Simplified ldap access control language system

Abstract

A simplified LDAP access language system provides user-defined attributes that tell the directory system who the user wants to give read or write access to a specific set of his attributes. The read and write attributes are separate lists and may, in fact, differ, thereby giving the user the flexibility to better manage access to his attributes. The value of the read and write attributes are in an LDAP Filter format which is an Internet standard (RFC 2254) which allows the user to specify not only users local to his intranet, but users across the Internet as well. Access control lists (ACL) are created by the System Administrators and list the specific attributes that the user is allowed to control read or write access, giving the Administrators full control of what information the user can give out. The ACLs are stored in the directory along with the entries. When a user accesses an entry in a directory, the server checks the ACL specified for the attributes being accessed. The read or write attribute for the owner of the attributes being accessed are used by the server when it checks the ACL. The combination of the read or write attribute and the ACL determine whether the user has permission to perform the read or write access to the attribute being accessed.