System and method for using schema attributes as meta-data in a directory service

[0002] The invention relates generally to computer-based directory services, and more particularly to a system and method for using schema attributes as meta-data in a directory service.

[0003] Computer systems generally comprise two or more computers networked together to enable the sharing of applications, services, and information. Most computer systems store and maintain data (in various formats) relating to the many network resources that comprise the system. Examples of such resources may include, but are not limited to computers and various peripheral devices (e.g.—printers, RAID devices, etc.), as well as users, files, and e-mail addresses. Directory services are a valuable tool utilized by computer systems to aid in storing and maintaining this data.

[0004] A directory service typically identifies all of the resources on a network and makes them accessible to users and applications. Currently, many computer systems utilize distributed directories. A distributed directory is a single directory that spans (and is shared by) multiple networking servers. Most distributed directories are based on the X.500 ITU (International Telecommunication Union) standard which structures directories in a hierarchical fashion, having different levels for different categories of information. Many directory service providers utilize hierarchical databases, which may be referred to as either “directory service databases” or “directory service repositories.” Distributed directories based on the X.500 standard allow for information to be created, read, and modified by clients having the appropriate access rights. This information may be shared across a plurality of servers and clients.

[0005] One example of a well-known directory service or system that uses a distributed directory with a hierarchical database structure is NetWare Directory Services™ (“NDS”) by Novell Corporation. The structure of at least one NDS directory system may be understood by defining terms such as meta-data, schema, and instance.

[0006] Traditionally, meta-data in a directory system may describe the syntax or format of data so that the system may understand how data is being represented in the system. Meta-data may also specify that a directory system may have attributes, and that these attributes may be grouped into entities known as classes. Generally, meta-data defines the model for schemas in a directory system.

[0007] A schema typically defines a set of attributes that are defined together to define or describe a class. NDS allows network administrators to create classes in the schema using attributes defined by the administrators. Each attribute in a class has certain information associated with it, such as an attribute name and an attribute syntax type. The attribute name identifies the attribute, while the attribute syntax limits the values that are assumed by the attribute. In addition to defining attributes or properties, classes may also contain other meta-data describing the behavior of the class.

[0008] Once a network administrator has created a class, users having appropriate access rights may then create objects based on that class. These objects, also referred to as instances of the class, are then entered into the distributed directory. Multiple instances of the same class may exist in a directory as long as each possesses a unique name. Although objects in a distributed directory tend to represent computer-related entities (e.g.—computers, printers, users), those skilled in the art understand that objects may also represent a variety of non-computer-related entities such as companies, departments, buildings, or the like.

[0009] One feature of directory service hierarchical databases allows for classes to be derived from (or based upon the declaration of) other classes. This concept, known as inheritance, is explained with reference to FIG. 1. FIG. 1 illustrates a portion of a distributed directory 100 wherein each block illustrated represents a class. For ease of explanation, assume that a help desk policy class 110 exists in distributed directory 100, and is derived from (or based on the declaration of) a general policy class 120, a WINDOWS 98™ type policy class 130, a user type policy class 140, and a scheduled feature policy class 150. Because help desk policy class 110 is derived from policy classes (120, 130, 140, 150), any instances (or objects) of the help desk policy class 110 created in directory 100 must contain all of the mandatory attributes defined by its own class definition (which may be none), as well as all of the mandatory attributes defined in the class definitions of policy classes (120, 130, 140, 150). This is because valid instances or objects of a derived class must include the mandatory attributes of the base class or classes from which it is derived. Help desk policy class 110 may be referred to as a derived class or subclass because it inherits the characteristics of policy classes (120, 130, 140, 150). In turn, policy classes (120, 130, 140, 150) are referred to as base classes or super classes because their characteristics are inherited by another class, namely help desk policy class 110. It should be recognized that FIG. 1 is an illustration of multiple inheritance, as the derived help desk policy class 110 is inheriting the characteristics of more than one base class.

