Lightweight directory access protocol (LDAP) directory server cache mechanism and method

[0002] 1. Technical Field

[0003] This invention relates generally to providing directory services in a distributed computing environment.

[0004] 2. Description of the Related Art

[0005] A directory service is the central point where network services, security services and applications can form a integrated distributed computing environment. The current use of a directory services may be classified into several categories. A “naming service” (e.g., DNS and DCE Cell Directory Service (CDS)) uses the directory as a source to locate an Internet host address or the location of a given server. A “user registry” (e.g., Novell NDS) stores information of all users in a system composed of a number of interconnected machine. The central repository of user information enables a system administrator to administer the distributed system as a single system image. Still another directory service is a “yellow pages” lookup provided by some e-mail clients e.g., Netscape Communicator, Lotus Notes, Endora and the like.

[0006] With more applications and system services demanding a central information repository, the next generation directory service will need to provide system administrators with a data repository that can significantly ease administrative burdens. In addition, the future directory service must also provide end users with a rich information data warehouse that allows them to access department or company employee data, as well as resource information, such as name and location of printers, copy machines, and other environment resources. In the Internet/intranet environment, it will be required to provide user access to such information in a secure manner.

[0007] To this end, the Lightweight Directory Access Protocol (LDAP) has emerged as an IETF open standard to provide directory services to applications ranging from e-mail systems to distributed system management tools. LDAP is an evolving protocol that is based on a client-server model in which a client makes a TCP/IP connection to an LDAP server, sends requests, and receives responses. The LDAP information model in particular is based on an “entry,” which contains information about some object. Entries are typically organized in a specified tree structure, and each entry is composed of attributes.

[0008] LDAP provides a number of known functions including query (search and compare), update, authentication and others. The search and compare operations are used to retrieve information from the database. For the search function, the criteria of the search is specified in a search filter. The search filter typically is a Boolean expression that consists of attribute name, attribute value and Boolean operations like AND, OR and NOT. Users can use the filter to perform complex search operations. The filter syntax is defined in RFC 1960.

[0009] LDAP thus provides the capability for directory information to be efficiently queried or updated. It offers a rich set of searching capabilities with which users can put together complex queries to get desired information from a backing store. Increasingly, it has become desirable to use a relational database for storing LDAP directory data. Representative database implementations include DB/2, Oracle, Sybase, Informix and the like. As is well known, Structured Query Language (SQL) is the standard language used to access such databases.

[0010] One of main goals for implementing an LDAP directory service with an relational database backing store (e.g., DB/2) is to provide a design and implementation such that all LDAP search queries can be executed efficiently. In the case of repetitive searches involving the same search query, however, it is not cost-effective to return to the backing store repetitively due to the nature of the database management system. In particular, it is very time consuming and expensive to go through the DBMS layers necessary to access entries inside the database for every entry required to be returned.

[0011] One approach to solving this problem is to use the backing store's cache. While this approach has been implemented and has proved somewhat useful, it still requires repetitive access to the backing store from the directory service. Moreover, use of the relational database backing store does not provide significant enough performance enhancements to justify the more complex caching mechanism required.

[0012] There remains a need to address the problem of efficient handling of repetitive searches issued from a hierarchical directory service to a relational database backing store.

[0013] It is a primary object of this invention to obviate repetitive inquiries into a relational database backing store used by a hierarchical-based directory service.

[0014] It is another primary object to search a relational database using hierarchical, filter-based queries, such as LDAP, and efficiently caching search results to increase search efficiency for repetitive queries.

[0015] Another primary object of this invention is to cache search results in a more efficient manner in a directory service having a relational database backing store.

[0016] Still another important object of this invention is to provide a mechanism for populating a local storage area associated with an LDAP directory service with directory search results retrieved from a relational database (e.g., DE/2) backing store.

[0017] Yet another important object of this invention is to enhance the efficiency of a directory service using a caching mechanism.

[0018] A more general object of this invention is to provide more efficient, less expensive hierarchical LDAP searches using relational tables in an LDAP directory service having a relational database management system (DBMS) as a backing store.

