Directory Service Group Membership Change Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing identity management (IdM) systems face inefficiencies in monitoring access authority changes in Active Directory, particularly in detecting security group changes, as current methods are computationally inefficient or do not accurately report group membership updates, leading to significant performance overhead and failure to detect user access authority changes.
Innovation Solution
A domain crawler process within the IdM system queries and consolidates event logs from multiple domain controllers to generate a group change list, sending update notifications of changed group access authority to the identity manager server, thereby efficiently detecting and reporting security group changes without additional data lookups or significant overhead on domain controllers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If LDAP change notification with Sub Tree scope is used to monitor Active Directory changes, then comprehensive change detection is achieved, but server performance is severely impacted due to generating LDAP search result messages for every object modification
Solution Approach 1:
The patent segments the monitoring approach by creating separate notification mechanisms for different types of changes. Instead of using Sub Tree scope that monitors all objects, the system uses targeted LDAP notifications with specific base DN filters to monitor only relevant objects (user accounts and groups), thereby reducing the notification overhead while maintaining detection accuracy for access authority changes.
Solution Approach 2:
The patent applies local quality by making the notification scope adaptive rather than uniform. The system dynamically determines the appropriate base DN and search scope based on the specific monitoring requirements for each user account and group combination. This allows the system to focus computational resources only on relevant changes rather than generating notifications for all domain objects.
2Productivity
If DirSync search control is used to reduce notification overhead, then server performance is improved, but detection of user access authority changes (group membership changes) is not achieved
Solution Approach 1:
The patent implements a dynamic monitoring approach where the system actively tracks both user objects and group objects simultaneously. When a group membership change occurs, the system receives notifications for both the user object (via user-specific LDAP notifications) and the group object (via group-specific LDAP notifications), allowing it to detect access authority changes even though DirSync alone would miss them.
Solution Approach 2:
The patent employs feedback mechanisms by cross-referencing multiple notification sources. The system maintains a cache of group membership information and compares received notifications against this cache to detect actual membership changes. This feedback loop ensures that access authority changes are detected even when individual notification sources might miss them.
3Measurement precision
If full group member list comparison is performed to detect membership changes, then accurate change detection is achieved, but computational overhead increases significantly due to potentially millions of member entries to compare
Solution Approach 1:
The patent extracts only the necessary information for change detection by using LDAP notifications that specifically report membership changes. Instead of retrieving and comparing entire group member lists, the system subscribes to LDAP notifications that are triggered only when membership changes occur. This extracts the essential change information without the computational burden of processing complete member lists.
Solution Approach 2:
The patent applies partial action by monitoring only the specific attributes and objects relevant to access authority changes. Rather than performing exhaustive comparisons of all group members, the system uses targeted LDAP filters and notifications to detect only the membership changes that affect user access authority, performing just enough monitoring to achieve the security objective.
Data Source
AI summary
An identity management system provides for a computationally efficient approach to monitor group changes, or events, on a directory service. Group events are monitored by use of a domain crawler process launched by an event monitoring process of the identity management system that gathers group event data and reports the collected and consolidated changes to the identity management system.