JP2008117052A - Management authority setting system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a user management system for transferring the authority of managing a subordinate user/group to a user of a higher order organization in user management in consideration of the organization by using a directory service, without changing ACL corresponding to network resources when assignment change occurs, nor changing a manager authority for an OU. <P>SOLUTION: This management authority setting system is configured of a directory server equipped with a directory service database and a management server for communicating with the directory server based on a communication protocol such as an LDAP. The management server registers an OU 702 and a group 705 for every organization as a pair 711 in the directory database in registering the organizations by a GUI. Also, an ACL(Access Control List) is automatically set in the OU 702 for managing the user/group by the group belonging to the higher layer, and the group 705 of the higher layer is registered as the member of a group 703 of the lower layer. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a management authority setting system, and more particularly to a management authority setting system using a directory service for managing users and network resources in a batch.

  Along with the development of computer systems, a large number of various file systems and file servers that share files have been built, and a plurality of users can easily access the system and files. Conventionally, user information using these resources has been individually managed for each system, but there is a problem that management becomes complicated due to the distribution of user information.

  Therefore, as a means for solving this problem, a directory service that integrates management of users and network resources is becoming widespread. By using the directory service to collectively manage the user's access authority to the network assets, the user can access any system in the network with a consistent authority.

  FIG. 1 is a diagram showing an example of user management in the above directory service. In the directory service 101, for example, a group A102 and a group B103 are registered. In group A102, user C104 and user D105 are registered, and in group B103, user E106 and user F107 are registered.

  Here, by setting the “read” authority for the A group to the folder 108, the user C 104 and the user D 105 are allowed to read the folder 108 (indicated by a circle), and the reading from the user E 106 and the user F 107 is suppressed. (Indicated by a cross).

The following patent documents are listed as technical documents related to access authority.
JP 2005-338935 A JP-A-8-50559 JP 2002-342352 A

  Consider a case in which user management in a company is managed using a directory service. FIG. 2 is a diagram illustrating an example in which an organization hierarchy of a company is expressed by a directory service. In FIG. 2, department A 205 belongs to department 202, manager B 206 belongs to section 203, and employee C 207 and employee D 208 belong to unit 204. Further, the directory service 201 includes an administrator 209 having management authority (administrative authority) for managing user information of the directory service 201.

  Here, let us consider a case where a change to user information on the directory service occurs due to an employee change or the like. FIG. 3 is a diagram showing whether or not user information can be added when the employee E310 is added to the unit 304 in addition to the employee C and the employee D on the directory service 301.

  Since the unit 304 is under the control of the department 302 and the section 303 in terms of organization, it is desirable that the department manager A 305 or the section manager B 306 can perform the additional work of the employee E 310 on the unit 304. However, the manager A 305 and the manager B 306 are also treated as general users on the directory service 301, and therefore do not have the authority to change the unit 304. In order to perform the change processing for the unit 304, it is necessary to acquire the same management authority as that of the administrator 309. However, if the management authority is given, not only the unit 304 but also a wide group including the section 303 and the section 302 are changed. Since the authority is given, the authority should not be set as much as possible other than the administrator 309 as the specific administrator. Therefore, for example, when changing information managed by the directory service, such as changing the employee's affiliation change email address, regardless of the size, the administrator 309 who has management authority must execute it. Must respond to various user information change requests that occur in each department, which increases the workload and makes it difficult for each department to respond flexibly to user management. There is a risk of causing a restriction on security or a reduction in security level.

  On the other hand, regarding the ACL (Access Control List) setting for network resources, an organization hierarchy definition system has been proposed that does not require resetting of ACLs set for network resources even when employee affiliation changes occur. . FIG. 4 is a diagram showing an example thereof. The organization hierarchy 401 of a company generally has an organization of a section 403, a section 404, and a unit 405. By setting each organization as a group hierarchy opposite to the organizational hierarchy as shown in the directory service 402, a tree of units 406, sections 407, and units 408, and setting the group shown in the directory service 402 as an ACL for network resources Therefore, it is possible to eliminate the need to reset the ACL by changing the affiliation within the group, and to allow the user belonging to the upper group to have the access authority for the resource to which the lower group has the access authority. However, even in this method, as an actual work, a user / group change work on the directory service is required, and the same is true that an administrator having management authority needs to perform the work.

  By the way, there is an organizational unit (OU) as a method for delegating user / group management authority. For the OU, the management authority of the user / group under the OU can be delegated to a user / group other than the administrator.

  However, since the OU cannot be set in the ACL, when the group of the organizational hierarchy is simply changed to the OU, the access right to the network resource is designated for each user, and the significance of performing hierarchical management for each department Will disappear. In addition, as an OU administrator, the user must be set individually in consideration of users belonging to a higher organization. In addition, if you want to set management authority for each user in the upper hierarchy that goes back to the organizational hierarchy, it is necessary to delegate management authority that is conscious of the organizational hierarchy, and it is also necessary to change the setting of OU management authority when changing affiliation Occurs.