[0019] A still more general object of this invention is to provide a reliable and scaleable enterprise directory solution, wherein a preferred implementation is LDAP using a DB/2 backing store.

[0020] These and other objects are provided in a method for searching a relational database using hierarchical, filter-based search queries. The method begins in response to a search query to the relational database. Search results retrieved in response to the search query are cached, preferably in a local storage area of the directory service. In response to subsequent issuance of the search query, the cached search results are then used preferentially in lieu of re-accessing the relational database to increase search efficiency.

[0021] According to a feature of the present invention, the search results are cached in a unique manner to facilitate use of these results for subsequent, repetitive queries. Preferably, first and second caches are established in the local storage area. The first cache is sometimes referred to herein as a Type I cache, and the second cache is sometimes referred herein as a Type II cache. The first cache receives a set of identifiers indexed by a filter key of the search query. The search results, namely entries corresponding to the set of identifiers, are then stored in the second cache. The present invention thus provides a mechanism for populating the Type I and Type II caches. In addition, the mechanism modifies information in the caches during (or as a result of) given directory service operations (e.g., modify, modify rdn, delete and add) that would otherwise invalidate the cached information. Thus, whenever a repetitive search query is generated within the directory service, search results are selectively fetched from the caches instead of being retrieved from the relational database. Cached information remains current at all times using the invalidation routines. This operation significantly reduces the cost of processing the repetitive search query.

[0022] Preferably, the filter-based query is a Lightweight Directory Access Protocol (LDAP) directory service query and the relational database is DB/2 or some other convenient backing store. As noted above, preferably the local storage area is associated with the directory service for enhanced query response. The Type I and Type II caches are preferably dedicated portions of the directory service local storage area.

[0023] In accordance with a more specific aspect of the invention, a method for searching a relational database (e.g., DB/2) from a Lightweight Directory Access Protocol (LDAP) directory service utilizes first and second caches associated with the directory service to obviate use of the backing store when receiving repetitive search queries. Preferably, a given unit of the first cache is a set of identifiers that qualified for the LDAP search of a particular filter key. Each given unit of the second cache is an entry qualified for the search and is indexed by its identifier.

[0024] The present invention also describes a computer program product in a computer readable media that implements an algorithm for populating the Type I and Type II caches, and that implements an algorithm for invalidating the caches during given directory service operations. A directory service implementing this inventive mechanism is also described.

[0025] The foregoing has outlined some of the more pertinent objects of the present invention. These objects should be construed to be merely illustrative of some of the more prominent features and applications of the invention. Many other beneficial results can be attained by applying the disclosed invention in a different manner or modifying the invention as will be described. Accordingly, other objects and a fuller understanding of the invention may be had by referring to the following Detailed Description of the preferred embodiment.

[0026] For a more complete understanding of the present invention and the advantages thereof, reference should be made to the following Detailed Description taken in connection with the accompanying drawings in which:

[0027] FIG. 1 is a representative LDAP directory service implementation;

[0028] FIG. 2 is a simplified LDAP directory;

[0029] FIG. 3 is a flowchart of an LDAP directory session;

[0030] FIGS. 4A-4C show representative LDAP directory service implementations having relational database backing store;

[0031] FIG. 5 is a simplified block diagram of the directory service caching mechanism of the present invention;

[0032] FIG. 6 is a representative LDAP directory tree;

[0033] FIG. 7 is a simplified flowchart of the inventive method for hierarchical LDAP searching in an LDAP directory service having a relational database management system as a backing store wherein search results are selectively cached in the directory service caching mechanism of FIG. 5;

[0034] FIG. 8 is a detailed flowchart of a preferred routine for populating the Type I and Type II caches of the present invention;

[0035] FIG. 9 is a flowchart of a preferred routine for invalidating the cache during an LDAP modify operation.

