Directory Service Group Membership Resolution

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Directory services face challenges in recursively resolving group memberships across multiple domains, especially during organizational mergers or acquisitions, requiring manual examination of records for tens of thousands of users to ensure correct resource assignment and permissions.

Innovation Solution

Implementing recursive LDAP queries that allow directory services to query multiple vendors' systems, enabling the identification of group members across heterogeneous environments and facilitating enterprise management applications to manage users and resources across different directory services.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If directory services store information across multiple domains with nested group structures, then the scope and coverage of directory services is improved, but the ability to recursively resolve group memberships deteriorates

Engineering Contradiction:

Improvescope of directory servicesVSAvoidcomplexity of resolving group memberships

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent segments the complex task of resolving group memberships into iterative steps. The system divides the problem by processing one domain at a time, extracting group membership information from each domain separately, and progressively building the complete resolution across multiple domains through repeated cycles of querying and processing.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent performs preliminary actions by first identifying all groups that need to be resolved before attempting to resolve their memberships. The system pre-processes the directory structure to map out all relevant groups across domains, then systematically resolves each group's membership in subsequent iterative steps, ensuring comprehensive coverage.

Inventive Principle:

Principle #10Preliminary action

2Measurement precision

If directory services identify individual members of groups across multiple domains, then the measurement precision of group membership identification is improved, but the loss of time for resolving memberships increases

Engineering Contradiction:

Improveprecision of group membership identificationVSAvoidtime to resolve group memberships

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent maintains continuity of useful action by implementing an iterative process that continuously queries directory services and processes group membership information without interruption. The system repeatedly cycles through domains, extracting and resolving group memberships in a continuous workflow that maximizes efficiency while ensuring complete resolution across all domains.

Inventive Principle:

Principle #20Continuity of useful action

Solution Approach 2:

The patent performs preliminary identification of all groups requiring resolution before executing the time-consuming resolution process. By pre-mapping the directory structure and identifying all relevant groups across domains in advance, the system minimizes the time required for the actual resolution process while ensuring no groups are missed.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If manual examination of records is performed for tens of thousands of users, then the reliability of resource assignment is improved, but the productivity of the process deteriorates

Engineering Contradiction:

Improveaccuracy of resource assignmentVSAvoidspeed of processing user records

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent implements self-service by enabling the directory service system to automatically resolve group memberships across multiple domains without requiring manual intervention. The system autonomously queries directory services, processes group membership information, and resolves memberships for tens of thousands of users through automated iterative processing, ensuring both accuracy and efficiency.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent replaces the mechanical manual examination process with an automated computational system. Instead of manually reviewing records, the system uses automated queries and processing algorithms to resolve group memberships across domains, substituting human labor with machine-based automation that maintains reliability while dramatically improving productivity.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS11586651B2Multiple domain directory integration

Publication Date: 2023.02.21 OMNISSA LLC

AI summary

Disclosed are various examples of integrating multiple domains within a directory service. A computing device retrieves a first list of members in a first group of users for the domain from a first directory service for a first domain. The computing device then determines that a second group of users is a member of the first group of users, wherein the second group of users corresponds to a second domain. The computing device then retrieves a second list of members in the second group of users from a second directory service for a second domain. The computing device subsequently compares the first list of members in the first group of users and the second list of members in the second group of users with a third list of members in a third group of users, wherein the third list of members in the third group of users corresponds to a user list maintained by the application. The computing device then adds to the third list of members in the third group of users each user that is both present in the first list of members in the first group of users or in the second list of members in the second group of users and missing from the third list of members in the third group of users.