Abstract: A computer system has a management service, such as a distributed directory, having a plurality of objects and an access control mechanism. The computer system also has a resource, such as a data store, with a security system. A first object in the management service represents a requester and a second object represents the resource. A broker has access to the management service and the resource, and is operative to determine whether the first object has rights to access the second object, and if such rights exist, allow the requester to access the resource.

Abstract: A method and apparatus is used for generically viewing and editing values and attributes of distributed directory objects. A data structure is adapted to represent one or more attributes and associated values of a target object in a distributed directory. A user interface receives inputs from a human user and displays at least a portion of the data structure, irrespective of the target object type. One or more syntax editors receives inputs from a human user and modify the data structure. Each of the one or more syntax editors correspond to at least one attribute syntax in the distributed directory. A mechanism modifies the target object in the distributed directory to include modifications made to the data structure with the attribute editors.