[go: up one dir, main page]

WO2001089177A1 - Systeme de specification de domaine, destine a une entree aci d'un protocole simplifie d'acces annuaire - Google Patents

Systeme de specification de domaine, destine a une entree aci d'un protocole simplifie d'acces annuaire Download PDF

Info

Publication number
WO2001089177A1
WO2001089177A1 PCT/US2000/013710 US0013710W WO0189177A1 WO 2001089177 A1 WO2001089177 A1 WO 2001089177A1 US 0013710 W US0013710 W US 0013710W WO 0189177 A1 WO0189177 A1 WO 0189177A1
Authority
WO
WIPO (PCT)
Prior art keywords
access
control command
access control
attributes
resource
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/US2000/013710
Other languages
English (en)
Inventor
Terry N. Hayes
Prasanta Behera
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
New Aurora Corp
Original Assignee
Netscape Communications Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Netscape Communications Corp filed Critical Netscape Communications Corp
Priority to US10/276,586 priority Critical patent/US7124132B1/en
Priority to PCT/US2000/013710 priority patent/WO2001089177A1/fr
Priority to AU2000254413A priority patent/AU2000254413A1/en
Publication of WO2001089177A1 publication Critical patent/WO2001089177A1/fr
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4523—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using lightweight directory access protocol [LDAP]
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

  • the invention relates to accessing resources in a directory structure in a computer environment. More particularly, the invention relates to controlling access to resources within an LDAP directory structure in a computer environment.
  • a Lightweight Directory Access Protocol (LDAP) directory (such as Netscape Communications Corporation's Directory Server) is a collection of "entries.” Each entry has a name (called the Distinguished Name) and a list of attribute values. The entries in a directory are organized in a tree structure, with major groupings that are subdivided into smaller units. A directory might contain several organization entries, each of which contains several organizationalUnit entries. These entries can be further subdivided.
  • LDAP Lightweight Directory Access Protocol
  • LDAP provides search operations that can be performed over specified portions of the directory tree. Trees and subtrees, therefore, are a natural way to deal with data stored in an LDAP directory.
  • Entries and attributes correspond to a wide variety of data types such as personnel information, server configuration, business relationships, and user preferences. Since all entries contain important information, a method is required to restrict the availability of specific information to authorized users.
  • the Netscape Directory Server allows an ACI entry to be created which controls access to data stored in the directory tree.
  • the ACI entry contains rules to determine which users of the directory should be allowed to have access.
  • One of the components of the ACL rule is a description of which entries the rule applies to.
  • the entry is essentially a resource specification (e.g., data, printers, servers, etc.).
  • ACL Access Control Lists
  • the invention provides a domain specification system for an LDAP ACL rule.
  • the system allows a system administrator to specify and control access to directory resources by specifying the resource using an easily understood standardized format.
  • the invention provides a system that allows the system administrator to restrict a user's access to a single node or single level of nodes.
  • a preferred embodiment of the invention provides a system for specifying an ACI domain entry in an access control command line that controls access to a resource.
  • the access control command specifies resources using a Universal Resource Locator (URL) format.
  • URL Universal Resource Locator
  • the resource specification contains the name of the resource.
  • a target scope value specifies the scope of access to be granted to a user.
  • the scope can b e limited to a single entry, a subtree, or a single level.
  • a search filter is part of the resource specification.
  • the ACL applies only to entries in the subtree rooted at the resource name that match the filter.
  • a list of attributes is also contained in the resource specification and the ACL applies only to attributes in the resource that are named in the list.
  • the access control command specifies the type of access to be granted to a user which includes, but is not limited to: read, write, and any other privileges that the system supports.
  • the access control command also specifies the required user attributes or credentials for access to a resource.
  • the directory server matches the required attributes with the accessing user's attributes and grants the type of access listed only if the user has the required attributes.
  • Fig. 1 is a diagram of an LDAP directory structure according to the invention.
  • Fig. 2 is a block schematic diagram of an example of server interaction with user ACI rules and system resources according to the invention.
  • the invention is embodied in an domain specification system for an LDAP ACI entry in a computer environment.
  • a system according to the invention allows a system administrator to specify and control access to directory resources b y specifying the resource using an easily understood standardized format.
  • the invention provides a system that allows the system administrator to restrict a user's access to a single node or single level of nodes.
  • a Lightweight Directory Access Protocol (LDAP) directory (such as Netscape Communications Corporation's Directory Server) is a collection of "entries.” Each entry has a name (called the Distinguished Name) and a list of attribute values. The entries in a directory are organized in a tree structure, with major groupings that are subdivided into smaller units. A directory might contain several organization entries, each of which contains several organizationalUnit entries. These entries can be further subdivided.
  • LDAP Lightweight Directory Access Protocol
  • LDAP provides search operations that can be performed over specified portions of the directory tree. Trees and subtrees, therefore, are a natural way to deal with data stored in an LDAP directory.
  • Entries and attributes correspond to a wide, variety of data types such as personnel information, server configuration, business relationships, and user preferences. Since all entries are stored within a single directory, a method is required to restrict the availability of specific information to authorized users.
  • the Netscape Directory Server allows an ACI attribute to be created which controls access to data stored in the directory tree.
  • the ACI attribute contains rules to determine which users of the directory should be allowed to have access.
  • a simple LDAP directory structure is shown.
  • the directory structure contains a server subtree 102 and people subtree 103. Under each subtree are multiple related entries.
  • the method used to control access in an LDAP system is via Access Control Lists (ACL).
  • ACL Access Control Lists
  • the Directory Server Administrator (DSAdmin) creates basic ACL rules that grant specific users access to entries in the directory.
  • the ACI entry 106 in the user's entry 104 specifies resources that the user has access to b y using ACL syntax.
  • the name (Distinguished Name) of one of the LDAP entries The ACI rule will apply to all entries in the subtree rooted at the specified entry.
  • the DSAdmin had to specify each of the values in a command line. For example:
  • a preferred embodiment of the invention adds a value called Targetscope that allows the ACI to be restricted to a more specific range.
  • the ACI command line is also specified in an LDAP URL format, thereby standardizing the command line format.
  • One of the values BASE, SUB and ONE is specified. These values have the same meaning as defined for LDAP search operations (as specified by the Internet Engineering Task Force (IETF)) and define the scope of access (i.e., one entry, one level, or an entire subtree).
  • the ACI entry will be restricted to the same set of entries as would be considered in an LDAP search.
  • a preferred embodiment of the invention improves the specification of the domain by allowing the user to apply the ACI rules to a single entry, entries at the next level of the tree only, or the entire subtree. Previous approaches could specify only the entire subtree.
  • Various schemes for filtering the entries within the subtree have been used to approximate the results of the invention's targetscope method. However, none of the prior approaches can exactly match the invention's results.
  • the invention uses the LDAP Universal Resource Locator (URL) format to include all four components of the domain specification.
  • An LDAP URL specification looks like:
  • the invention improves over previous approaches by bringing the complete description of the domain Into a standard form which is already familiar to users.
  • the Server 202 checks the ACI rule 201 for the resource when the user attempts access to a resource 203. The condition attributes are checked against the current user. If the ACI specification 201 allows the user access, then the Server 202 grants access to the resource 203.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Health & Medical Sciences (AREA)
  • Databases & Information Systems (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Storage Device Security (AREA)

