Abstract: A method and system for restricting remote access by users of directory access protocol client systems without using an directory access protocol “netgroup” option by defining a “remote_allowed” attribute for a entire user group, which, if enabled, allows granting of all remote access requests to all clients, but which, if disabled, allows granting of remote access requests to client systems specifically listed in a “hosts” attribute. In this manner, directory administrators may configure remote access rights for groups of users without having to perform cumbersome and tedious “netgroup”. Subsequent to granting access, the authentication, such as a log in, may be performed on the user. The invention is particularly useful for Lightweight Directory Access Protocol (LDAP) systems, where the “hosts” attribute can list client systems by Internet Protocol address, by hostname, or a by combination of address and hostname.

Abstract: A method and system for restricting remote access by users of directory access protocol client systems without using an directory access protocol “netgroup” option by defining a “remote_allowed” attribute for a entire user group, which, if enabled, allows granting of all remote access requests to all clients, but which, if disabled, allows granting of remote access requests to client systems specifically listed in a “hosts” attribute. In this manner, directory administrators may configure remote access rights for groups of users without having to perform cumbersome and tedious “netgroup”. Subsequent to granting access, the authentication, such as a log in, may be performed on the user. The invention is particularly useful for Lightweight Directory Access Protocol (LDAP) systems, where the “hosts” attribute can list client systems by Internet Protocol address, by hostname, or a by combination of address and hostname.