[0036] A block diagram of a representative LDAP directory service in which the present invention may be implemented is shown in FIG. 1. As is well-known, LDAP is the lightweight directory access protocol, and this protocol has been implemented in the prior art, e.g., as either a front end to the X.500 directory service, or as a standalone directory service. According to the protocol, a client machine 10 makes a TCP/IP connection over network II to an LDAP server 12, sends requests and receives responses. LDAP server 12 supports a directory 21 as illustrated in a simplified form in FIG. 2. Each of the client and server machines further include a directory “runtime” component 25 for implementing the directory service operations as will be described below. The directory 21 is based on the concept of an “entry” 27, which contains information about some object (e.g., a person). Entries are composed of attributes 29, which have a type and one or more values. Each attribute 29 has a particular syntax that determines what kinds of values are allowed in the attribute (e.g., ASCII characters, .jpeg file, etc.) and how these values are constrained during a particular directory operation.

[0037] The directory tree is organized in a predetermined manner, with each entry uniquely named relative to its sibling entries by a “relative distinguished name” (RDN). An RDN comprises at least one distinguished attribute value from the entry and, at most, one value from each attribute is used in the RDN. According to the protocol, a globally unique name for an entry, referred to as a “distinguished name” (DN), comprises a concatenation of the RDN sequence from a given entry to the tree root.

[0038] The LDAP search can be applied to a single entry (a base level search), an entry's children (a one level search), or an entire subtree (a subtree search). Thus, the “scope” supported by LDAP search are: base, one level and subtree. LDAP does not support search for arbitrary tree levels and path enumeration.

[0039] LDAP includes an application programming interface (API), as described in “The C LDAP Application Program Interface”, IETF Task Force Working Draft, Jul. 29, 1997, which is incorporated herein by reference. An application on a given client machine uses the LDAP API to effect a directory service “session” according to the flowchart of FIG. 3. At step 40, an LDAP session with a default LDAP server is initialized. At step 42, an API function ldap_init() returns a handle to the client, and this handle allows multiple connections to be open at one time. At step 44, the client authenticates to the LDAP server using, for example, an API ldap_bind() function. At step 46, one or more LDAP operations are performed. For example, the API function ldap_search() may be used to perform a given directory search. At step 48, the LDAP server returns the results. The session is then closed at step 50 with the API ldap_unbind() function then being used to close the connection.

[0040] It may be desirable to store LDAP directory data in a backing store. FIGS. 4A-4C illustrates several representative LDAP directory service implementations that use a relational database management system (RDBMS) for this purpose. These systems merely illustrate possible LDAP directory services in which the present invention may be implemented. One of ordinary skill should appreciate, however, that the invention is not limited to an LDAP directory service provided with a DB/2 backing store. The principles of the present invention may be practiced in other types of directory services (e.g., X.500) and using other relational database management systems (e.g., Oracle, Sybase, Informix, and the like) as the backing store.

[0041] In FIG. 4A, an LDAP client 34 can connect to a number of networked databases 38a-58nthrough an LDAP server 36. The databases 38a-38ncontain the directory information. However, from the user's perspective, the LDAP server 36 actually stores all the information without knowing the database 38 in which the data is actually located. With this configuration, the LDAP server 36 is freed from managing the physical data storage and is able to retrieve information from multiple database servers 38 which work together to form a huge data storage.

[0042] FIG. 4B illustrates a multiple client/multiple server LDAP/DB2 enterprise solution. In this environment, a DB/2 client preferably runs on each LDAP server 36. Each such DB/2 client can connect to any database server 38 containing directory information. The collection of database servers 38a-38nform a single directory system image, and one or more of the LDAP servers 36 can access such information. Because all the LDAP servers 36 see the same directory image, a network dispatcher 37 may be deployed to route requests among the LDAP servers 36.

[0043] FIG. 4C illustrates a multiple client/parallel super server configuration. In certain environment where users need to store large amount of information into the directory, this configuration automatically partitions the database into different machines 38. In addition, database queries are divided into smaller, independent tasks that can execute concurrently, which increases end user query response time. This configuration enables users to store up to terabytes of data into the database.

[0044] One of ordinary skill should appreciate that the system architectures illustrated in FIGS. 4A-4C are not to be taken as limiting the present invention.