Abstract

Ce système de spécification de domaine, destiné à une entrée ACI (interface de communications asynchrones) d'un LDAP (protocole simplifié d'accès annuaire), constitue un système de spécification d'une entrée de domaine ACI dans une ligne de commande d'accès régulant l'accès à une ressource. Cette commande d'accès spécifie les ressources à l'aide d'un format d'adresse URL contenant le nom de la ressource. Une valeur de portée cible spécifie la portée de l'accès à accorder à un utilisateur, laquelle peut se limiter à une seule entrée, à un sous-arbre ou à un seul niveau, un filtre de recherche faisant partie de la spécification de ressource. L'ACI s'applique seulement aux entrées dans le sous-arbre enraciné au niveau du nom de ressource qui correspond au filtre. Une liste d'attributs est également contenue dans la spécification de ressource, l'ACI concernant seulement des attributs de la ressource qui sont nommés dans la liste. La commande d'accès spécifie le type d'accès à accorder à un utilisateur, ce type comprenant, sans y être cependant limité: refus, lecture, écriture et tout autre privilège que le système comporte. La commande d'accès spécifie également les attributs utilisateur requis pour l'accès à une ressource. Le serveur d'annuaires compare les attributs requis avec les attributs de l'utilisateur désirant l'accès, et accorde le type d'accès enregistré seulement si l'utilisateur possède les attributs requis.
PCT/US2000/013710 2000-05-17 2000-05-17 Systeme de specification de domaine, destine a une entree aci d'un protocole simplifie d'acces annuaire Ceased WO2001089177A1 (fr)

Priority Applications (3)

Application Number Priority Date Filing Date Title
US10/276,586 US7124132B1 (en) 2000-05-17 2000-05-17 Domain specification system for an LDAP ACI entry
PCT/US2000/013710 WO2001089177A1 (fr) 2000-05-17 2000-05-17 Systeme de specification de domaine, destine a une entree aci d'un protocole simplifie d'acces annuaire
AU2000254413A AU2000254413A1 (en) 2000-05-17 2000-05-17 Domain specification system for an ldap aci entry