[0010] Through the derivation described above, the directory system may now make a determination that help desk policy class 110 is a policy class that is acceptable for WINDOWS 98™ systems, and for users, and that it is a policy class that may be scheduled. Such a determination may be made by examining the names of the base policy classes (120, 130, 140, 150) that help desk policy class 110 is derived from. Since the names of the base policy classes (120, 130, 140, 150) are well known and constant, and because help desk policy class 110 is derived from these base policy classes, the system is able to make this determination about the help desk policy class 110 and any eventual instances of the help desk policy class 110 that may be created.

[0011] Those skilled in the art will realize that policy classes (110, 120, 130, 140, 150) are but a few representative examples of policy classes that may be created to manage resources of a computer system such as users, workstations, or servers. These policy classes may also apply to various operating systems and may be capable of supporting various features.

[0012] One drawback associated with using hierarchical database structures is that derivation is generally a one-time process. In other words, when an administrator or other individual creates a new subclass that is to be derived from a base class, he or she may be limited in the future to only those attributes that were included in the class definition of the new subclass at the time of creation.

[0013] In FIG. 1, for example, help desk policy class 110 was derived from policy classes (110, 120, 130, 140, 150) and was defined to include any new attributes along with the attributes that were inherited from policy classes (110, 120, 130, 140, 150). If a network administrator, in the course of organizing or managing objects or instances of classes, later discovers that help desk policy class 110 shares the structure and behavior of some other existing base class (not shown), it may be disadvantageous for the help desk policy class 110 to derive from this newly discovered base class. If the help desk policy class 110 is allowed to derive from the newly discovered base class, any subsequent objects or instances of the help desk policy class 110 created would conflict with objects or instances of the help desk policy class 110 already in existence. The network administrator would most likely be forced to create a new help desk policy class and re-create all of the old objects already in existence.

[0014] The inability to modify a class schema by adding attributes later may result in an inflexible and inefficient system. These and other drawbacks exist. For this reason, it may be valuable for network administrators managing classes in a directory to be able to determine the user interface and behavior of a class before any objects or instances of the class are created in the directory. In addition, it may valuable for network administrators to understand how different classes relate to one another before any objects or instances of the classes are created in the directory.

[0015] The invention solving these and other problems in the art relates to a system and method for using schema attributes as meta-data in a directory service.

[0016] According to an embodiment of the invention, a directory service may be used with a computer system or network to aid in storing and managing data or other information relating to the system. Prior to creating an object class in a directory service, various data or other information pertaining to one or more network resources in a computer system may be identified. A group of attributes that will be used to describe this data may be given special names or menacingly the individual creating the class. These attributes may then be included in the class schema. After a class has been created, users having appropriate access rights may then create objects or instances of the class in the directory.

[0017] One advantage of this embodiment is that the user interface and behavior of a class may be determined before any objects or instances of the class ever exist in the directory. This may be accomplished by reading the class schema and identifying the attributes which exist in the schema that have been given special meaning.

[0018] Another advantage of this embodiment is that additional attributes may be added to the class schema if the meaning or use of the class has changed, or if any additional attributes are needed to describe how the class should behave.

[0019] According to one embodiment of the invention, a directory system may define or determine relationships between various classes in the directory via a specially named relationship class. First, at least two classes in a directory that share some type of relationship may be identified. A name that appropriately identifies the relationship between the at least two classes may be selected, and then a relationship class having the selected name may be created in the distributed directory. The relationship class may have an attribute that is specially named to indicate that its multiple values may include the names of the classes participating in the relationship. When the relationship class is created, however, no values may be assigned to the attribute. Rather, values for the attribute may be assigned in an object or instance of the relationship class, after the object or instance of the relationship class is created in the directory. Once an object or instance of the relationship class is created in the directory, the directory system may search the directory tree to locate the instance of the relationship class. Upon finding this object in the tree, the directory system may read the value of the attribute to discover the names of the classes that participate in the relationship.

[0020] One advantage of this embodiment is that more than one object or instance of the relationship class may be created in the directory, allowing for customization in different segments of the directory tree. Customization may be advantageous because, for example, relationships between classes may be different for different subtrees of the directory.