[0045] With the above as background, FIG. 5 illustrates a block diagram of an inventive caching mechanism that is preferably implemented at or in association with the LDAP directory service. The directory service includes an LDAP server 36 and a relational database backing store 38 as previously described. LDAP server 36 is typically a computer having suitable memory partitioned into a first cache 40 and a second cache 42. The first cache 40 is sometimes referred to herein as a Type I cache, and the second cache 42 is sometimes referred to herein as a Type II cache. First and second caches 40 and 42 may comprise part of the same local storage area 44, or each cache may be associated with its own local storage area. As used herein, the designations “first” and “second” thus may not designate different physical structures. In a preferred embodiment, the Type I and Type II caches are merely separate memory locations of the same random access memory (RAM) of the LDAP server, although any suitable storage area(s) may be used for this purpose.

[0046] By implementing the Type I and Type II caches in the directory service local storage area, repetitive search queries are handled without resort to the relational database 38. This caching mechanism provides significant performance improvements given that conventional LDAP directory servers are search-oriented and have many repetitive searches. According to the invention, a unit of the Type I cache is a set of identifiers (Ids) which qualify for a given LDAP search query of a particular filter key. The unit is indexed by that filter key. A unit of Type II cache is an entry qualified for the search and is indexed by its identifier.

[0047] By way of example, and with reference to the representative directory tree in FIG. 6, a typical LDAP search may be as follows:

[0048] ldapsearch −b “c=IBM_US, c=US” −s sub (sn=smith); where: “−b” is the base distinguished name (dn) from which the search is initiated, “−s” is the scope of the search (either base, one or subtree), and “sn=smith” is the filter string that specifies the condition the search needs to find matches in the directory. The three elements above form a unique combination of criteria for a given LDAP search query. As is well known, a filter key is a combination of filter string+scope+base dn, and each filter key is thus unique for an LDAP search. In the above example, the filter key is:

[0049] “(sn=smith)2o=IBM_US, c=US”,

[0050] where 2 is a numeric representation of the scope subtree level (with base level being 0 and one level being 1).

[0051] FIG. 7 is a representative flowchart of the inventive caching method. As described above, the method is preferably implemented in an LDAP directory service having a DB/2 relational database backing store, although one of ordinary skill will appreciate that the inventive technique may be used to search any relational database using hierarchical, filter-based database queries. The method begins at step 60 by establishing the Type I and Type II caches, preferably in a directory server. At step 62, a test is run to determine whether an LDAP search query has been issued. If not, the routine cycles. If, however, the outcome of the test at step 62 indicates that a search query has been issued, the routine continues at step 64 to determine whether the search query has been previously serviced. If the outcome of the test at step 64 is negative, the search query is processed by communicating the query to the relational database at step 66 and then returning the search results at step 68. In this processing path, the search results are cached at step 70 and the routine then returns to step 62 or terminates. If, however, the outcome of the test at step 64 is positive, which indicates that the query is a repetitive one, the routine branches to step 65 to retrieve the search results from the cache in lieu of going back to the relational database. These results are then returned to the inquiring client or process at step 67. This completes the processing.

[0052] As will be seen, the inventive caching scheme preferably takes advantage of several LDAP table structures that are now described below. Further details about these structures are provided in U.S. Ser. No. 09/050,503, titled “A Fast And Efficient Method To Support Hierarchical LDAP Searches With Relational Tables”, assigned to the assignee of this application, and incorporated herein by reference.

[0053] Entry Table:

[0054] This table holds the information about a LDAP entry. This table is used for obtaining the EID of the entry and supporting LDAP_SCOPE_ONELEVEL and LDAP_SCOPE_BASE search scope.

[0055] EID. The unique identifier of the LDAP entry. This field is indexed.

[0056] PEID. The unique identifier of a parent LDAP entry in the naming hierarchy.

[0057] EntryData. Entries are stored using a simple text format of the form “attribute: value”. Non-ASCII values or values that are too long to fit on a reasonable sized line are represented using a base 64 encoding. Giving an ID, the corresponding entry can be returned with a single SELECT statement.