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/US2000/013710 WO2001089177A1 (fr) 2000-05-17 2000-05-17 Systeme de specification de domaine, destine a une entree aci d'un protocole simplifie d'acces annuaire

Publications (1)

Publication Number Publication Date
WO2001089177A1 true WO2001089177A1 (fr) 2001-11-22

Family

ID=21741398

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2000/013710 Ceased WO2001089177A1 (fr) 2000-05-17 2000-05-17 Systeme de specification de domaine, destine a une entree aci d'un protocole simplifie d'acces annuaire

Country Status (2)

Country Link
AU (1) AU2000254413A1 (fr)
WO (1) WO2001089177A1 (fr)

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
"COMMAND LINE METHOD FOR MANAGING ACCESS CONTROL PROFILES FOR ALIASES", IBM TECHNICAL DISCLOSURE BULLETIN,IBM CORP. NEW YORK,US, vol. 38, no. 6, 1 June 1995 (1995-06-01), pages 513 - 514, XP000520755, ISSN: 0018-8689 *
ITU-T: "Information Technology - Open Systems Interconnection - The Directory: Models", ITU-T RECOMMENDATION X.501, November 1993 (1993-11-01), pages 1 - 153, XP002163461 *
NETSCAPE: "Netscape Directory Server, Version 3.0", ADMINISTRATOR'S GUIDE, December 1997 (1997-12-01), XP002123088 *

Also Published As

Publication number Publication date
AU2000254413A1 (en) 2001-11-26

Similar Documents

Publication Publication Date Title
US6535879B1 (en) Access control via properties system
US6633872B2 (en) Extendible access control for lightweight directory access protocol
Carter LDAP System Administration: Putting Directories to Work
EP1058873B1 (fr) Controle d'acces aux fichiers dans un serveur de fichiers a protocoles multiples
US5878415A (en) Controlling access to objects in a hierarchical database
US6256031B1 (en) Integration of physical and virtual namespace
US6768988B2 (en) Method and system for incorporating filtered roles in a directory system
EP2548138B1 (fr) Procédé et système informatiques pour bases de données relationnelles caractérisés par un contrôle d'accès basé sur les rôles
US7016893B2 (en) Method and system for sharing entry attributes in a directory server using class of service
US7020662B2 (en) Method and system for determining a directory entry's class of service based on the value of a specifier in the entry
US6785686B2 (en) Method and system for creating and utilizing managed roles in a directory system
US6240455B1 (en) Internet server providing link destination deletion, alteration, and addition
US7167918B2 (en) Macro-based access control
US7165182B2 (en) Multiple password policies in a directory server system
US6553368B2 (en) Network directory access mechanism
US6970873B2 (en) Configurable mechanism and abstract API model for directory operations
US8635221B2 (en) Method, system, and program product for managing access to data items in a database
JP2000047924A (ja) 管理オブジェクトへのユーザアクセス権に対応するアクセス権を特定する許諾表を用いて管理オブジェクト情報へのデータベースアクセスを限定する装置及び方法
US7194472B2 (en) Extending role scope in a directory server system
US20030078937A1 (en) Method and system for nesting roles in a directory system
EP1668437A1 (fr) Systeme, dispositif et procede pour gerer des attributs de securite de fichiers dans un systeme de stockage de fichiers informatiques
US7124132B1 (en) Domain specification system for an LDAP ACI entry
US6950819B1 (en) Simplified LDAP access control language system
US7363328B2 (en) Method and system for modifying schema definitions
US20030061347A1 (en) Method and system for determining a directory entry's class of service by pointing to a single template entry

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A1

Designated state(s): AL AM AT AU AZ BA BB BG BR BY CA CH CN CU CZ DE DK EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MD MG MK MN MW MX NO NZ PL PT RO RU SD SE SG SI SK SL TJ TM TR TT UA UG US UZ VN YU ZA ZW

AL Designated countries for regional patents

Kind code of ref document: A1

Designated state(s): GH GM KE LS MW SD SL SZ TZ UG ZW AM AZ BY KG KZ MD RU TJ TM AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE BF BJ CF CG CI CM GA GN GW ML MR NE SN TD TG

121 Ep: the epo has been informed by wipo that ep was designated in this application
REG Reference to national code

Ref country code: DE

Ref legal event code: 8642

WWE Wipo information: entry into national phase

Ref document number: 10276586

Country of ref document: US

DFPE Request for preliminary examination filed prior to expiration of 19th month from priority date (pct application filed before 20040101)
122 Ep: pct application non-entry in european phase
NENP Non-entry into the national phase

Ref country code: JP