[0021] Another advantage of this embodiment is that the values of the attribute in the instance of the relationship class may be modified if the relationship between classes (identified by the relationship class and its object) has changed.

[0022] According to one embodiment of the invention, a directory system may define or determine several relationships between various classes in the directory via a general relationship class. First, various relationships between classes in a directory may be identified. Names that appropriately identify these relationships between classes may be selected. Next, a general relationship class may be created in the directory, having a first attribute and a second attribute. When the general relationship class is created, however, neither of the attributes may be assigned any values. Rather, values for these attributes may be assigned in an object or instance of the general relationship class once the object or instance is created in the directory. Various value fields for the first attribute may include the names that were created to define the various types of relationships that may exist between classes in a directory. The names of classes that participate in the relationships named in the value fields of the first attribute may then be assigned to corresponding value fields in the second attribute. Once an object or instance of the general relationship class is created in the directory, the directory system may search the directory tree to locate an instance of the general relationship class. Upon finding this object in the tree, the directory system may read the value fields of the first attribute to discover the various relationships that are represented. Next, the directory system may read the corresponding value fields for the second attribute to find the names of the classes that are participating in the respective relationships.

[0023] One advantage of this embodiment is that more than one object or instance of the general relationship class may be created in the directory, allowing for customization in different segments of the directory tree. Customization may be advantageous because, for example, relationships between classes may be different for different subtrees of the directory.

[0024] Another advantage of this embodiment is that the values of the attribute in the instance of the general relationship class may be modified if the various types of relationships between the classes have changed, as well as whether the names of any classes participating in the relationships have changed.

[0025] These and other objects, features, and advantages of the invention will be apparent through the detailed description of the preferred embodiments and the drawings attached hereto. It is also to be understood that both the foregoing general description and the following detailed description are exemplary and not restrictive of the scope of the invention.

[0026] FIG. 1 illustrates a distributed directory having a hierarchical database structure.

[0027] FIG. 2 is a schematic block diagram of a system of networked computers in accordance with an embodiment of the invention.

[0028] FIG. 3 illustrates an example of a class schema, according to an embodiment of the invention.

[0029] FIG. 4 illustrates a process for creating a class in a directory, according to an embodiment of the invention.

[0030] FIG. 5 illustrates a process for reading a class schema, according to an embodiment of the invention.

[0031] FIGS. 6A-6B illustrate an example of a relationship class and an instance of a relationship class created in a directory, respectively, according to an embodiment of the invention.

[0032] FIG. 7 illustrates a process for creating a relationship class in a directory, according to an embodiment of the invention.

[0033] FIGS. 8A-8B illustrate an example of a general relationship class and an instance of a general relationship class in a directory, respectively, according to an embodiment of the invention.

[0034] FIG. 9 illustrates a process for creating a general relationship class in a directory, according to an embodiment of the invention.

[0035] A directory service using a hierarchical database structure may be used to store and maintain data relating to various resources comprising a networked computer system 200, as illustrated in FIG. 2.

[0036] System 200 may comprise one or more networks 204 (e.g. networks 204a,204b,204c) that may be, or include any one or more of, for instance, the Internet, an intranet, a PAN (Personal Area Network), a LAN (Local Area Network), a WAN (Wide Area Network), a SAN (Storage Area Network), or a MAN (Metropolitan Area Network). One or more network clients 212 (e.g. clients 212a,212b,212c) may also comprise system 200. Each network client 212 may access files or applications, as well as other functions or data structures provided by one or more servers 208 (e.g. servers 208a,208b,208c) via communications links 228. Examples of network clients 212 may include any one or more of, for example, personal computers, portable computers, workstations, or dumb terminals. Suitable servers 208 may be configured as Internet servers, intranet servers, software component servers, directory service providers or name servers, or as any combination thereof. A network client 212 may function as both a client and a server. Communications links 228 may be, or include any one or more of, for instance, a telephone line, a digital T1, T3, E1, or E3 line, Digital Data Service (DDS) connection, Digital Subscriber Line (DSL) connection, an Ethernet connection, an ISDN (Integrated Services Digital Network) line, a dial-up port such as V.90, V.34 or V.34bis analog modem connection, a cable modem, or other wired or wireless data connections known to those having skill in the art.

