LDAP Authentication Notifications for Accurate Inactive User Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
LDAP servers are unable to detect whether a user is inactive or active, leading to the risk of erroneous user disablement.
Innovation Solution
Implementing an LDAP server device that stores a first attribute value for the latest user login time and a second attribute value for the latest authentication time, receiving an authentication notification message to update the second attribute value, and sending a response message to an LDAP client device, enabling the LDAP server to track the latest successful authentication independently of the authentication process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If LDAP server only stores login time without authentication time, then the system structure remains simple, but the user status detection accuracy deteriorates
Solution Approach 1:
The patent segments the user status tracking into two distinct time attributes: login time (when user accesses network function) and authentication time (when user is verified by LDAP). This segmentation allows precise detection of user status by comparing these separate timestamps, resolving the contradiction between simple structure and accurate detection.
2Reliability
If LDAP server does not receive authentication notifications, then the communication protocol remains simple, but the reliability of user status tracking deteriorates
Solution Approach 1:
The patent implements a feedback mechanism where the network function sends an authentication notification message back to the LDAP server after successful user authentication. This feedback loop ensures the LDAP server reliably updates the authentication time attribute, resolving the contradiction between simple protocol and reliable tracking.
3Loss of information
If LDAP server updates authentication time independently, then the authentication process remains decoupled, but the loss of information about latest authentication deteriorates
Solution Approach 1:
The patent establishes preliminary action by having the LDAP server generate and store the authentication time attribute in advance within the user's attribute set. This pre-configured attribute structure ensures authentication time information is captured and preserved independently, resolving the contradiction between decoupled authentication and information preservation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A Lightweight Directory Access Protocol, LDAP, server device (130), an LDAP client device (120), a method, a computer program are disclosed. The LDAP server device (130) for storing a first attribute value corresponding to a latest registered time for user login to a network function device, and a second attribute value corresponding to a time when the user was latest authenticated, and is configured to: receive, from an LDAP client device, an authentication notification message after the user has been successfully authenticated, the authentication notification message indicating a successful authentication of the user and is performed by the network function device; and update the second attribute value to a value that corresponds to or is a time associated with the successful authentication of the user.