Never stale caching of effective properties

1. A computer-implemented method of maintaining a cache of effective attributes in an identity management system employing a graph, comprising:

configuring, from a schema, notification requirements to be triggered by updating of attributes of vertices in the graph and triggered by updating a topology of the graph by updating vertices or edges in the graph, wherein the graph is hierarchically arranged with at least three classes of vertices, optionally representing users, roles and assignments;

wherein

a configured notification requirement identifies at least a direction of notification through the graph and

the configured notification requirement requires notification to vertices that are connected in the direction of notification through the graph with a locus of the update and that cache effective attributes harvested from vertices after the updating;

detecting an update to an attribute or topology in the graph that triggers the configured notification requirement and causes a notification that traverses from a third or subsequent class through a second class to a notified vertex of a first class that is connected with the locus of the update; and

refreshing the cache of effective attributes for the notified vertex, responsive to the notification, effectively traversing edges from the first class to the second and to the third or subsequent class to recalculate the effective attributes, wherein the effective attributes that express a relationship between the first and third or subsequent classes can be retrieved from the cache of effective attributes without traversing from the first to third or subsequent class.

2. The method of claim 1 , further including:

configuring, from the schema, one or more cache refresh instructions for traversing the edges from the notified vertex, responsive to the notification.

3. The method of claim 1 , wherein:

the graph is arranged with at least three classes of vertices, optionally representing users, roles and assignments;

notification traverses from a third or subsequent class through a second class to a first class;

the first class of vertices caches effective attributes; and

refresh of the cache of effective attributes effectively traverses from the first class to the second, third or subsequent class.

4. The method of claim 1 , wherein:

the graph is arranged with a plurality of classes of vertices, wherein a first class optionally represents users and the hierarchy represents reporting relationships in an organization chart;

edges interconnect vertices in a first class in a hierarchy with a plurality of root vertices;

notification traverses from leaf vertices or branching vertices up the hierarchy to the root vertices;

the root vertices cache effective attributes; and

refresh of the cache of the effective attributes effectively traverses from a notified root vertex down the hierarchy.

5. The method of claim 1 , wherein the notified vertex represents a user, first degree vertices represent roles, second degree vertices represent assignments of rights, and the cached effective attributes are assignments available to the user.

6. The method of claim 1 , further including traversing edges by executing graph traversing operations.

7. The method of claim 1 , further including recalculating the effective attributes by accumulating attributes from the updated vertex and the other vertices.

8. The method of claim 1 , further including, with some notifications, a description of an update to the attribute of the updated vertex and refreshing the cache using the description of the update, thereby effectively traversing the edges from the notified vertex.

9. The method of claim 1 , further including performing the notification by adding the notified vertex to a list or queue of vertices needing a cache refresh.

10. The method of claim 1 , further including performing the notification by traversing over one or more vertices that require the cache refresh and performing the cache refresh as the traversing proceeds.

11. The computer-implemented method of claim 4 , further including:

recording scheduling of a first user for a change in reporting relationship on a date, on which date the first user ceases reporting to a second user and begins reporting to a third user;

prior to the date, ignoring the scheduled reporting relationship of the first user with the third user when recalculating effective attributes;

on the date, triggering a notification of vertices representing the second and third users to refresh caches of effective relationships;

on and after the date, ignoring the prior reporting relationship of the first user with the second user and taking into account the reporting relationship with the third user when recalculating effective attributes.

12. The computer-implemented method of claim 1 , further including:

recording scheduling of at least one first user for a change in temporary role upon reaching at least one milestone, at which milestone the first user receives or loses the temporary role;

prior to the first user receiving the temporary role, ignoring the scheduled temporary role when recalculating effective attributes;

upon the first user receiving the temporary role, triggering a notification of a vertex representing the first user to refresh caches of effective attributes; and

upon the first user losing the temporary role, triggering a notification of a vertex representing the first user to refresh caches of effective attributes.

