Sun Microsystems, Inc.

Oracle America, Inc.

Robert L Byrne

Karine Excoffier

Gilles Bellaton

Leszek K Mencnarowski

Pransanta Behara

Jérôme Arnou

A directory server system that includes a data repository storing a plurality of entries, wherein the plurality of entries comprises a plurality of user entries and a plurality of role entries, wherein each of the plurality of role entries define a role and comprises an InterestedApplication attribute, a directory server executing a first operation to obtain initial results and execute a second operation to obtain final results, wherein the second operation uses the initial results and the InterestedApplication attribute to obtain the final results, and an application requesting the directory server to execute the first operation and the second operation.

Method and apparatus for requestor sensitive role membership lookup

Extending role scope in a directory server system. A directory server system comprises a directory server and a role mechanism. The directory server interacts with entries organized in a tree structure. The entries comprise user entries and role entries. The role entries define a role and have an associated scope defined from their location in the tree structure. The role mechanism is capable of attaching a role of an existing role entry to a user entry subject to a first condition comprising. The role mechanism is further capable of determining whether the existing role entry has extra data designating an extra scope, and, if so, of attaching a role of the existing role entry to a user entry subject to a second condition. The second condition comprises the role membership condition and the fact that the user entry belongs to the extra scope of the existing role entry.

Extending role scope in a directory server system

The invention proposes a directory server, capable of interacting with entries organized in a tree structure. Each entry has attributes, these attributes comprising real attributes each having a value stored in the entry. The directory server comprising: a mechanism capable of associating a virtual attribute to an entry, subject to a virtual attribute condition being verified, the virtual attribute condition being derived from data located elsewhere in the tree structure, and a resolving function, capable of receiving a first filter expression, based on a virtual attribute, for converting it into one or more second filter expressions, containing real attributes, and being computed from the first filter expression and from the virtual attribute condition.

Indexing virtual attributes in a directory server system

Various embodiments of systems and methods for using condition defining data (e.g., access control instructions) attached to nodes in a tree to implement node-related conditions in a directory server having a tree structure are disclosed. In one embodiment, a method includes attaching condition defining data that includes a variable portion and a reference portion to a given node in the tree structure, and upon access to a subnode of said given node in the tree, using the reference portion and a property of the subnode to tentatively derive a value for the variable portion, changing the variable portion into the value, and evaluating the condition in said condition defining data.

Macro-based access control

Various embodiments of systems and methods for implementing filter-based attribute value access control are disclosed. In one embodiment, a method involves designating a location in the directory server, providing attribute related data that includes a filter expression, and selectively controlling access to an entry situated at the designated location using the filter expression in the attribute related data. For example, access to an attribute of the entry may be denied if a criterion defined by the filter expression associated with the attribute is not met by a first value of the attribute.

Growing community of inventors

Voiron, France

Robert L Byrne