[0058] Descendant Table:

[0059] The purpose of this table is to support the subtree search feature of LDAP. For each LDAP entry with, a unique ID (AEID), this table contains the descendant entries unique identifiers (DEID). The columns in this table are:

[0060] AEID. The unique identifier of the ancestor LDAP entry. This entry is indexed.

[0061] DEID. The unique identifier of the descend LDAP entry. This entry is indexed.

[0062] Attribute Table:

[0063] One table per searchable attribute. Each LDAP entry is assigned an unique identifier (EID) by the backing store. The columns for this table are:

[0064] EID

[0065] Attribute value

[0066] Thus, in the parent table, the EID field is the unique identifier of an entry in the LDAP naming hierarchy. The PEID field is the unique identifier of the parent entry in the naming hierarchy. In the descendant table, the AEID field is the unique identifier of a ancestor LDAP entry in the LDAP naming hierarchy. The DEID field is the unique identifier of the descend LDAP entry.

[0067] In addition to the table structures described above, the following SQL SELECT statements are used by LDAP/DB2 search routines:

[0068] Base Level Search:

[0069] SELECT entry.EntryData,

[0070] from ldap_entry as entry

[0071] where entry.EID in (

[0072] select distinct ldap_entry.EID

[0073] from <table list>

[0074] where (ldap_entry.EID=<root dn id>)

[0075] <sql where expressions>)

[0076] One Level Search:

[0077] SELECT entry.EntryData,

[0078] from ldap_entry as entry

[0079] where distinct ldap_entry.EID

[0080] from ldap_entry, <table list>

[0081] ldap_entry as pchild, <list of tables>

[0082] where ldap_entry.EID=pchild.EID

[0083] AND pchild.PIED=<root dn id>

[0084] <sql where expressions>)

[0085] Subtree Search

[0086] SELECT entry. EntryData,

[0087] from ldap_entry as entry

[0088] where entry.EID in (

[0089] select distinct ldap_dentry.EID

[0090] from ldap_entry, ldap_desc, <table list>

[0091] where

[0092] (LDAP_ENTRY.EID=ldap_desc.DEID AND

[0093] ldap_desc.AEID=<root dn id>)

[0094] ldap_entry as pchild. <table list>

[0095] where ldap_entry.EID=ldap_desc.EID

[0096] AND ldap_desc.AEID=%d <where expressions>).

[0097] In the above representation, <table list> and <where expression> are the two null terminated strings returned by the SQL generator. The <root dn id> is the unique identifier of the root dn. The where clause should only be generated if <where expression> is not the empty string and no errors where detected in the parsing the LDAP filter.

[0098] As is well-known, LDAP search queries comprise six basic filters with the format <attribute> <operator> <value>. Complex search filters are generated by combining basic filters with Boolean operators AND (&), OR (|) and NOT (!). For each LDAP filter element or sub-expression, there is a set of entries (EIDS) that will satisfy the element. Thus, each element generally maps to a set of EIDs.

[0099] FIG. 8 is a flowchart illustrating the preferred routine of the present invention for populating the cache. The routine begins at step 80 by locking the Type I cache. At step 82, a test is performed to determine whether the filter key for a given LDAP search query can be found in the Type I cache. If the outcome of the test at step 82 is positive, the routine continues at step 84 to obtain a set of identifiers corresponding to that filter key from the cache. If the outcome of the test at step 82 is negative, the routine accesses LDAP_DESC and the attribute tables (in the relational database) at step 86 to obtain candidate identifiers and generate an identifier list (namely, the set of identifiers). At step 88, the identifier list is added to the Type I cache indexed by the filter key. The cache is then unlocked at step 90. At this point of the operation, an identifier list has been formed which is either retrieved from the Type I cache or retrieved from the tables in the relational database. The routine then continues at step 92.

