Abstract: Embodiments herein relate to viral transfer risk management. In example embodiments, an apparatus is configured to retrieve a first user identifier associated with a first client computing entity. The apparatus is further configured to determine, based at least in part on a first transfer risk score associated with the first user identifier, a first transfer risk score grouping for the first user identifier. The apparatus is further configured to, based at least in part on the first transfer risk score grouping and physical space parameters associated with a physical space identifier, allocate a first physical space assignment within a physical space associated with the physical space identifier to the first user identifier associated with the first client computing entity.

Abstract: Embodiments herein relate to viral transfer risk management. In example embodiments, an apparatus is configured to retrieve a first user identifier associated with a first client computing entity. The apparatus is further configured to determine, based at least in part on a first transfer risk score associated with the first user identifier, a first transfer risk score grouping for the first user identifier. The apparatus is further configured to, based at least in part on the first transfer risk score grouping and physical space parameters associated with a physical space identifier, allocate a first physical space assignment within a physical space associated with the physical space identifier to the first user identifier associated with the first client computing entity.

Abstract: A method and apparatus for tracking an identity of a user associated with a network lease is disclosed. The IP lease is correlated to user information by storing a user ID with lease information in a manner in which the user information is associated with the lease information. In an embodiment, the user ID is a Global User ID (GUID). In an embodiment the user ID is unique to a specified domain. In an embodiment, the user ID is given to only one user and never changes.

Abstract: A role based access control system is described that assigns roles, which otherwise are mutually exclusive, to users based on detecting designated conditions when the user initiates actions or operations on the network. The assignment of the role to a particular user may be conditional upon one or more such designated conditions occurring. In particular, two roles that are mutually exclusive of one another may be occupied by one user for purpose of performing specified operations upon designated conditions being detected when the user initiates one or more of the specified operations. Business rules specify conditions for assigning the conditional roles.

Abstract: A method and apparatus are disclosed for modifying a subscription of a subscriber to a telecommunications service based on subscriber information and service information that are stored in a directory repository. A directory-enabled service selection framework is coupled to the directory repository for receiving stored information therefrom. The directory-enabled service selection framework receives a request to identify one or more services to which a subscriber is subscribed, based on a prior request to modify the subscription of the subscriber to the telecommunications service. A list is generated of the one or more services to which the subscriber is currently subscribed, based on group membership of the subscriber, one or more roles occupied by the subscriber, and authorization information associated with the subscriber that is stored in the directory repository.

Abstract: A method is disclosed for managing network resources in multiple administrative domains. According to the method, a user is authenticated in a first administrative domain. A token is generated for the user that identifies the user as being assigned a role. The token is configured to identify the user by the role to a component of a second administrative domain. When the user requests a resource of the second administrative domain, its component examines the token and the role to determine whether to grant access to the resource. As a result, the second administrative domain may grant the user access to its resources without re-authenticating the user in the second administrative domain.

Abstract: A method is provided to configure access to a plurality of data repositories. The data repositories each provide data objects for applications operated by users. A request is received to access data objects in the plurality of data repositories. The request may specify a parameter. Metadata is retrieved that characterizes a portion of the data objects stored in each data repository. One or more objects are selected from the data repositories using the parameter in the request and the metadata.

Abstract: A system and method for synchronizing database information over a communications network distributed among a plurality of servers. The system allows each server to track the state of a replica on each of the servers, and changes to the servers are communicated between the servers along with their states. The states may be stored as an array of timestamps, the timestamps each indicating a time at which the replica on each server was updated. In a network wherein two servers (a first and third server) cannot communicate directly, a first network server transmits a change to an intermediate (a second) server including its state information. The second server transmits the change to the third server, and the third server updates its replica. The third server transmits its state information to the second server, and the timestamp information is conveyed to the first server. The state information of the third server may be transmitted to the second server during later updates of the third server's replica.

Abstract: A method and apparatus for reorganizing a distributed directory is disclosed. A source logical group, such as a partition, is identified for reorganization. A destination object is selected to which the source logical group will become subordinate. Multiple simultaneous reorganizations of the distributed directory can be handled.

Abstract: Methods and systems for managing replicated objects in a partitioned hierarchical database are disclosed. One method combines partition-wide object identifiers in order according to ancestry to form a database-wide object identifier that identifies a target object relative to all other objects in the database. Each partition-wide object identifier includes a replica identifier and at least one integer value. Suitable integer values include timestamp values, event counter values, random values, and GUID values. Other methods use the identifiers to access objects after a single object or a subtree of objects has been renamed or moved.

Abstract: A method of moving leaf objects and subtrees in computer networks that employ a distributed network directory is disclosed. The method employs the existing directories and an authentication procedure for each server. A first object that is under the physical control of the administrator of one partition of the distributed network directory requests access to a second object that is under the physical control of the administrator of another partition of the distributed network directory. The directory verifies that the access control list of the first object includes the second object. The access control list of the second object is then checked to verify that it includes a reference to the first object as an object that is permitted access to the second object. As a result, access is only granted in response to requests from objects that appear in the access control list of the second object. a method of synchronizing the access control lists based upon an authoritative access control list is also disclosed.

Abstract: A method of moving leaf objects and subtrees in computer networks that employ a distributed network directory is disclosed. The method employs the existing directories and an authentication procedure for each server. A first object that is under the physical control of the administrator of one partition of the distributed network directory requests access to a second object that is under the physical control of the administrator of another partition of the distributed network directory. The directory verifies that the access control list of the first object includes the second object. The access control list of the second object is then checked to verify that it includes a reference to the first object as an object that is permitted access to the second object. As a result, access is only granted in response to requests from objects that appear in the access control list of the second object. a method of synchronizing the access control lists based upon an authoritative access control list is also disclosed.