13. A tangible non-transitory computer readable storage media, including program instructions loaded into memory that, when executed on processors cause the processors to implement a method of maintaining a cache of effective attributes in an identity management system employing a graph, the method including:

configuring, from a schema, notification requirements to be triggered by updating of attributes of vertices in the graph and triggered by updating a topology of the graph by updating vertices or edges in the graph, wherein the graph is hierarchically arranged with at least three classes of vertices, optionally representing users, roles and assignments;

wherein

a configured notification requirement identifies at least a direction of notification through the graph and

the configured notification requirement requires notification to vertices that are connected in the direction of notification through the graph with a locus of the update and that cache effective attributes harvested from vertices after the updating;

detecting an update to an attribute or topology in the graph that triggers the configured notification requirement and causes a notification that traverses from a third or subsequent class through a second class to a notified vertex of a first class that is connected with the locus of the update; and

refreshing the cache of effective attributes for the notified vertex, responsive to the notification, effectively traversing edges from the first class to the second and to the third or subsequent class to recalculate the effective attributes, wherein the effective attributes that express a relationship between the first and third or subsequent classes can be retrieved from the cache of effective attributes without traversing from the first to third or subsequent class.

14. The tangible non-transitory computer readable storage media of claim 13 , further including:

configuring, from the schema, one or more cache refresh instructions for traversing the edges from the notified vertex, responsive to the notification.

15. The tangible non-transitory computer readable storage media of claim 13 , wherein:

the graph is arranged with at least three classes of vertices, optionally representing users, roles and assignments;

notification propagates from a third or subsequent class through a second class to a first class;

the first class of vertices caches effective attributes; and

refresh of the cache of effective attributes effectively traverses from the first class to the second, third or subsequent class.

16. The tangible non-transitory computer readable storage media of claim 13 , wherein:

the graph is arranged with a plurality of classes of vertices, wherein a first class optionally represents users and the hierarchy represents reporting relationships in an organization chart;

edges interconnect vertices in a first class in a hierarchy with one or more root vertices;

notification traverses from leaf vertices or branching vertices up the hierarchy to the root vertices;

the root vertices cache effective attributes; and

refresh of the cache of the effective attributes effectively traverses from a notified root vertex down the hierarchy.

17. The tangible non-transitory computer readable storage media of claim 13 , wherein the notified vertex represents a user, the first degree vertices represent roles, the second degree vertices represent assignments of rights, and the cached effective attributes are assignments available to the user.

18. The tangible non-transitory computer readable storage media of claim 13 , further including tracing edges by executing graph traversing operations.

19. The tangible non-transitory computer readable storage media of claim 13 , further including recalculating the effective attributes by aggregating attributes from the updated vertex and the other vertices.

20. The tangible non-transitory computer readable storage media of claim 13 , further including, with some notifications, a description of an update to the attribute of the updated vertex and refreshing the cache using the description of the update.

21. The tangible non-transitory computer readable storage media of claim 13 , further including performing the notification by adding the notified vertex to a list or queue of vertices needing a cache refresh.

22. The tangible non-transitory computer readable storage media of claim 13 , further including performing the notification by traversing over one or more vertices that require the cache refresh and performing the cache refresh as the traversing proceeds.

23. The tangible non-transitory computer readable storage media of claim 16 , further including:

recording scheduling of a first user for a change in reporting inter-relationship on a date, on which date the first user ceases reporting to a second user and begins reporting to a third user;

prior to the date, ignoring the scheduled reporting inter-relationship of the first user with the third user when recalculating effective attributes;

on the date, triggering a notification of vertices representing the second and third users to refresh caches of effective attributes;

on and after the date, ignoring the prior reporting relationship of the first user with the second user and taking into account the reporting relationship with the third user when recalculating effective attributes.

24. An identity management system for maintaining a cache of effective attributes in a graph, the system including a processor, memory coupled to the processor and program instructions from the non-transitory computer readable storage media of claim 13 loaded into the memory.