for managing replicated objects in a partitioned hierarchical database are disclosed. One method combines partition-wide object identifiers in order according to ancestry to form a database-wide object identifier that identifies a target object relative to all other objects in the database. Each partition-wide object identifier includes a replica identifier and at least one integer value. Suitable integer values include timestamp values, event counter values, random values, and GUID values. Other methods use the identifiers to access objects after a single object or a subtree of objects has been renamed or moved.

Replicated object identification in a partitioned hierarchy

A method of moving leaf objects and subtrees in computer networks that employ a distributed network directory is disclosed. The method employs the existing directories and an authentication procedure for each server. A first object that is under the physical control of the administrator of one partition of the distributed network directory requests access to a second object that is under the physical control of the administrator of another partition of the distributed network directory. The directory verifies that the access control list of the first object includes the second object. The access control list of the second object is then checked to verify that it includes a reference to the first object as an object that is permitted access to the second object. As a result, access is only granted in response to requests from objects that appear in the access control list of the second object. a method of synchronizing the access control lists based upon an authoritative access control list is also disclosed.

Growing community of inventors

Fremont, CA, United States of America

Ranjan Prasad