[0037] Both the servers 208 and network clients 212 may include one or more of an addressable storage medium such as random access memory, or an optical or magnetic disk. The servers 208 and network clients 212 may also use floppy drives, optical drives, tape drives, or other drives to read a storage medium 224. Examples of suitable storage mediums may include, for instance, a magnetic, optical, or other device having a specific physical substrate configuration. Floppy disks, hard disks, tape, CD-ROM's, PROM's, and RAM may be considered a non-exhaustive list of suitable storage devices. Various devices including printers 216, and storage devices 220, for example, may also comprise system 200. Those of skill in the art will appreciate that the invention works with various system configurations. Accordingly, more or less of the aforementioned system components may be used in various embodiments.

[0038] In an embodiment of the invention, a directory service may be used with system 200 as described above, to aid in storing and managing data or other information relating to the system. Suitable directory services may preferably be those having a hierarchical database structure, such as, for example, NetWare Directory Services™ (“NDS”) by Novell Corporation. Directory services with a hierarchical database structure may be preferred as they generally allow network administrators to create classes in a directory schema, and subsequently allow users with appropriate access rights to create objects or instances of the class, which may be added to the distributed directory.

[0039] FIG. 3 illustrates an embodiment of the invention which overcomes the drawbacks associated with inheritance and derivation by enabling a directory system to determine relationships between various classes by using specially named attributes. In FIG. 3, an example of a schema for a help desk policy class 310 is shown. This policy class may be derived from (or based on the declaration of) a general policy class 320. General policy class 320 may contain attributes generic to all policy classes. It should be recognized that help desk policy class 310 and general policy class 320 have been selected for illustrative purposes, and are but two examples of many various types of classes that may exist in a directory system. Accordingly, the scope of the invention should not be limited by the following description.

[0040] According to the invention, when a network administrator or other individual decides to create the help desk policy class 310, he or she may first select and name one or more attributes to describe the help desk policy.

[0041] For example, a network administrator may first name the attributes that describe what types of objects the help desk policy class 310 may manage. If, for instance, the help desk policy may be used to manage users, an attribute named “policyusertype” may be created. Likewise, if the policy may be used to manage workstations, an attribute named “policyworkstationtype” may be created.

[0042] Next, a network administrator may name the attributes that describe what particular platforms the help desk policy may apply to. For example, if the help desk policy applies to the WINDOWS 98™ platform, an attribute having the name “policyWIN98platform,” may be created.

[0043] Additionally, attributes having special names may be created for the help desk policy class if it can support different features. For example, if a help desk policy can be scheduled, it may be given a name such as “policyScheduledfeature.”

[0044] Any number of attributes may be created and assigned a special name or meaning. The names assigned to the attribute may be expressed in any number of ways according to any number of various conventions, including those unique to the directory service or to the computer system that the directory service is managing. Once a group of attributes have been named, the help desk policy class 310 may be created in the distributed directory including those attributes that describe how the class should behave. The class may, as described above, derive generic attributes relating to policies from general policy class 320. While creating the help desk policy class, any number of attributes that have been named may be added to the class schema.

[0045] After a network administrator has created the class, users having appropriate access rights may then create objects based on that class. These objects, also referred to as instances of the class, are then entered into the distributed directory. Upon creation, the instances or objects of the help desk policy class 310 may include each of the attributes that were added to the schema of help desk policy class 310, even though they may go unused.

[0046] One of the benefits of using attributes, is that more attributes may be named and added to the class schema at a later time. If for instance, a network administrator learns that the help desk policy class may also manage servers, an attribute named “policyServertype” may be added to the class schema which already includes the attributes named “policyusertype” and “policyWorkstationtype.”

[0047] Similarly, if it is later determined that the help desk policy class may also apply to the WINDOWS NT™ platform, WINDOWS 95™ platform, or WINDOWS 2000™ platform, attributes named “policyWINNTplatform,” “policyWIN95platform,” and “policyWIN2000platform” may be created and subsequently added to the class schema. The same applies to any additional features or other properties that a class may affect. The invention allows more attributes to be added to further describe a class when its meaning or use has changed.