[0100] In particular, for each identifier in the identifier list, the routine continues at step 94 by locking the Type II cache. A test is then performed at step 96 to determine if the identifier can be found in the Type II cache. If the outcome of the test at step 96 is positive, the routine continues at step 98 to get the entry corresponding to that identifier from the Type II cache. If the outcome of the test at step 96 is negative, the routine accesses the LDAP_ENTRY table (in the relational database) at step 100 to retrieve the entry given the identifier. At step 102, the entry is added to the Type II cache indexed by the identifier. At this point in the process flow, an entry is formed which is either retrieved from the Type II cache or retrieved from the LDAP_ENTRY table.

[0101] The routine then continues at step 104 to process the entry with ACL information. At step 106, the entry is sent back to the client or other process initiated the search query. At step 108, the Type II cache is unlocked.

[0102] The following is a representative picture of the Type I and II caches following such an operation: Example:

[0103] The following is a detailed listing of a preferred code implementation of the above-described algorithm of FIG. 8:

[0104] mutex_lock (lock_cache_I)

[0105] if the filter key can be found in the type I cache

[0106] get the id list (a set of ids) corresponding to that filter key from type I cache

[0107] else

[0108] access LDAP_DESC and attributes tables to get candidate ids and put them in an id list (a set of ids).

[0109] add the id list to the type I cache indexed by the filter key

[0110] endif

[0111] mutex_unlock (lock_cache_I)

[0112] /* so far an id list is formed which is either retrieved from type I cache or retrieved from the tables of the database */

[0113] for each id in that id list

[0114] mutex_lock (lock_cache_II)

[0115] if id can be found in the type II cache

[0116] get the entry corresponding to that id from type II cache.

[0117] else

[0118] access LDAP_ENTRY table to retrieve the entry given the id

[0119] add the entry to type II cache indexed by the id

[0120] endif

[0121] /*so far an entry is formed which is either retrieved from type II cache or from LDAP_ENTRY table */

[0122] process entry with ACL info

[0123] send entry back to client

[0124] mutex_unlock (lock_cache_II)

[0125] endfor

[0126] According to the present invention, it is necessary to “invalidate” the cache during particular directory service operations (e.g., modify, modify rdn, delete and add operations) which would otherwise impact cached information. Inadvertently the cache according to the invention refers to a set of processes for maintaining the integrity of the cached data during RDBMS operations that would otherwise alter the contents of the backing store which formed the original search results for the query. FIG. 9 illustrates a flowchart of a preferred routine for invalidating the cache during a representative operation, the LDAP modify operation.

[0127] The routine assumes that particular search results have been stored in the cache in response to a search query and that the RDBMS contents are being modified prior to a repetitive query. The routine begins at step 110 by locking the Type I cache. Step 112 is then repeated for each attribute name that is modified in the relational database. In particular, a test is performed at step 114 to determine if the attribute name is in the filter string of the filter key for the search query. If the outcome of the test at step 114 is positive, the routine continues at step 116 by removing the cache unit (namely, the identifier list and the filter key). After all attribute names have been processed in this manner, the routine unlocks the Type I cache at step 118. The routine then continues at step 120 to lock the Type II cache. A test is then performed at step 122 to determine if the identifier of the modified entry is in the Type II cache. If the outcome of the test at step 122 is positive, the routine continues at step 124 to remove the unit (namely, the entry and its identifier). The Type II cache is then unlocked at step 126 to end the processing.

[0128] Using the above example, assume an entry with id 234 and cn and sn of the entry are modified. The caches then look as follows:

[0129] Type II cache:

[0130] Nothing is removed.

[0131] The caches will become:

[0132] The code of the LDAP modify operation described in FIG. 9 is set forth below:

[0133] mutex_lock (lock_cache_I)

[0134] for each attribute name that is modified

[0135] if attribute name is in the filter string of the filter key, remove the unit (id list+filter key)

[0136] endif

[0137] endfor

[0138] mutex_unlock (lock_cache_I)

[0139] mutex_lock (lock_cache_II)

[0140] if id of the modified entry is in the type II cache remove the unit (entry+id)

[0141] endif

[0142] mutex_lock (lock_cache_II)

[0143] The following are representative code listings for the other referenced LDAP operations that are processed to invalidate the cache information.

