Rule validator of an attribute rule enforcer for a directory
View Patent ↗An attribute rule enforcer evaluates the attributes of a call to add, modify, or delete information in a directory, such as a lightweight directory access protocol (LDAP) directory. The attribute rule enforcer determines if the attributes of the call comply with predetermined rules governing the directory's content. The directory attribute rule enforcer may be located at the front end of the directory's access server, and intercepts calls to the directory access server. If the directory attribute rule enforcer determines that the attributes of a call complies with the rules governing the content of the directory, it will forward the call to the directory's access server for action. If, on the other hand, the directory attribute rule enforcer determines that the attributes of a call do not comply with the rules governing the content of the directory, the attribute rule enforcer will reject the call. Further, it may forward an appropriate error message to the source of the call.
1. An apparatus comprising:
a rule validator of an attribute rule enforcer for a directory, wherein the rule validator is interposed between a client and a directory access server for providing access to the directory, the rule validator is configured to determine whether an attribute of a client request complies with a first rule governing content of data that is permissible to be forwarded to the directory access server and a second rule governing structure of data that is permissible to be forwarded to the directory access server, the rule validator is further configured to forward the request to the directory access server when the attribute complies with the first rule and the second rule and being further configured to reject the request to the directory access server and return an error message to a source of the request when the attribute does not comply with the first rule and the second rule, the rule validator is further configured to reply to a beacon signal received from a master rule validator, and the rule validator is further configured to issue a kill signal to a master rule validator in response to an indication the master rule validator has stopped functioning; and
a configuration file for use by said rule validator, the configuration file containing a plurality of parameters corresponding to the first and second rules.
2. The apparatus as recited in claim 1 wherein the rule validator upon startup opens a datagram socket and binds to a specified port to receive a client computer request.
3. The apparatus as recited in claim 1 wherein the plurality of parameters includes a directory access protocol parameter for specifying a file containing said error message.
4. The apparatus as recited in claim 1 wherein the rule validator is further configured to parse rules indicated in said configuration file and cache a list of rules in memory.
5. The apparatus as recited in claim 1 wherein the rule validator is further configured to select a master list of rule lists for a request from a client source to a directory access server.
6. The apparatus as recited in claim 1 further comprising:
a master rule validator comprising an active rule validator bound to an identified port, wherein the rule validator is a backup rule validator sharing the identified port, the master rule validator periodically sending a signal to the backup rule validator according to a preset period of time.
7. A computer-implemented method of validating rules with an attribute rule enforcer for a directory, the method of validating rules comprising:
determining whether an attribute of a client request complies with a first rule governing content of data that is permissible to be forwarded to the directory access server and a second rule governing structure of data that is permissible to be forwarded to the directory access server,
forwarding the request to the directory access server when the attribute complies with the first rule and the second rule;
rejecting the request to the directory access server and returning an error message to a source of the request when the attribute does not comply with the first rule and the second rule;
detecting that the port to which the rule validator is to bind is in use by a master rule validator and configuring the rule validator in a backup mode;
replying to a beacon signal received from the master rule validator; and
issuing a kill signal to the master rule validator in response to an indication that the master rule validator has stopped functioning.
8. The method, as recited in claim 7 ,
wherein the first and second rules include a data addition rule when the request includes a request to add data to the directory,
wherein the first and second rules include a data modification rule when the request includes a request to modify data in a directory, and
wherein the first and second data rules include a data deletion rule when the request includes a request to delete data from the directory.
9. The method, as recited in claim 7 , further comprising:
detecting that the port to which the rule validator is to bind is in use by a master rule validator and configuring the rule validator in a backup mode; and
periodically activating the rule validator and verifying that the port is still in use by the master rule validator.
10. The method, as recited in claim 7 , further comprising:
detecting that a port to which the rule validator is to bind is in use by a master rule validator and configuring the rule validator in a backup mode; and
entering a master mode by the rule validator in response to the master rule validator no longer being active.
11. A method of validating rules for use with an attribute rule enforcer for a directory, the method of validating rules comprising:
determining whether an attribute of a client request complies with a first rule governing content of data that is permissible to be forwarded to the directory access server and a second rule governing structure of data that is permissible to be forwarded to the directory access server;
forwarding the request to the directory access server if the attribute complies with the first rule and the second rule;
rejecting the request to the directory access server and returning an error message to a source of the request if the attribute does not comply with the first rule and the second rule;
detecting that the port to which the rule validator is to bind is in use by a master rule validator and configuring the rule validator to be in a backup mode; and
entering a master mode by the rule validator in response to the master rule validator no longer being active.
12. The apparatus as recited in claim 1 ,
wherein the first and second rules include data addition rules when the request includes a request to add data to the directory,
wherein the first and second rules include data modification rules when the request includes a request to modify data in a directory, and
wherein the first and second data rules include data deletion rules when the request includes a request to delete data from the directory.
13. The apparatus as recited in claim 1 , wherein the plurality of parameters includes an add rules parameter, a modify rules parameter, a modrdn parameter, a delete rules parameter, a log directory parameter, a service port parameter, a debug level parameter, or a directory access protocol error parameter.
14. The apparatus as recited in claim 1 , wherein the rule validator is configured to periodically activate and verify that a port associated with the rule validator is in use by a master rule validator.