Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for storing, by a policy enforcement system, a plurality of policies and data associating a plurality of user credentials with the plurality of policies; receiving, from a client device, a request for data from a file system, the request further comprising user credentials; forwarding the request for data to a second node that stores the data from the file system; receiving, from the node, the data from the file system; selecting from the plurality of policies, based on the received user credentials and the data associating the plurality of user credentials with the plurality of policies, one or more policies that correspond to the received user credentials; filtering, by the policy enforcement system, the data from the file system based on the one or more policies; and sending the filtered data to the client device.

Abstract: A mechanism is disclosed for enabling an attribute provider service (APS), which provides access to one or more attributes, to control access to the attributes at the attribute level. In one implementation, a request is received, which specifies a particular attribute that is desired to be accessed from an attribute repository. In response to this request, a policy that applies to the particular attribute is accessed. The policy is then processed to determine whether access to the particular attribute is to be allowed or denied. With the above mechanism, it is possible to control access to attributes at the attribute level rather than at the service level. Because access control is exercised at such a low level, an administrator can exercise much tighter and precise control over how attributes provided by an APS are accessed.

Abstract: Methods and systems thereof for controlling access to resources are described. When a user attempts to access a resource via a remote interface such as a Web server, the request is initially evaluated by a source of policy definitions such as a policy server. This source returns a policy decision to the remote interface. The policy decision is stored in memory by the remote interface. The remote interface can then evaluate subsequent requests from the user for the resource using the stored policy decision instead of having to communicate again with the source for the policy decision. Enhancements to this approach are also described. Accordingly, policy definitions and decisions are more efficiently implemented.

Abstract: An architecture for allowing extensibility to policies. The architecture has a policy component program that is able to evaluate and enforce polices. The architecture also has plugin modules for allowing a user to customize the polices. The policy component program is able to present interfaces to the user for customizing the polices. The policy component program is further able to integrate customized polices into a framework of the policy component program in response to user input that is based on the interfaces presented to the user. The presented interfaces may be for defining subjects in the policy program, defining conditions in the policy program, defining referrals in the policy program, defining resource names in the policy program, and defining how conflicts will be resolved in the policy program. The interfaces may be compliant with the JAVA programming language.

Abstract: A computing device including a method of adding to a directory information tree involving the steps of accessing a template name, reading a template according to the accessed template name, the template including structural information of the directory information tree, receiving a first set of attributes from an application program, the received first set of attributes not including a location within the directory information tree, constructing an entry including the received first set of attributes, and a destination location within the directory information, the destination location generated using the structural information, and adding the constructed entry to the directory information tree at the destination location.

Abstract: Methods and systems thereof for managing resources are described. A list of resources is accessed. The names of the resources are compared so that relationships between the resources can be determined. For example, one resource can be identified as a sub-resource of another resource. The resources can then be represented in an organizational structure based on their relationships. The organizational structure can be readily traversed to locate a resource by name. Once the resource is located by name, a determination can be made as to whether the resource is subject to an access control policy.

Abstract: An architecture for allowing extensibility to policies. The architecture has a policy component program that is able to evaluate and enforce polices. The architecture also has plugin modules for allowing a user to customize the polices. The policy component program is able to present interfaces to the user for customizing the polices. The policy component program is further able to integrate customized polices into a framework of the policy component program in response to user input that is based on the interfaces presented to the user. The presented interfaces may be for defining subjects in the policy program, defining conditions in the policy program, defining referrals in the policy program, defining resource names in the policy program, and defining how conflicts will be resolved in the policy program. The interfaces may be compliant with the JAVA programming language.

Abstract: A method and system thereof for controlling access to resources. Access to a resource is controlled by a policy definition. A request for access to a resource is received at a first agent. The first agent is authorized to refer policy definitions to other agents. The policy definition for the resource is delegated to a second agent by the first agent using a referral policy. The referral policy includes identification of the resource and identification of the second agent. The second agent is the source of the policy definition that governs access to the resource. The request for access is forwarded to the second agent according to the referral policy. Based on the policy definition, a decision can be made regarding whether the request for access to the resource is granted. The decision can also indicate the actions that may be performed using the resource.

Abstract: A method providing an application computer program to be written independently of the structure of a directory information tree. The application program makes calls to an innovative API, the API accessing the structure of the directory information tree in an innovative template. If the structure of the directory information tree is changed, the template is changed, but the application is not changed.