Maintaining access control lists in non-identity-preserving replicated data repositories

1. A method of managing access control lists (ACLs) across replicated data repositories, the method comprising:

selecting, from a first data processing system, a controlled object and an ACL object bound to the controlled object, wherein the first data processing system is associated with a first user identity space;

creating, using a processor, a replicated version of the controlled object within a second data processing system associated with a second user identity space, wherein the second user identity space is different from the first user identity space;

creating, using the processor, a replicated version of the ACL object within the second data processing system; and

substituting, within the replicated version of the ACL object, an identity from the first user identity space with a selected identity from the second user identity space.

2. The method of claim 1 , wherein the identity is a user identity or a group identity of the first user identity space.

3. The method of claim 1 , wherein the selected identity is a user identity or a group identity of a user initiating the creating of the replicated version of the controlled object and the creating of the replicated version of the ACL object.

4. The method of claim 1 , wherein the first data processing system comprises a preserving replica data repository and the second data processing system comprises a non-preserving replica data repository, the method further comprising:

responsive to creating a new ACL object within the non-preserving replica data repository, generating a create operation log;

replaying the create operation log within the preserving replica data repository creating a replicated version of the new ACL object within the preserving data repository; and

in the preserving data repository, substituting an identity within the replicated version of the new ACL object of the second user identity space with an identity of a user of the first user identity space initiating the replaying.

5. The method of claim 1 , wherein the first data processing system comprises a preserving replica data repository and the second data processing system comprises a non-preserving replica data repository, the method further comprising:

responsive to modifying an ACL object within the non-preserving data repository, generating a modification operation log; and

sending the modification operation log to at least one other replica data repository without replaying the modification operation log at the at least one other replica data repository.

6. The method of claim 1 , wherein the first data processing system comprises a preserving replica data repository and the second data processing system comprises a non-preserving replica data repository, the method further comprising:

responsive to generating an element in the preserving replica data repository, generating a create element operation log;

replaying the create element operation log within the non-preserving replica data repository creating a replicated version of the element within the non-preserving replica data repository; and

in the non-preserving replica data repository, binding the replicated version of the element to a rolemap of a parent directory in which the replicated version of the element is created.

7. The method of claim 1 , wherein the first data processing system comprises a preserving replica data repository and the second data processing system comprises a non-preserving replica data repository, the method further comprising:

allowing modification of a role binding in a rolemap within the non-preserving replica data repository without the non-preserving replica data repository first acquiring mastership of the rolemap; and

disallowing modification of a role binding in a rolemap within the preserving replica data repository without the preserving replica data repository first acquiring mastership of the rolemap.

8. The method of claim 1 , wherein the first data processing system comprises a preserving replica data repository and the second data processing system comprises a non-preserving replica data repository, the method further comprising:

allowing a modification of a policy within the non-preserving replica data repository without the non-preserving replica data repository first acquiring mastership of the policy; and

disallowing modification of a policy within the preserving replica data repository without the preserving replica data repository first acquiring mastership of the policy.

9. The method of claim 1 , wherein the first data processing system comprises a preserving replica data repository and the second data processing system comprises a non-preserving replica data repository, the method further comprising:

allowing a modification of a binding between a controlled object and a rolemap within the non-preserving replica data repository without the non-preserving replica data repository first acquiring mastership of the controlled object; and

disallowing a modification of a binding between a controlled object and a rolemap within the preserving replica data repository without the preserving replica data repository first acquiring mastership of the controlled object.

10. The method of claim 1 , wherein the first data processing system comprises a preserving replica data repository and the second data processing system comprises a non-preserving replica data repository, the method further comprising:

disallowing an unbinding of a rolemap from a first policy and a subsequent binding of the rolemap to a second policy without the non-preserving replica data repository first acquiring mastership of the rolemap, the first policy, and the second policy.