Expanded membership access control in a collaborative environment
View Patent ↗A method, system and apparatus for expanded membership access control in a collaborative environment. A collaborative application which has been configured for expanded membership access control can include a collaborative space configured to host places, and rooms and sub-rooms within the places. The collaborative space further can include a membership management processor coupled to the collaborative space and programmed both to produce access control lists for the rooms and sub-rooms based upon specified roles for members and to assign the roles to members added to the rooms and sub-rooms separately from the access control lists. Notably, a membership directory also can be included which can be configured to store membership information for the members exclusive of the access control lists.
1. A method for managing expanded membership access control in a collaborative application, the method comprising the steps of:
adding a room to a place through the collaborative application;
creating a set of roles in an access control list (ACL) in a hierarchical directory for said added room, and further creating a set of corresponding groups for said roles in the hierarchical directory;
adding a member to a membership directory that is separate from the hierarchical directory; and,
additionally adding the member to said added room and assigning one of said roles in the ACL to said added member by writing a directory entry in the hierarchical directory in a group corresponding to said assigned one of said roles after said assigned one of said roles has been assigned to said added member.
2. The method of claim 1 , wherein the membership directory comprises one or more fields in each record entry for the added member which specify corresponding roles assigned to the added member for different rooms and sub-rooms in the collaborative application.
3. The method of claim 1 , further comprising the step of limiting access to said added room by an accessing member by looking up a group membership for said accessing member in the hierarchical directory, matching said group membership to a role and applying role-based permissions indicated by said ACL.
4. The method of claim 2 , further comprising the step of determining role based permissions for a particular member by inspecting a record entry for said particular member to identify said assigned one of said roles for an indicated room.
5. The method of claim 4 , further comprising the step of performing the determining step while the collaborative application is off-line.
6. The method of claim 1 , further comprising the step of removing said added member from said added room by deleting said record entry.
7. The method of claim 6 , wherein said removing step further comprises the step of deleting said record entry for said added member.
8. A collaborative application, comprising:
a collaborative space configured to host places, and rooms and sub-rooms within said places in a computer having at least one processor and memory; and,
a membership management processor executing in memory of the computer and coupled to the collaborative space, the membership management processor programmed to add a room to a place through the collaborative application, to create a set of roles in an access control list (ACL) in a hierarchical directory for said added room and to further create a set of corresponding groups for said roles in the hierarchical directory, to add a member to a membership directory that is separate from the hierarchical directory, and to additionally add the member to said added room and assigning one of said roles in the ACL to said added member by writing a directory entry in the hierarchical directory in a group corresponding to said assigned one of said roles after said assigned one of said roles has been assigned to said added member.
9. The collaborative application of claim 8 , wherein the membership directory comprises one or more fields in each record entry for the added member which specifies corresponding roles assigned to the added member for different rooms and sub-rooms in the collaborative application.
10. The collaborative application of claim 8 , wherein the membership management processor is further programmed to limit access to said added room by an accessing member by looking up a group membership for said accessing member in the hierarchical directory, matching said group membership to a role and applying role-based permissions indicated by said ACL.
11. The collaborative application of claim 9 , wherein the membership management processor is further programmed to determine role based permissions for a particular member by inspecting a record entry for said particular member to identify said assigned one of said roles for an indicated room.
12. The collaborative application of claim 8 , wherein said hierarchical directory is an LDAP directory.
13. The collaborative application of claim 8 , wherein the set of roles comprises readers, managers, and authors.
14. The collaborative application of claim 8 , wherein the membership management processor is further programmed to remove said added member from said added room by deleting said record entry.
15. A computer program product comprising a computer usable storage memory having computer usable program code for catalog display, said computer program product including:
computer usable program code for adding a room to a place through the collaborative application;
computer usable program code for creating a set of roles in an access control list (ACL) in a hierarchical directory for said added room, and further creating a set of corresponding groups for said roles in the hierarchical directory;
computer usable program code for adding a member to a membership directory that is separate from the hierarchical directory; and,
computer usable program code for additionally adding the member to said added room and assigning one of said roles in the ACL to said added member by writing a directory entry in the hierarchical directory in a group corresponding to said assigned one of said roles after said assigned one of said roles has been assigned to said added member.
16. The computer program product of claim 15 , wherein the membership directory comprises one or more fields in each record entry for the added member which specifies corresponding roles assigned to the added member for different rooms and sub-rooms in the collaborative application.
17. The computer program product of claim 15 , further comprising computer usable program code for limiting access to said added room by an accessing member by looking up a group membership for said accessing member in the hierarchical directory, matching said group membership to a role and applying role-based permissions indicated by said ACL.
18. The computer program product of claim 16 , further comprising computer usable program code for determining role based permissions for a particular member by inspecting a record entry for said particular member to identify said assigned one of said roles for an indicated room.
19. The computer program product of claim 18 , further comprising computer usable program code for performing the determining step while the collaborative application is off-line.
20. The computer program product of claim 15 , further comprising computer usable program code for removing said added member from said added room by deleting said record entry.
21. The computer program product of claim 20 , wherein computer usable program code for removing said added member from said added room by deleting said record entry further comprises computer usable program code for deleting said record entry for said added member.