Efficient configuration of LDAP user privileges to remotely access clients within groups
View Patent ↗A method and system for restricting remote access by users of directory access protocol client systems without using an directory access protocol “netgroup” option by defining a “remote_allowed” attribute for a entire user group, which, if enabled, allows granting of all remote access requests to all clients, but which, if disabled, allows granting of remote access requests to client systems specifically listed in a “hosts” attribute. In this manner, directory administrators may configure remote access rights for groups of users without having to perform cumbersome and tedious “netgroup”. Subsequent to granting access, the authentication, such as a log in, may be performed on the user. The invention is particularly useful for Lightweight Directory Access Protocol (LDAP) systems, where the “hosts” attribute can list client systems by Internet Protocol address, by hostname, or a by combination of address and hostname.
1. A computer-implemented method for configuration of remote directory user privileges to remotely access clients by users of devices within groups comprising:
responsive to a request from a directory access protocol remote client device to access a specific directory resource:
responsive to a first access control attribute being set to a default value, permitting by a directory server access to the specific directory resource by all directory access protocol client devices within a defined group of client devices without accessing or referring to an access control list, and without referring to a map file, wherein the group is less than all client devices;
responsive to the first access control attribute being set to a value other than the default value, searching by the directory server for a second access control attribute, wherein the second access control attribute contains one or more specific hostnames of remote client devices to which access to the specific directory resource is to be granted;
responsive to the second access control attribute being found and including the hostname of the requesting remote client device, granting access by the requesting remote client device to the specific directory resource; and
responsive to, subsequent to, and separately from the granting of access, performing authentication between the remote client device and the specific directory resource;
wherein computer implementation of the method comprises deploying process software using a site-to-site virtual private network including encryption for connecting one or more fixed sites over an unsecured network via tunneling.
2. The method as set forth in claim 1 wherein the authentication comprises a log in process.
3. The method as set forth in claim 1 wherein the directory access protocol remote client device comprises a Lightweight Directory Access Protocol remote client device.
4. The method as set forth in claim 1 wherein the hostname second attribute comprises at least one network address.
5. A computer memory device program product for configuration of remote directory user privileges to remotely access clients within groups, the computer memory device comprising:
a computer readable storage memory device;
first computer instruction for execution by a directory server for, responsive to a request from a
directory access protocol remote client device to access a specific directory resource, and responsive to a first access control attribute being set to a default value, permitting access to the specific directory resource by all directory access protocol client devices within a defined group of client devices without accessing or referring to an access control list, and without referring to a map file, wherein the group is less than all client devices;
second computer instruction for execution by a directory server for, responsive to the first access control attribute being set to a value other than the default value, searching for a second access control attribute, wherein the second access control attribute contains one or more specific hostnames of remote client devices to which access to the specific directory resource is to be granted;
third computer instruction for execution by a directory server for, responsive to the second access control attribute being found and including the hostname of the requesting remote client device, granting access by the requesting remote client device to the specific directory resource; and
fourth computer instruction for execution by a directory server for, responsive to, subsequent to, and separately from the granting of access, performing authentication between the remote client device and the specific directory resource;
wherein the first, second, third and fourth computer instructions are stored by the computer readable storage memory device by deploying the computer instructions using a site-to-site virtual private network including encryption for connecting one or more fixed sites over an unsecured network via tunneling.
6. The computer program product as set forth in claim 5 wherein the authentication comprises a log in process.
7. The computer program product as set forth in claim 5 wherein the directory access protocol remote client device comprises a Lightweight Directory Access Protocol remote client device.
8. The computer program product as set forth in claim 5 wherein the second access control attribute comprises at least one network address.
9. A system for remote access of directory resources by clients within groups comprising:
a processor of a directory access control system;
an access granter portion of a directory access control system configured to,
responsive to a request from a directory access protocol remote client device to access a specific directory resource:
responsive to a first access control attribute being set to a default value, permit by a directory server access to the specific directory resource by all directory access protocol client devices within a defined group of client devices without accessing or referring to an access control list, and without referring to a map file, wherein the group is less than all client devices;
responsive to the first access control attribute being set to a value other than the default value, search by the directory server for a second access control attribute, wherein the second access control attribute contains one or more specific hostnames of remote client devices to which access to the specific directory resource is to be granted;
responsive to the second access control attribute being found and including the hostname of the requesting remote client device, grant access by the requesting remote client device to the specific directory resource; and
an authenticator portion of the directory access control system configured to, responsive to˜ subsequent to, and separately from the granting of access, perform authentication between the remote client devices and the specific directory resource;
and a deployer portion of the system for configuring the access granter portion using a site-to-site virtual private network including encryption for connecting one or more fixed sites over an unsecured network via tunneling.
10. The system as set forth in claim 9 wherein the authentication comprises a log in process.
11. The system as set forth in claim 9 wherein the directory access protocol remote client comprises a Lightweight Directory Access Protocol remote client.
12. The system as set forth in claim 9 wherein the second access control attribute comprises at least one network address.