Domain specification system for an LDAP ACI entry
View Patent ↗A domain specification system for an LDAP ACI entry provides a system for specifying an ACI domain entry in an access control command line that controls access to a resource. The access control command specifies resources using a Universal Resource Locator (URL) format that contains the name of the resource. A target scope value specifies the scope of access to be granted to a user which can be limited to a single entry, a subtree, or a single level. A search filter is part of the resource specification. The ACI applies only to entries in the subtree rooted at the resource name that match the filter. A list of attributes is also contained in the resource specification and the ACI applies only to attributes in the resource that are named in the list. The access control command specifies the type of access to be granted to a user which includes, but is not limited to: deny, read, write, and any other privileges that the system supports. The access control command also specifies the required user attributes for access to a resource. The directory server matches the required attributes with the accessing user's attributes and grants the type of access listed only if the user has the required attributes.
1. A process for specifying an ACI domain entry that controls access to a resource in a computer environment, comprising the steps of:
providing an access control command that is capable of being defined by a system administrator;
said access control command specifies the name of said resource, wherein said resource is in a directory structure;
said access control command lists a target scope value;
wherein said target scope value specifies the scope of access to be granted to a user and allows said ACI domain entry to be restricted to a specific range, wherein said range comprises a node;
wherein said access control command specifies the type of access to be granted to a user;
wherein said access control command is expressed in an LDAP Universal Resource Locator (URL) standardized format in an ACI rule;
wherein said specific range specifies a portion of a tree structure;
wherein said access control command specifies the required user attributes for access to said resource; and
wherein a directory server matches said required attributes with the accessing user's attributes and grants said type of access only if the user has said required attributes.
2. The process of claim 1 , wherein said type of access includes, but is not limited to: deny, read, write, and any other privileges that the system supports.
3. The process of claim 1 , wherein said target scope value specifies one of the values: BASE, SUB, or ONE.
4. The process of claim 1 , wherein said access control command specifies a search filter; and wherein said access command applies only to entries that match said filter.
5. The process of claim 1 , wherein said access control command specifies a list of attributes; and wherein said access control command applies only to attributes in said resource that are listed in said list.
6. An apparatus for specifying an ACI domain entry that controls access to a resource in a computer environment, comprising:
an access control command that is capable of being defined by a system administrator;
said access control command specifies the name of said resource, wherein said resource is in a directory structure;
said access control command lists a target scope value;
wherein said target scope value specifies the scope of access to be granted to a user and allows said ACI domain entry to be restricted to a specific range, wherein said range comprises a single node;
wherein said access control command specifies the type of access to be granted to a user;
wherein said access control command is expressed in an LDAP Universal Resource Locator (URL) standardized format in an ACI rule;
wherein said specific range specifies a portion of a tree structure;
wherein said access control command specifies the required user attributes for access to said resource; and
wherein a directory server matches said required attributes with the accessing user's attributes and grants said type of access only if the user has said required attributes.
7. The apparatus of claim 6 , wherein said type of access includes, but is not limited to: deny, read, write, and any other privileges that the system supports.
8. The apparatus of claim 6 , wherein said target scope value specifies one of the values: BASE, SUB, or ONE.
9. The apparatus of claim 6 , wherein said access control command specifies a search filter; and wherein said access command applies only to entries that match said filter.
10. The apparatus of claim 6 , wherein said access control command specifies a list of attributes; and wherein said access control command applies only to attributes in said resource that are listed in said list.
11. A program storage medium readable by a computer, tangibly embodying a program of instructions executable by the computer to perform method steps for specifying an ACI domain entry that controls access to a resource in a computer environment, comprising the steps of:
providing an access control command that is capable of being defined by a system administrator;
said access control command specifies the name of said resource, wherein said resource is in a directory structure;
said access control command lists a target scope value;
wherein said target scope value specifies the scope of access to be granted to a user and allows said ACI domain entry to be restricted to a specific range, wherein said range comprises a single level of nodes;
wherein said access control command specifies the type of access to be granted to a user;
wherein said access control command is expressed in an LDAP Universal Resource Locator (URL) standardized format in an ACI rule;
wherein said specific range specifies a portion of a tree structure;
wherein said access control command specifies the required user attributes for access to said resource; and
wherein a directory server matches said required attributes with the accessing user's attributes and grants said type of access only if the user has said required attributes.
12. The method of claim 11 , wherein said type of access includes, but is not limited to: deny, read, write, and any other privileges that the system supports.
13. The method of claim 11 , wherein said target scope value specifies one of the values: BASE, SUB, or ONE.
14. The method of claim 11 , wherein said access control command specifies a search filter; and wherein said access command applies only to entries that match said filter.
15. The method of claim 11 , wherein said access control command specifies a list of attributes; and wherein said access control command applies only to attributes in said resource that are listed in said list.
16. The process of claim 1 , wherein said node comprises a single node.
17. The process of claim 1 , wherein said node comprises a single level of nodes.
18. The process of claim 1 , wherein said portion of said tree structure comprises an entire subtree of said tree structure.
19. The process of claim 4 , wherein said specific range comprises a portion of a subtree structure of said directory structure that matches said search filter.
20. The apparatus of claim 6 , wherein said portion of said tree structure comprises a next level of said tree structure.