Abstract: A network computer maintains a directory of objects having multi-valued attributes. The attributes are comprised of individual linked values having conflict-resolution data that indicates a change to an object at an attribute-value level. A second network computer stores a replica of the directory in which a replica of the objects is maintained. The computers replicate the objects in the directories and update the individual linked values of the attributes. Replication conflicts are identified and resolved with the conflict-resolution data at the attribute-value level of the objects.

Abstract: A new schema implementation enables reversible changes to be made to definitions in a schema. The definitions of attributes and classes are in the form of schema objects. Each schema object has an internal ID in addition to its unique name and object ID (DID), and a deactivation flag for indicating whether the schema object has been deactivated. To modify an attribute or class, the corresponding schema object is deactivated by setting its deactivation flag to “TRUE,” and a new schema object is created to contain the changes. The new schema object has the same unique name and DID as the old schema object but is given a different internal ID. When a client wants to access instances of the schema object by its unique name or DID, a translation is made to provide the internal ID of the new schema object such that instances of the new schema object are located instead of the old schema object.

Abstract: A system and method for managing the creation of objects in a distributed directory service system assigns quotas to entities (such as users, computers, groups) to limit the number of objects each entity is allowed to create and own. For purposes of enforcing the quotas, tombstones generated for deleted objects are taken into account in the calculation of a weighted total number of objects owned by an entity, with each tombstone counted as a configurable fraction of a regular object. When an entity requests a directory operation that will increase the number of objects owned by that entity, the number of system objects owned by that entity is added to the number of tombstones multiplied by the fractional tombstone factor to generate the weighted total, which is compared to the quota of that entity to determine when the requested operation should be performed.

Abstract: A system and method for managing the creation of objects in a distributed directory service system assigns quotas to entities (such as users, computers, groups) to limit the number of objects each entity is allowed to create and own. For purposes of enforcing the quotas, tombstones generated for deleted objects are taken into account in the calculation of a weighted total number of objects owned by an entity, with each tombstone counted as a configurable fraction of a regular object. When an entity requests a directory operation that will increase the number of objects owned by that entity, the number of system objects owned by that entity is added to the number of tombstones multiplied by the fractional tombstone factor to generate the weighted total, which is compared to the quota of that entity to determine when the requested operation should be performed.

Abstract: Described is an invention for safeguarding against the modification of certain data associated with one domain of a distributed network by an entity (such as an administrator) within another domain of the distributed network while still allowing the entity to modify other data associated with the one domain. More particularly, security safeguards are applied by a directory replication service that operates to replicate the shared data to each domain in a domain “forest.” Those security safeguards allow a user to indicate that certain modifications of specified shared data may only be made within the domain in which the shared data was created. In that way, a shared data namespace may still be implemented in which trust relationships exist so that, for example, an administrator in one domain may alter a configuration of another domain within the forest. However, certain data may be restricted by these safeguards such that certain modifications of that data (e.g.

Abstract: A network computer maintains a directory of objects having multi-valued attributes. The attributes are comprised of individual linked values having conflict-resolution data that indicates a change to an object at an attribute-value level. A second network computer stores a replica of the directory in which a replica of the objects is maintained. The computers replicate the objects in the directories and update the individual linked values of the attributes. Replication conflicts are identified and resolved with the conflict-resolution data at the attribute-value level of the objects.

Abstract: A new schema implementation enables reversible changes to be made to definitions in a schema. The definitions of attributes and classes are in the form of schema objects. Each schema object has an internal ID in addition to its unique name and object ID (OID), and a deactivation flag for indicating whether the schema object has been deactivated. To modify an attribute or class, the corresponding schema object is deactivated by setting its deactivation flag to “TRUE,” and a new schema object is created to contain the changes. The new schema object has the same unique name and OID as the old schema object but is given a different internal ID. When a client wants to access instances of the schema object by its unique name or OID, a translation is made to provide the internal ID of the new schema object such that instances of the new schema object are located instead of the old schema object.

Abstract: A new schema implementation enables reversible changes to be made to definitions in a schema. The definitions of attributes and classes are in the form of schema objects. Each schema object has an internal ID in addition to its unique name and object ID (OID), and a deactivation flag for indicating whether the schema object has been deactivated. To modify an attribute or class, the corresponding schema object is deactivated by setting its deactivation flag to “TRUE,” and a new schema object is created to contain the changes. The new schema object has the same unique name and OID as the old schema object but is given a different internal ID. When a client wants to access instances of the schema object by its unique name or OID, a translation is made to provide the internal ID of the new schema object such that instances of the new schema object are located instead of the old schema object.

Abstract: A system for multi-master unique identifier allocation comprises a server for allocating pools of identifiers to requesting servers and at least one server for requesting pools of identifiers and allocating individual identifiers as necessary. A single master server allocates “pools” of unique identifiers to network servers upon request. The network servers in turn allocate unique identifiers from their pool as necessary when the server generates new system objects. When a network server's pool of unique identifiers is nearly depleted, the network server requests an additional pool of identifiers from the master server.

Abstract: A Knowledge Consistency Checker (KCC) that periodically executes on each server of the computer network is provided. The KCC interacts with a data structure contained within a copy of a database located on each server, and with a replication program that executes on each server when called by the KCC. The data structure contains a list of server objects representing the servers in the network. Associated with each server objects is a list or replication objects that describe how the server is obtain a copy of a change to the database. Each replication object represents a server other than the server with which it is associated. The KCC uses the replication objects to inform the replication program from which servers to periodically request an update to the database and to the data structure. Thus, while each KCC is only responsible for creating the objects required for its own server, the replication topology of the entire network is provided to every server in the network by the periodic requests.

Abstract: A network computer maintains a directory of objects having multi-valued attributes. The attributes are comprised of individual linked values having conflict-resolution data that indicates a change to an object at an attribute-value level. A second network computer stores a replica of the directory in which a replica of the objects is maintained. The computers replicate the objects in the directories and update the individual linked values of the attributes. Replication conflicts are identified and resolved with the conflict-resolution data at the attribute-value level of the objects.

Abstract: A system for switching exclusive authority to perform a predefined system-wide task between machines in a network comprises: a database having an attribute for identifying a master server in the domain to exclusively perform the predefined network-wide task. The database is replicated on each of the servers in the domain. The attribute may be changed so as to change the master server to another one of the servers in the domain. While multiple servers in the network may be physically capable of performing the predefined system-wide task, at any one time only one server may be designated as the master server. The master server role may, however, be “floated” among various servers in the network. At any particular moment, the machine which currently holds the master server role is referred to as the master server role owner and is identified in an attribute, role owner, that is stored on each server in the network.