Network directory access mechanism

Details Network directory access mechanism Network directory access mechanism

1998-03-03

2003-04-22

Corrielus, Jean M. (Department: 2172)

Data processing: database and file management or data structures

Database design

Data structure types

C707S793000, C707S793000, C707S793000, C709S217000, C709S218000, C709S219000

Reexamination Certificate

active

06553368

ABSTRACT:

BACKGROUND OF THE INVENTION
This invention relates to a network directory access mechanism, for example access mechanisms based on Directory Access Control Domains (DACDs) on the Internet.
The popularity of directory servers based on ISO/CCITT X.500 model has increased with the wide support by the industry of the Lightweight Directory Access Protocol (LDAP). LDAP is defined by RFC 1777. There is a desire to try to integrate heterogeneous information in these directories by either moving the data from their old format to this new model, or to map the old model into the X.500 model. However, this is not straightforward and has practical difficulties.
The directory services under the X.500 model are based on an object hierarchy, with each node in the hierarchy corresponding to a given level of detail. A particular location in the hierarchy is identified by the sequence of nodes down the hierarchy from the root or base node to the node in question. Each entry in the hierarchy sets out attributes for the entry. Although there is a single logical hierarchy, parts of the hierarchy can be physically separated. In order for the practical hierarchy to operate, therefore, each node identifies the physical location of the adjacent nodes down the hierarchy.
To access the hierarchy, access control lists are provided. These can be provided at nodes throughout the hierarchy and define access control rights for different users and/or bodies. The access control rights relate to areas of the local structure (domains) of the hierarchy and not to the physical locations of the nodes of the attributes for the hierarchy. Thus, if it is intended to provide access under the LDAP, for example, to information created under a pre-existing, non-X.500 format, it is necessary to copy the whole of the previous directory to the new directory accessed through LDAP.
The present invention seeks to provide a solution to the problem of how to integrate into a directory service operable under a first format directory entries under a second format, without needing to convert all of the entries under the first format into the second format.
SUMMARY OF THE INVENTION
Particular and preferred aspects of the invention are set out in the accompanying independent and dependent claims. Combinations of features from the dependent claims may be combined with features of the independent claims as appropriate and not merely as explicitly set out in the claims.
In accordance with a first aspect of the invention, there is provided a computer-implemented directory access mechanism. The method comprises steps of:
i) a directory service operable to access a network directory under a predetermined protocol responding to an access request under the protocol for information available in a predetermined environment external to the directory; and
ii) the directory service using an access method for the environment to access the information.
Thus, an embodiment of the invention enables a directory service operable under a predetermined directory access protocol to access data in a predetermined environment (e.g. data stored in accordance with a different storage model from that on which the predetermined protocol is based, or a different physical location, or a different protocol) by configuring an attribute access method and using this method to retrieve the information from, for example, a directory operable in the predetermined environment.
In a preferred embodiment of the invention the access method configuration is achieved by extending a domain definition normally used for access control. Where reference is made to an access method, this forms an access process or procedure, typically implemented by a set of access parameters or computer instructions or a combination thereof. Preferably, the access method is retrieved via a domain definition for a domain of the directory. The domain definition can also include access control information. In a preferred embodiment of the invention, the directory is defined under X.500 and the access method is retrieved from a Directory Access Control Domain object.
However, the invention is not limited to associating the access method with access control. Thus it is possible for an access method to be defined without access control, on a specific attribute.
The domain definition can include a pointer to an access method for the domain in the environment, possibly stored externally to the directory or possibly stored with a definition of a node in the directory.
In the preferred embodiment of the invention, the protocol is the Lightweight Directory Access Protocol. The information to be accessed could typically be an attribute of an entry in the directory.
Thus, a preferred embodiment of the invention uses the Directory Access Control Domain (DACD) as defined in the ISO/CCITT X.501 (1993 E) specification not only to store access rights but also to store access methods. The access method points to a directory entry storing the specific access method parameters.
In accordance with another aspect of the invention, there is provided a directory access mechanism comprising a directory service to access a network directory operable under a predetermined protocol, at least one identifier of an access method for access to information in a predetermined environment external to the directory, the directory service being configured to respond to an access request under the protocol to access the information in said environment using an access method identifier.
In accordance with a further aspect of the invention, there is provided a directory access mechanism comprising a directory service configured to be operable to access to a network directory under a predetermined protocol and to identify at least one access method for access to information in a predetermined environment external to the directory, the directory service being configured to respond to an access request under the protocol to access the information available in the environment using an access method identifier.
In accordance with yet a further aspect of the invention, there is provided an Access Control List (ACL) for a network directory service, which access control list comprises control access rights for directory objects and access methods for attributes of the directory objects. The access control list can form a computer implemented access control mechanism for an object-based directory.
The invention also provides a computer program product on a carrier medium, the computer program product comprising a directory service configured to be operable to provide directory access under a predetermined protocol, and at least one identifier of an access method for information in a predetermined environment external to the directory, the directory service being configured to respond to an access request under the protocol to access the information available in the environment using an access method identifier.
The invention further provides a directory server for a computer network, the directory server comprising storage for a network services directory under a predetermined protocol and at least one identifier of an access method for information in a predetermined environment external to the directory, and a processor for executing a directory service controller, the directory service being configured to respond to an access request under the predetermined protocol to access the information available in the environment using an access method identifier.


REFERENCES:
patent: 5491817 (1996-02-01), Gopal et al.
patent: 5497422 (1996-03-01), Tysen et al.
patent: 5500929 (1996-03-01), Dickinson
patent: 5649103 (1997-07-01), Datta et al.
patent: 5706517 (1998-01-01), Dickinson
patent: 5758343 (1998-05-01), Vigil et al.
patent: 5774552 (1998-06-01), Grimmer
patent: 5812533 (1998-09-01), Cox et al.
patent: 5862325 (1999-01-01), Reed et al.
patent: 5864683 (1999-01-01), Boebert et al.
patent: 5878415 (1999-03-01), Olds
patent: 5884035 (1999-03-01), Butman et al.
patent: 5922074 (1999-07-01), Richard et al.
patent: 5995961 (1999-11-01), Levy et al.
pate

Affiliated with

Also associated with

Rating

Network directory access mechanism does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Network directory access mechanism, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Network directory access mechanism will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-3085522