JP4932291B2 - Access right control system - Google Patents

Description

  The present invention relates to a system using a directory service that centrally manages user information in a company and resources on a network.

In recent years, many applications such as personnel systems and accounting systems and file servers for sharing files have been built in the enterprise. Conventionally, information on users who use these applications and file servers has been individually managed, but there is a problem that management is complicated.
As a means for solving this problem, a directory service for centrally managing user information and resources on a network is becoming widespread. A protocol for accessing the directory service is also a standard called LDAP (Lightweight Directory Access Protocol).

Also, when controlling access rights to a folder or file on the file server, an ACL (Access Control List) is set for the folder or file. The ACL specifies what operations are permitted for users and groups managed by the directory service.
FIG. 14 shows an ACL setting example. In the directory service 1401, an A group 1402 and a B group 1405 are registered. C user 1403 and D user 1404 are added to A group 1402, and E user 1406 and F user 1407 are added to B group 1405. At this time, the “read” access right is designated for the folder A 1408 for the A group. Thereby, users who can refer to the folder 1408 can be limited to only the C user 1403 and the D user 1404 (see, for example, Patent Document 1).

Japanese Patent Laying-Open No. 2005-338935 (paragraph numbers 0008 to 0010, FIGS. 1 and 2)

Consider a case where ACL is set to control access rights to a file server in a company.
FIG. 1 shows an example of an organization hierarchy of a company. As shown in FIG. 1, a company 101 is at the top of the organization hierarchy, and a president 111 belongs to the organization. Under the company 101, there are a design department 102 and a sales department 105, and an A department manager 112 and a B department manager 117 belong to each organization. Further, under the design department 102, there are a design department first group 103 and a design department second group 104, each of which includes a section manager 113, a staff D 114, a section manager E 115, and a staff F 116. ing.

  FIG. 2 is a diagram showing the organizational hierarchy shown in FIG. 1 by directory service groups and users. As shown in FIG. 2, the organization shown in FIG. 1 is expressed as a group on the directory service. The organization hierarchy can be expressed as a group hierarchy. According to this, there is a company 201 at the top of the group hierarchy.

  On the other hand, considering ACL settings, there are many cases where it is desired that a person belonging to a higher organization can access files and folders managed by a lower organization because of the characteristics of resources in the company. Specifically, this is a case where the department manager A 112 or the president 111 wants to be able to access the files and folders managed by the design department first group 103 in FIG. 1 for reading. It is also possible to set access for writing.

  In order to realize this, an ACL as shown in FIG. 3 is set. FIG. 3 is a diagram showing an ACL for setting access rights for folders and files, and an ACL set so that users belonging to a higher organization can also access. That is, as shown in FIG. 3, it is necessary to specify three access rights for the folder 301: the design department first group access right 304, the manager A access right 303, and the president access right 302.

  There have been two problems with this designation method. One is that when setting an ACL, it is necessary to individually designate users belonging to a higher organization in consideration of the organizational hierarchy. In the example of FIG. 3, the access right 303 for the manager A and the access right 302 for the president must be individually set to ACL in consideration of the users belonging to the upper organization.

The other is that the ACL set for a resource such as a file server must be changed in synchronization with the change of the organization.
In a company, the information and organizational hierarchy of users belonging to an organization are frequently changed due to personnel changes, organizational changes, retirement, recruitment of new employees, and the like. Therefore, it is necessary to change the ACL set for the file or folder in synchronization with the change of the organization. In the example of FIG. 3, the ACL needs to be changed when the general manager of the design section changes.

  As described above, synchronizing ACLs set for files and folders with organizational changes is a very complicated task when the number of files is large. For this reason, an ACL change omission occurs, or a state in which the access right to the actual organization and the file does not match often occurs.

The present invention was devised to solve the above problem, and when the access right to the file server in the enterprise is controlled by the ACL, the user belonging to the higher organization can be accessed, and at the time of the organization change It is an object of the present invention to provide an access right control system that registers a group hierarchy in which an ACL change is unnecessary in a directory service database.