  An object of the present invention is to perform user management in consideration of an organizational structure using a directory service, without changing the ACL for network resources even when a change in affiliation occurs, and for the administrator authority for the OU. The object is to provide a user management system that does not require any changes. It is another object of the present invention to allow subordinate organization user / group management authority to be delegated to a user in a higher organization.

  According to one aspect of the present invention, there is provided a management authority setting system having a directory server having a directory service database and a management server communicating with the directory server, wherein the management server defines an organizational hierarchy. In addition, in the directory service database, a combination of an organizational unit (OU) corresponding to the organizational hierarchy and a hierarchical level in which management authority can be set and a group belonging to the OU is determined by a user operation or automatically. A management authority setting system characterized by being generated is provided. Note that, as a communication protocol between the directory server and the management server, generally, LDAP (Lightweight Directory Access Protocol) is used.

  In the above system, the organizational unit OU and the group are associated with each other so that the management authority (administrative authority) for managing user information can be granted, for example, in units of hierarchy.

  For the OU, the management authority of the user / group under the OU can be delegated to a user / group other than the administrator. Since whether or not to grant authority is determined for each group, authority can be given to any OU.

  Furthermore, it is preferable to have means for registering a group hierarchy opposite to the organizational hierarchy in the directory service database.

  According to another aspect of the present invention, there is provided a management authority setting method in a management authority setting system including a directory server having a directory service database and a management server that communicates with the directory server using a communication protocol such as LDAP. The step of defining an organization hierarchy, which is a step of registering group / user information in the directory service, a step of displaying a tree view displaying the organization hierarchy on the display screen, and any of the organizations displayed in the tree view When the subordinate organization belonging to the selected organization is defined, the organizational unit (OU) hierarchy corresponding to the organizational hierarchy and the group belonging to the OU are combined for each defined organization. And creating an authority in the organizational unit. Administrative authority setting wherein the door is provided.

  When the tree view display is performed, one organization in the tree view display is selected, and a unit belonging to the selected organization is displayed in the list view. A group of unit and unit is newly created, a group of the higher organization is created under the OU of the selected organization, an ACL of the lower OU is given to the upper group, And adding a higher group to the members of the group.

  Through the above processing, the department group is registered as a member of the section group, so that management authority can be set for the section from the department.

According to the present invention, the following effects can be obtained.
(1) Organization users / groups can be managed not only by an administrator having management authority, but also by users in a higher hierarchy that goes back up the organization hierarchy.
(2) Even when an affiliation change occurs in a user of a higher hierarchy, there is no need to change the administrator authority for the OU, and the user / group management work for the lower organization is started immediately after the change work on the directory service is completed. be able to.

  Hereinafter, a management authority grant system according to an embodiment of the present invention will be described with reference to the drawings.

  FIG. 5 is a diagram showing a configuration example of the management authority setting system according to the embodiment of the present invention. The organization hierarchy definition system shown in FIG. 5 includes a directory service database 505, a directory server 502 including a directory service unit 504, and a management server 501 that communicates with the directory server 502 using a communication protocol such as LDAP. Configured. The management server 501 also includes an organization hierarchy definition unit 503 that defines an organization hierarchy using a GUI.

  FIG. 6 is a diagram showing a display example as a specific definition example of the organization hierarchy in the organization hierarchy definition unit 503 shown in FIG. In the organization hierarchy definition screen 601 shown in FIG. 6, group / user information corresponding to the organization hierarchy can be registered in the directory service by defining the organization hierarchy with the GUI. An organization hierarchy definition screen 601 shown in FIG. 6 includes a tree view unit 602 that displays an organization hierarchy, and a list view unit 603 that displays users and groups belonging to the organization selected in the tree view unit 602. The display example shown in FIG. 6 shows a state in which the section 604 is selected in the tree view unit 602, and in response to this, the list view unit 603 displays the section manager 605 belonging to the selected section 604 and the first unit. 606 is displayed. Although not shown, in this state, for example, based on the user's operation, in addition to the section manager 605, the corresponding organizational unit (OU) is registered so as to have a corresponding relationship with the group called the section manager. Yes.

  For example, it is assumed that the designer adds a new unit (second unit 607) to the list view unit 603 using the GUI in accordance with the organizational change. Then, the 2nd unit 607 and OU matched with it are created automatically or by arbitrary selection operation of a user. The fact that an OU is attached means that management authority can be granted. Therefore, an arbitrary group can be created by arbitrarily adding an OU to each group such as a department, section, or unit. It can be in a state where management authority can be given to.

  FIG. 7 is a diagram showing a setting example of the directory service for the organization hierarchy example shown in FIG. In the setting example 701 shown in FIG. 7, a set 711, 712, 713, 714 in which OUs 702, 703, 704, 708 and groups 705, 706, 707, 709 are set is set in the directory service for each organization. . In FIG. 7, the ACL of OUs 702, 703, 704, and 708 is assigned to the upper organization group, that is, the first group OU 704 and the second unit OU 708, the section group 706 that is one layer higher has management authority. (Refer to the broken line arrow), see the broken line arrow in which the department group 705 one level higher than the section OU 703 has management authority). With such a configuration, a user belonging to the department group 705 can manage users / groups belonging to the section OU703. Further, there is an advantage that the user belonging to the section group 706 can manage the user / group belonging to the unit OU704.

