Maintaining multiple sets of identity data
A method of assigning the UNIX computers in a network to one of a plurality of groups called zones, of creating independent sets of UNIX identity information for each network entity (user or group) for separate zones, and of associating an entity's sets of UNIX entity information with a single global entity record for the entity in the network's identity resolver. A further method of allowing a UNIX computer to request entity information from the identity resolver, and of the identity resolver returning resolved entity information appropriate for the requesting computer's zone. A further method of managing sets of zone-specific UNIX identity information in the identity resolver to ensure that entity names and entity identification numbers are not duplicated within a zone and to all the same names and numbers to be duplicated across zones. Other embodiments are also described.
1. A method comprising:
obtaining a group identifier from a UNIX client computer on a network, wherein said network includes at least two networks which are linked together, said network having a single master directory for said at least two networks;
determining a zone assigned by an administrator of the UNIX client computer from zone identity information, wherein said assigned zone is assigned to at least a second UNIX client computer on the network, and a plurality of zones exist on said network, wherein said UNIX client computer and said second UNIX client computer are located in a same one of said at least two networks, and in a different one of said plurality of zones;
selecting a global group record using the group identifier, said global group record including a UNIX group name for each of said plurality of zones;
retrieving from said selected global group record said UNIX group name for said determined zone among said plurality of zones;
sending said UNIX group name to said UNIX client computer.
2. The method of claim 1 wherein the zone identity information identifies one zone of said plurality of zones, said plurality of zones including at least a first zone which is assigned to said first UNIX computer which is located in a first one of said at least two networks and a second zone which is assigned to a third UNIX computer which is located in a second one of said at least two networks, where a first group record of the first zone conflicts with a second group record of the second zone, wherein said single master directory includes said selected global group record.
3. The method of claim 1 wherein the zone identity information is an explicit zone identifier obtained with the group identifier.
4. The method of claim 1 wherein the group identifier is a global group name.
5. A non-transitory computer-readable storage medium storing instructions that, when executed by a UNIX computing system on a network, cause the system to perform operations comprising:
communicating a group identifier and zone identity information corresponding to a zone assigned by an administrator to an identity resolver, wherein said assigned zone is assigned to said UNIX computing system, and at least a second UNIX computing system on the network wherein said network includes at least two networks which are linked together, said network having a single master directory for said at least two networks, and a plurality of zones exist on said network, wherein said UNIX computing system and said second UNIX computing system are located in a same one of said at least two networks, and in a different one of said plurality of zones;
obtaining a response containing a UNIX group name from the identity resolver which performs a look-up for a global group record using the group identifier and the zone corresponding to the zone identity information; and
providing the obtained UNIX group name to a process executing on the UNIX computing system.
6. The method of claim 5 wherein the zone identity information identifies one zone of said plurality of zones, said plurality of zones including at least a first zone which is assigned to said first UNIX computer which is located in a first one of said at least two networks and a second zone which is assigned to a third UNIX computer which is located in a second one of said at least two networks, where a first group record of the first zone conflicts with a second group record of the second zone, wherein said single master directory includes said selected global group record.