In order to achieve the above object, an access right control system according to the present invention includes:
And directory server with a de I directory service database, an access right control system including a management server in communication with the directory server using the LDAP,
The management server is
For each lower-level organization included in the organizational hierarchy that is configured as a hierarchy in which the lower organization belongs to the upper organization, a group hierarchy that is configured as a hierarchy in which the group corresponding to the upper organization belongs to the group corresponding to the lower organization is created. Group hierarchy registration means for registering the group hierarchy in the directory service database of the directory server ;
Access control list setting means for setting an access control list for specifying the access rights of each group included in the group hierarchy with respect to folders and / or files;
Access right control means for controlling access rights to the folder and / or file based on the group hierarchy registered in the directory service database of the directory server and the access control list set by the access control list setting means When,
It comprising: a.

According to the present invention, when controlling the access to the file server companies Gonai, a user belonging to the upper tissue accessible, and, a group hierarchy ACL change during tissue modification is not required in the directory service database It is possible to register and to display a tree by recursively processing a group hierarchy configured in the opposite direction to the organization hierarchy.

Hereinafter, an embodiment of an access right control system to which the present invention is applied will be described in detail with reference to the drawings.
FIG. 4 is a system configuration diagram showing an example of an embodiment of the present invention. As shown in FIG. 4, the access right control system 400 includes a directory server 403 including a directory service database (directory service DB) 405 and a management server 401 that accesses the directory server 403.

In addition, the management server 401 includes an organization hierarchy definition unit 402 that accesses the directory server 403 using LDAP and defines an organization hierarchy using a GUI (Graphical User Interface). The organization hierarchy definition unit 402 includes an organization hierarchy definition screen display unit 411, a GUI input unit 412, and a directory service registration unit 413.
In addition, the directory server 403 includes a directory service unit 404.

FIG. 5 is a specific example of the organization hierarchy definition screen 501 displayed by the organization hierarchy definition screen display unit 411 of the organization hierarchy definition unit 402 shown in FIG. The organization hierarchy definition screen 501 is a screen for registering a group hierarchy corresponding to the organization hierarchy in the directory service via the directory service registration unit 413 by defining the organization hierarchy via the GUI input unit 412.
As shown in FIG. 5, the organization hierarchy definition screen 501 includes a tree view 502 that displays an organization hierarchy, and a list view 503 that displays users and groups belonging to the organization 505 selected in the organization hierarchy. The display content of the list view 503 changes according to the organization selected in the tree view 502. In the example of FIG. 5, since the design unit 504 is selected in the tree view 502, the list view 503 belongs to the design unit first group 506, which is a subordinate organization of the design unit 504, and the design unit 504. A section manager 507 is displayed.

FIG. 6 is a diagram showing the relationship between the organization hierarchy displayed on the organization hierarchy definition screen and the group hierarchy defined in the directory service unit 404.
As shown in FIG. 6, in the organization hierarchy definition screen 601, a design unit 603 is defined as a subordinate organization of the company 602. Further, the design unit 603 defines a design unit first group 604 as a subordinate organization.

At this time, the directory service registration unit 413 of this system ( access right control system 400) defines a group hierarchy opposite to the organizational hierarchy in the management server 401 in the directory service 606. In other words, the design department first
The design unit 608 is defined as a group included in the group 607, and the company 609 is defined as a group included in the design unit 608. As a result, since the upper organization is a group hierarchy included in the lower organization, it is possible to access users belonging to the upper organization only by setting the ACL of the group representing the lower organization.

  FIG. 7 is a diagram showing the organization hierarchy definition screen after adding the design unit second group to the organization hierarchy. As shown in FIG. 7, the organization hierarchy definition screen 701 belongs to the design unit first group, the design unit second group, and the design unit 704, which are subordinate organizations of the design unit 704 shown in the tree view 702. The manager A is displayed in the list view 703.

  FIG. 8 is a diagram showing the group hierarchy on the directory service after adding the design unit second group to the organization hierarchy. As shown in FIG. 8, compared with FIG. 6, the design unit second group 804 is newly added, and the design unit 805 is further defined as a group included in the design unit second group 804. In FIG. 8, the design unit 802 and the design unit 805, and the company 803 and the company 806 indicate the same object. At this time, since the hierarchical relationship between the design departments (802, 805) and the company (803, 806) does not change, the company 806 is also indirectly included in the design department second group 804.

