Resource access based on supervisory-subordinate relationship

1. A processing device comprising:

a processing circuitry including a processor and associated memory;

non-volatile storage configured to store management information including information identifying supervisor-subordinate relationships among users;

the processing circuitry configured to:

receive a request from a first user, wherein the request includes a request to alter access rights of a second user to a network resource;

establish authorization of the first user to request access to the network resource based on information included in a directory services database;

retrieve management information associated with the first user and the second user from the non-volatile storage;

determine whether a supervisor-subordinate relationship exists between the first user and the second user based on the management information associated with the first user and the second user; and

alter the access rights of the second user to the network resource at least partly in response to determining that the supervisor-subordinate relationship between the first user and the second user exists.

2. The processing device of claim 1 , wherein the processing circuitry is further configured to:

subsequent to altering the access rights of the second user, determine that the supervisor-subordinate relationship has been terminated; and

reverting the access rights of the second user to the network resource to a pre-altered state in response to termination of the supervisor-subordinate relationship.

3. The processing device of claim 1 , wherein the processing circuitry is further configured to:

subsequent to altering the access rights of the second user, determine that the supervisor-subordinate relationship has been terminated; and

in response to termination of the supervisor-subordinate relationship, leave the access rights of the second user to the network resource unchanged.

4. The processing device of claim 1 , wherein:

altering the access rights of the second user includes granting access to the network resource.

5. The processing device of claim 4 , wherein

the processing circuitry is configured to limit access rights granted to the second user to a subset of the access rights possessed by the first user.

6. The processing device of claim 1 , wherein the processing circuitry is further configured to:

identify, based on the management information, which of a plurality of non-duplicated directory services databases is to be queried to obtain information indicating whether a requestor is an authorized network user.

7. The processing device of claim 1 , wherein the management information includes:

source-of-rights information indicating whether a user's access authorizations were granted by another user, and if so, which user granted that access authorization.

8. A method comprising:

receiving a request from a first user, wherein the request includes a request to alter access rights of a second user to a network resource;

establishing authorization of the first user to request access to the network resource based on information included in a directory services database;

retrieving management information associated with the first user and the second user from non-volatile storage;

determining whether a supervisor-subordinate relationship exists between the first user and the second user based on the management information associated with the first user and the second user; and

altering the access rights of the second user to the network resource at least partly in response to determining that the supervisor-subordinate relationship between the first user and the second user exists.

9. The method of claim 8 , further comprising:

subsequent to altering the access rights of the second user, determining that the supervisor-subordinate relationship has been terminated; and

reverting the access rights of the second user to access the network resource to a pre-altered state in response to termination of the supervisor-subordinate relationship.

10. The method of claim 8 , further comprising:

subsequent to altering the access rights of the second user, determine that the supervisor-subordinate relationship has been terminated; and

in response to termination of the supervisor-subordinate relationship, leaving the access rights of the second user to the network resource unchanged.

11. The method of claim 8 , wherein:

altering the access rights of the second user includes granting access to the network resource.

12. The method of claim 11 , further comprising

limiting granted access rights of the second user to a subset of the access rights possessed by the first user.

13. The method of claim 8 , further comprising:

identifying, based on the management information, which of a plurality of non-duplicated directory services databases is to be queried to obtain information indicating whether a requestor is an authorized network user.

14. The method of claim 8 , wherein the management information includes:

role information indicating roles assigned to the first user and the second user.

15. A system comprising:

a plurality of directory services databases;

a processing device including a processor and associated memory;

non-volatile storage configured to store management information including information identifying supervisor-subordinate relationships among users;

the processing device configured to:

receive a request from a first user, wherein the request includes a request to alter access rights of a second user to a network resource;

establish authorization of the first user to request access to the network resource based on information included in one or more of the plurality of directory services databases;

retrieve management information associated with the first user and the second user from the non-volatile storage;

determine whether a supervisor-subordinate relationship exists between the first user and the second user based on the management information associated with the first user and the second user; and

alter the access rights of the second user to the network resource at least partly in response to determining that the supervisor-subordinate relationship between the first user and the second user exists.

16. The system of claim 15 , wherein the processing device is further configured to:

subsequent to altering the access rights of the second user, determine that the supervisor-subordinate relationship has been terminated; and

reverting the access rights of the second user to a pre-altered state in response to termination of the supervisor-subordinate relationship.

17. The system of claim 15 , wherein the processing device is further configured to:

subsequent to altering the access rights of the second user, determine that the supervisor-subordinate relationship has been terminated; and

in response to termination of the supervisor-subordinate relationship, leave the access rights of the second user to the network resource unchanged.

18. The system of claim 15 , wherein:

altering the access rights of the second user includes granting access to the network resource.

19. The system of claim 18 , wherein

the processing device limits the access rights granted to the second user to a subset of access rights possessed by the first user.

20. The system of claim 15 , wherein the processing device is further configured to:

identify, based on the management information, which of a plurality of non-duplicated directory services databases is to be queried to obtain information indicating whether a requestor is an authorized network user.