Directory Access Group Search via Partitioning and Path Compression
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large LDAP repositories with complex hierarchies face inefficiencies in searching for users and their ancestor groups, leading to increased LDAP queries, unpredictable recursion depth, and degraded user experience due to synchronization and timeout issues.
Innovation Solution
Implementing a directory service system that partitions user groups into disjoint subsets, applies path compression, and caches data representations to reduce query complexity and improve authorization efficiency by flattening the group structure and ranking nodes, allowing for faster role determination.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If recursive LDAP queries are performed to search for users and ancestor groups in large complex directories, then complete role information can be obtained, but the number of LDAP queries increases and search time becomes unpredictable
Solution Approach 1:
The system pre-computes and stores the transitive closure of group memberships (ancestor groups) for each user in a cache before authorization requests are made. This preliminary action eliminates the need for recursive LDAP queries during actual authorization, providing complete role information instantly without time-consuming searches.
Solution Approach 2:
The system anticipates future authorization requests by pre-loading group hierarchy data into memory cache. This cushioning mechanism ensures that when authorization requests arrive, the data is already available, preventing timeout issues and performance degradation that would occur with real-time recursive queries.
2Reliability
If recursive LDAP queries are performed to determine user roles, then accurate authorization can be achieved, but the recursion depth becomes unpredictable and may cause timeouts
Solution Approach 1:
The system pre-computes the complete ancestor group hierarchy for each user before authorization requests are made. By calculating the transitive closure of group memberships in advance and storing it in cache, the system eliminates unpredictable recursion depth during actual authorization operations, ensuring both accuracy and performance.
3Reliability
If LDAP exploration starts from the beginning every time without caching, then data freshness is maintained, but user experience degrades due to repeated searches
Solution Approach 1:
The system pre-computes and caches group hierarchy data in advance, making it immediately available for authorization requests. This preliminary computation eliminates the need to start LDAP exploration from the beginning each time, dramatically improving user experience while maintaining data accuracy.
Solution Approach 2:
The system creates copies of group hierarchy data and stores them in a cache structure. These cached copies allow rapid retrieval during authorization requests without querying the LDAP server, improving response time while the system periodically refreshes the cache to maintain data freshness.
4Reliability
If synchronous authorization processes are used to ensure accuracy, then role determination is complete, but system throughput decreases due to thread occupation
Solution Approach 1:
The system pre-computes authorization data and caches it before requests arrive. When authorization requests are made, the system retrieves pre-computed results from cache rather than performing synchronous LDAP queries, maintaining complete role determination while dramatically improving system throughput by eliminating thread occupation during data retrieval.
Data Source
AI summary
Methods and systems for searching directory access groups are disclosed. A set of groups associated with a logon user is determined. The set of groups is partitioned into one or more disjoint subsets, wherein each of the disjoint subsets is represented by a data representation including a root node and one or more intermediate nodes. For each of the disjoint subsets, the disjoint subset is path compressed to flatten a structure of the data representation representing the disjoint subset. The data representation is cached to a database cache.