LDAP Directory Identity Data Integration Without Schema Extensions

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

LDAP servers face challenges in maintaining identity data for complex networks without altering their default schema, which is disruptive and requires high administrative privileges, especially when integrating multiple zones with different user and group records.

Innovation Solution

The solution involves creating global user and group records that can coexist with zone records, using dynamically linked auxiliary classes like posixAccount and posixGroup, allowing zone records to masquerade as posixAccount or posixGroup records without modifying the schema, enabling interoperability with RFC2307-compliant clients.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If schema extensions are used to maintain multiple sets of identity data for different zones, then the system can support complex network identity requirements, but the schema modification becomes disruptive and requires high administrative privileges

Engineering Contradiction:

Improveability to maintain multiple identity data setsVSAvoidschema modification complexity

Core Design Contradiction:

Adaptability or versatilityVSEase of operation

Solution Approach 1:

The patent introduces an intermediary mechanism that allows zone records to be associated with global records through a bridging attribute (such as a distinguishedName attribute in the zone record that references the global record). This intermediary association enables the system to maintain multiple identity data sets without requiring schema extensions, as it uses existing LDAP attributes to create the linkage between global and zone-level identities.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent segments identity data into two distinct levels: global identity records that contain universal identity information, and zone-specific records that contain localized identity information. This segmentation allows each level to be managed independently without requiring modifications to the overall schema, as the association between levels is established through standard LDAP referencing mechanisms rather than schema extensions.

Inventive Principle:

Principle #1Segmentation

2Reliability

If the default LDAP schema is modified to support zone records, then interoperability with RFC2307 clients is maintained, but administrative overhead and disruption increase

Engineering Contradiction:

Improveinteroperability with RFC2307 clientsVSAvoidadministrative overhead

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent makes existing LDAP record types multi-functional by enabling them to serve both as global records and as zone-specific records depending on the context and associated attributes. For example, standard user and group record types are used for both global identity representation and zone-specific identity representation, eliminating the need for separate schema definitions while maintaining RFC2307 client interoperability.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The patent changes the interpretation and usage of existing LDAP record parameters rather than creating new parameters. By modifying how existing attributes are utilized and associated (such as using the distinguishedName attribute for cross-referencing between global and zone records), the system achieves zone record functionality without schema modifications, thereby maintaining compatibility with RFC2307 clients while reducing administrative overhead.

Inventive Principle:

Principle #35Parameter changes

3Adaptability or versatility

If separate zone records are created for each user and group, then zone-specific identity data is preserved, but the system complexity increases

Engineering Contradiction:

Improvezone-specific identity data preservationVSAvoidrecord management complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent implements a nested structure where zone records are logically nested within or associated with global records through attribute references. Each zone record contains or references the distinguishedName of its corresponding global record, creating a hierarchical relationship without requiring physical nesting in the LDAP tree structure. This allows zone-specific identity data to be preserved while managing complexity through clear parent-child relationships that can be traversed efficiently.

Inventive Principle:

Principle #7Nested doll (Nesting)

Data Source

PatentUS9965496B2Method and apparatus for creating compliant zone records in an LDAP directory without schema extensions

Publication Date: 2018.05.08 DELINEA INC

AI summary

A global user record that can be found in a search for posixAccount-type records is created in a database, then a zone user record of a type that cannot be found in a search for posixAccount-type records is associated with it. Finally, the zone user record is augmented so that it, too, will be found in a search for posixAccount-type records. Global and zone-specific group records are created similarly.