[0144] LDAP Modify Rdn Operation

[0145] mutex_lock(lock_cache_I)

[0146] if attribute name of the modified rdn is in the filter string of the filter key, remove the unit (id list+filter key)

[0147] endif

[0148] mutex_unlock(lock_cache_I)

[0149] mutex_lock (lock_cache_II)

[0150] if id of the modified entry is in the type II cache remove the unit (entry+id)

[0151] endif

[0152] mutex_unlock(lock_cache_II)

[0153] Example:

[0154] An entry with id 23 and rdn cn is modified.

[0155] Using the caches above in the i):

[0156] Type I cache:

[0157] Nothing is removed.

[0158] The caches will become

[0159] LDAP delete operation

[0160] mutex_lock (lock_cache_I)

[0161] for each attribute name in the deleted entry

[0162] if attribute name is in the filter string of the filter key

[0163] remove the unit(id list+filter key)

[0164] endif

[0165] endfor

[0166] mutex_unlock(lock_cache_I)

[0167] mutex_lock (lock_cache_II)

[0168] if id of the modified entry is in the type II cache remove the unit (entry+id)

[0169] endif

[0170] mutex_lock (lock_cache_II)

[0171] Example:

[0172] An entry with id 4009 and attributes dn, ou, c, objectclass.

[0173] Using the example above in ii):

[0174] Type I cache:

[0175] Nothing is removed

[0176] Type II cache:

[0177] Nothing is removed

[0178] LDAP add operation

[0179] mutex_lock (lock_cache_I)

[0180] for each attribute name in the added entry

[0181] if attribute name is in the filter string of the filter key

[0182] remove the unit (id list+filter key)

[0183] endif

[0184] endfor

[0185] mutex_unlock (lock_cache_I)

[0186] Type II cache is not affected at all.

[0187] Example:

[0188] An entry with id 3515 and attributes dn, ou, c, objectclass and jobresponsibility.

[0189] Using the example above in iii):

[0190] According to another desirable feature of the invention, a double linked list preferably is used to keep track of the least recently used (LRU) unit in each cache. When the cache is full, the least recently used unit preferably will be flushed out.

[0191] As noted above, the invention may be implemented in any hierarchical directory service in which a relational database management system (RDBMS) is used to provide a backing store function. Typically, an SQL query is generated and used to access the relational database, and results are then returned in response to this query. Search results are cached preferably in a pair of caches associated with or implemented in the directory server. Preferably, each unit of Type I cache is a set of identifiers that qualify for the LDAP search of a particular filter key, and the unit is indexed by that filter key. A unit of Type II cache is an entry qualified for the search and is indexed by its identifiers. Routines are provided to populate the caches and, where necessary (e.g., when information in the relational database changes) to invalidate given information therein. The resulting cache mechanism is robust and ensures that repetitive search queries are managed through the cache as opposed to through repeated, yet unnecessary search queries from the directory service to the relational database.

[0192] One of ordinary skill will appreciate that the invention can be applied to any relational database management system (RDBMS). In addition, the EID sets approach can also be applied to b-tree based LDAP server implementation. The inventive algorithm may be applied to any LDAP server implementation, including Netscape Directory Server.

[0193] The present invention thus implements an LDAP server cache that provides significant advantages. Foremost, the inventive caching mechanism obviates the need to go back repetitively into the backing store on subsequent searches when information in the directory service is otherwise current. The technique also ensures that the caches are updated or modified as needed when LDAP operations are carried out. In a preferred embodiment, each of the caches are implemented in a suitable storage area, such as a random access memory of a computer. Compared with using a backing store cache, the present invention achieves significant performance improvement.

[0194] One of the preferred embodiments of the routines of this invention is as a set of instructions (computer program code) in a code module resident in or downloadable to the random access memory of a computer.

[0195] Having thus described our invention, what we claim as new and desire to secure by letters patent is set forth in the following claims.