Method and system for access authorization involving group membership across a distributed directory

摘要

A system is presented for performing a directory operation within a distributed directory environment that includes distributed directory servers and a proxy server that acts as an intermediate agent between a client and the distributed directory environment. The proxy server sends requests to directory servers to collect information about group memberships for a user with respect to group entries within each portion of a distributed directory that is supported by each directory server. The proxy server sends the compiled information of group memberships for the user along with any directory operation that the proxy server requests on behalf of the user. A directory server receives the compiled information of group memberships along with a requested directory operation and then performs the requested directory operation with respect to its locally stored portion of the distributed directory information tree and with respect to the received information of group memberships for the user.