  FIG. 9 is a flowchart showing an overview of processing for creating a new organization in the organization hierarchy definition system. When a new organization is created on the organization hierarchy definition screen, as shown in FIG. 9, first, a group corresponding to the organization is created on the directory service (step 901). In the example shown in FIGS. 7 and 8, a group corresponding to the second design group is created on the directory service.

  Next, a group corresponding to the organization above the organization to be created is acquired (step 902). In the example shown in FIG. 7 and FIG. 8, the group corresponding to the design department which is a higher organization of the design department second group corresponds to this.

Next, the organizational hierarchical relationship is defined as a group hierarchical relationship. Specifically, a group corresponding to the higher organization is added to the member attribute of the newly created group (step 903). The member attribute is an attribute indicating an object belonging to a certain group on the directory service. In this system ( access right control system 400), a group hierarchy opposite to the organization hierarchy is created. It represents the upper organization of a certain organization.
In the example shown in FIG. 7 and FIG. 8, a group corresponding to the design unit is added to the member attribute of the design unit second group.

FIG. 10 is a flowchart showing an outline of processing for displaying an organization hierarchy from a group hierarchy stored in a directory service as a tree. As shown in FIG. 10, first, a group corresponding to the highest organization is acquired (step 1001). In the example shown in FIG. 8, companies (803 and 806) correspond to this.
Subsequently, the highest-level organization, that is, companies (803 and 806) are displayed in the tree view (step 1002). The process (step 1003) for displaying the organization under the company (803 and 806) is a recursive process shown in the flowchart shown in FIG.

  FIG. 11 is a flowchart showing an outline of processing for recursively displaying lower organization hierarchies. As shown in FIG. 11, first, the memberOf attribute of the target group is acquired (step 1101). The MemberOf attribute is an attribute indicating a group to which an object on the directory service belongs. However, since the group hierarchy created by this system is a tree opposite to the organization hierarchy (see FIG. 6), memberOf The attribute represents a subordinate organization of a certain organization.

Next, it is determined whether there is a memberOf attribute of the target group (step 1102). In the example of FIG. 8, since the group to which the company (803 and 806) belongs, that is, the design unit (802 and 805) is acquired, the process proceeds to the next step.
In the subsequent processing, the number of groups of the memberOf attribute is repeated (step 1103).
First, the memberOf attribute group is displayed as a subordinate organization of the target group (step 1104). In the example of FIG. 8, the design departments (802 and 805) are displayed as subordinate organizations of the company (803 and 806).

Next, the process is recursively repeated with the design units (802 and 805) as the target group.
That is, the memberOf attribute of the design unit (802 and 805) is acquired (step 1101).
Since the design units (802 and 805) belong to the design unit first group 801 and the design unit second group 804, the process proceeds to the next step.

The group of the memberOf attribute is displayed as a subordinate organization of the target group (step 1104). That is, the design unit first group 801 and the design unit second group 804 are displayed as subordinate organizations of the design unit (802 and 805).
Furthermore, the design unit first group 801 and the design unit second group 804 are used as target groups, and the process is recursively repeated, but each group does not belong to any group, that is, there is no memberOf attribute. The process ends.
Through the above steps, the organization hierarchy is displayed as a tree from the group hierarchy stored in the directory service.

FIG. 12 is a diagram showing groups and users registered on the directory service when the organizational hierarchy shown in FIG. 1 is defined in this system.
In FIG. 12, a group hierarchy opposite to the organizational hierarchy shown in FIG. 1 is configured. For example, the design units (1202 and 1205) are groups belonging to the design unit first group 1201 and the design unit second group 1204. The companies (1203, 1206, and 1208) are in a group to which the design department (1202 and 1205) and the sales department 1207 belong.

  FIG. 13 shows an example in which an ACL is set using the group shown in FIG. As shown in FIG. 13, in this example, the “read” access right 1302 is designated for the design group first group. When the ACL is set in this way, the folder 1301 can be accessed by four people: the president, the department manager A, the section manager C, and the employee D. That is, when setting the ACL, it is not necessary to be aware of the upper organizational hierarchy. Also, when the manager of the design department changes, it is only necessary to change the user belonging to the design department on the directory service side, and it is not necessary to change the ACL set in the folder.