  However, in the example shown in FIG. 7, since the group 705 does not have management authority for the unit OU 704, management of users / groups belonging to the unit OU 704 cannot be performed.

  Therefore, the group for each OU is made a group hierarchy opposite to the organizational hierarchy. FIG. 8 is a diagram showing the hierarchy of the group in FIG. In FIG. 8, the department group 807 is registered as a member of the section group 806. As a result, the department group 807 can inherit the user / group management authority of the unit OU802 of the section group 806. In addition, as shown in FIG. 8, by registering users for groups belonging to these OUs, it is possible to quickly start user / group management work for subordinate organizations by changing users within the group. There is.

  FIG. 9 is a flowchart showing an outline of the processing of the organization hierarchy definition unit. FIG. 10 is a flowchart showing the flow of processing accompanying addition of a unit as described above.

  As shown in FIG. 9, the process is started, and in step S901, a tree view for displaying the organization hierarchy is displayed on the display screen. In step S902, one of the organizations displayed in the tree view is selected. In step S903, a new organization is registered in the selected organization. In step S904, users (for example, section managers) and units belonging to the organization selected in the tree view are displayed in the tree view.

  As shown in FIG. 10, when registering a new organization in step S903, for example, in step S1001, a unit is added to the list view while a section in the tree view display is selected. In step S1002, a unit OU is created with the addition of a unit. In step S1003, a unit group is created and assigned to the unit OU. In step S1004, the management authority is set for the section group as the ACL of the unit OU. In step S1005, the section group is added to the members of the unit group. By performing the same process when adding a section before adding a unit, the department group is registered as a member of the department group. Therefore, the department group has a section management authority. The group authority is inherited, and the management authority can be transferred from the unit to the section and department.

  As described above, in the management authority setting system according to the present embodiment, (1) even when a change in affiliation occurs in a higher-level user, there is no need to change the administrator authority for the OU, and the directory service can The user / group management work for the subordinate organization can be started immediately after the change work is completed. (2) There is an advantage that management of users / groups of an organization can be carried out not only by an administrator having management authority but also by a user of a higher hierarchy that goes back up the organization hierarchy. Therefore, even if there are many organizations and the organization is frequently changed, it is not necessary to place a burden on only one administrator, and settings relating to the granting of management authority can be made in detail and easily. .

  The present invention may be in the form of a program capable of executing each step according to the present embodiment by a computer.

  The present invention can be used as a management authority grant system in an organization.

It is the figure which showed the user management example in a general directory service. It is a figure which shows an example which expressed the organization hierarchy of the company by the directory service. It is a figure showing the problem by addition of user information. It is a figure which shows an example of the organization hierarchy definition system which does not require resetting of ACL also by affiliation change. It is a figure which shows the example of 1 structure of the management authority setting system by one embodiment of this invention. It is a figure which shows the example of a display of an organization hierarchy definition part. It is the figure which showed the example of a directory service setting when the organization hierarchy is defined by the management authority setting system by this Embodiment. It is the figure which showed the example of a setting of the directory service for tracing back user / group management authority to a high-order organization. It is a flowchart figure which shows the outline of the process in an organization hierarchy definition part. It is a flowchart figure which shows the flow of the process accompanying the addition of the above units.

Claims (4)

A management authority setting system comprising a directory server provided with a directory service database and a management server communicating with the directory server,
When defining the organizational hierarchy, the management server includes organizational units (OUs) corresponding to the organizational hierarchy in the directory service database that can be set with administrative authority and groups belonging to the OU. A management authority setting system in which a pair is generated by a user operation or automatically.   The management authority setting system according to claim 1, further comprising means for registering a group hierarchy opposite to the organization hierarchy in the directory service database. A management authority setting method in a management authority setting system, comprising: a directory server provided with a directory service database; and a management server that communicates with the directory server,
One of the steps of defining the organization hierarchy, registering group / user information in the directory service, displaying a tree view displaying the organization hierarchy on the display screen, and the organization displayed in the tree view A step of selecting
When defining a subordinate organization belonging to the selected organization, for each defined organization, creating a group of organizational units (OU) corresponding to the organizational hierarchy and a group belonging to the OU;
Setting authority in the organizational unit;
A management authority setting method characterized by comprising: When the tree view display is performed, one organization in the tree view display is selected, and a unit belonging to the selected organization is displayed in the list view. Creating a new group pair with the group of units and creating a group of higher-level organizations under the OU of the selected organization;
4. The management authority setting method according to claim 3, further comprising: a step of giving an ACL of a lower OU to the upper group, and a step of adding the upper group to members of the lower group.

Images