As described above, the access right control system 400 according to the present embodiment has the following effects.
(1) By defining an organizational hierarchy using a GUI, a group hierarchy opposite to the organizational hierarchy can be registered in the directory service database.
(2) By setting the group registered in (1) in the ACL of the file or folder, users belonging to the higher organization can be automatically accessed. Further, when the organization is changed, it is only necessary to change the user belonging to the group on the directory service side, and it is not necessary to reset the ACL of the file or folder.

  The preferred embodiments have been described above. However, the present invention is not limited to the above-described embodiments, and appropriate modifications can be made without departing from the scope of the present invention. For example, although the protocol for accessing the directory service is LDAP, other protocols may be used. In addition, the organizational hierarchy is defined using the GUI, but other interfaces may be used.

It is the figure which showed the example of the organization hierarchy. It is the figure which represented the example of the organization hierarchy by the group and user of the directory service. It is the figure which showed the example of ACL set so that the user which belongs to a high-order organization could also access. 1 is a system configuration diagram showing an embodiment of the present invention. It is the figure which showed the example of the organization hierarchy definition part. It is the figure which showed the relationship between an organization hierarchy and a group hierarchy. It is the figure which showed the organization hierarchy definition screen after adding a design part 2nd group to an organization hierarchy. It is the figure which showed the group hierarchy on the directory service after adding a design part 2nd group to an organization hierarchy. It is a flowchart which shows the outline | summary of the process which creates a structure | tissue newly. It is a flowchart which shows the outline | summary of the process which displays an organization hierarchy. It is a flowchart which shows the outline | summary of the process which displays a lower organization hierarchy recursively. FIG. 2 is a diagram showing groups and users created when the organizational hierarchy shown in FIG. 1 is defined. It is the figure which showed the example which set the group created with this system to ACL. It is the figure which showed the example of a setting of ACL which concerns on a prior art example.

Explanation of symbols

101, 201, 602, 609, 803, 806, 1203, 1206, 1208 Company 102, 212, 504, 603, 608, 704, 802, 805, 1202, 1205
Design Department 103, 222, 506, 604, 607, 801, 1201 Design Department First Group 104, 223, 804, 1204 Design Department Second Group 105, 213, 702, 1207 Sales Department 111, 211 President 112, 221, 507 A department manager 113, 231 C manager 114, 232 D employee 115, 233 E manager 116, 234 F employee 224 B manager 301, 1301 Folder 302, 303, 304, 1302 Access right (read)
400 access right control system 401 management server 402 organization hierarchy definition unit 403 directory server 404 directory service unit 405 directory service database (directory service DB)
411 Organization hierarchy definition screen display unit 412 GUI input unit 413 Directory service registration unit 501, 601, 701 Organization hierarchy definition screen 502 Tree view 503, 703 List view 505 Organization 606 Directory service

Claims (3)

And directory server with a directory service database, an access right control system including a management server in communication with the directory server using the L DAP,
The management server is
For each lower-level organization included in the organizational hierarchy that is configured as a hierarchy in which the lower organization belongs to the upper organization, a group hierarchy that is configured as a hierarchy in which the group corresponding to the upper organization belongs to the group corresponding to the lower organization is created. Group hierarchy registration means for registering the group hierarchy in the directory service database of the directory server ;
Access control list setting means for setting an access control list for specifying the access rights of each group included in the group hierarchy with respect to folders and / or files;
Access right control means for controlling access rights to the folder and / or file based on the group hierarchy registered in the directory service database of the directory server and the access control list set by the access control list setting means When,
Access control systems that comprising: a. 2. The access right control system according to claim 1, wherein the group hierarchy registration unit creates the group hierarchy by adding a group corresponding to a higher organization to a member attribute of a group corresponding to a lower organization. The lowest group included in each group hierarchy registered in the directory service database of the directory server is acquired, the highest organization corresponding to the lowest group is displayed, and the memberOF attribute disappears in the displayed group. And further comprising: a tree display means for displaying the organization hierarchy as a tree by repeatedly adding and displaying the subordinate organization indicated by the memberOF attribute of the displayed group as a subordinate organization of the displayed group. Item 3. The access right control system according to Item 1 or 2.

Images