[0048] One of the advantages of the invention is that the attributes which are given special meaning and defined in the class schema may serve as meta-data. By reading the schema of a class, the directory system may ascertain what the class relates to even before any objects or instances of the class exist in the directory.

[0049] Referring back to FIG. 3, a network administrator may, for example, be responsible for managing various policies created by other network administrators. Assume, for instance, that a network administrator wishes to create a list of all of the possible policies that apply to workstations. Before any instances of these policy classes exist in the directory, the directory system may read the schemas of each of the policy classes. For each class, a first determination may be made as to whether or not the class in question was derived from the general policy class 320. If a class was derived from the general policy class 320, the network administrator may know that the class is a policy class and should be examined further to determine whether or not the attribute “policyWorkstationtype” exists in the schema. If it does exist in the class schema, the network administrator will know that the policy may apply to workstations, and can list it accordingly.

[0050] In addition to scanning, searching, reading, or examining multiple class schemas for a particular attribute in order to identify class relationships, it is of course possible to scan, search, read, or examine the schema of one class to identify relationships. For example, the directory system may read the schema of the help desk policy class 310, as illustrated in FIG. 3. Because the attributes named “policyUsertype,” “policyWorkstationtype,” and “policyWIN98platform,” exist in the schema for the help desk policy class 310, the directory system may assume that the help desk policy may be used with users and workstations running WINDOWS 98™ platforms. In addition, because an attribute named “policyScheduledfeature” also exists in the class schema, the system may know that it should include scheduling code and features.

[0051] In the foregoing description, attributes concerning objects, platforms, and features were described with reference to policy classes. Those skilled in the art will understand that any types of attributes may be given special meaning to describe the user interface or behavior of any types of classes that may need to be created.

[0052] FIG. 4 illustrates a flowchart for creating a class in a distributed directory according to the invention, in one regard. Processing may begin at step 400. In step 404, a network administrator or other individual may identify various data or other information pertaining to one or more network resources that may need to be classified. The network administrator may then, in step 408, select and name the group of attributes that will be used to classify the data. The attributes may, for example, describe what type of objects a class may manage, what platforms a class may apply to, and, among others, what features a class may support. The names assigned to the various attributes may be expressed in any number of ways according to any number of various conventions. In step 412, a class may be created in the distributed directory including those attributes that describe how the class should behave. After a class has been created, users having appropriate access rights may then create objects based on that class in step 416. These objects, which may also be referred to as instances of the class, may then be entered into the distributed directory. In step 420, an inquiry is made to determine whether or not the meaning or use of the class has changed, or if any additional attributes are needed to describe how the class should behave. If a network administrator needs to add more attributes to the class schema, he or she may do so as seen in step 424. If no further attributes are needed, processing may end at step 428.

[0053] FIG. 5 illustrates a flowchart for reading a class schema according to the invention, in one regard. Processing may begin at step 500. In step 504, a network administrator may identify what types of classes he or she is trying to obtain information about. For example, a network administrator may wish to create a list of all policies that apply to workstations, or apply to Windows NT™, or may be scheduled. Once the criteria has been decided, the directory system may scan, search, or perform a query on the classes in the directory in step 508. For each particular class identified as a result of the search, scan, or query, an inquiry may be made in step 512 to determine whether or not the class has been derived from a relevant base class. In other words, if it is only desired to evaluate the policy classes in the directory, a determination may be made to see if the class has been derived from the general policy class. If the class has not been derived from the appropriate base class, a second inquiry may be made in step 516 to determine whether or not there are any remaining classes in the directory. If there are, the next class may be evaluated in step 520 with processing then proceeding back to step 512.

[0054] If a determination is made in step 512 that the class has been derived from the desired base class, the schema of the class may be read in step 524. An inquiry may then be made in step 528 to determine whether or not the class schema includes the desired attribute. Again, if the directory system is trying to locate, for example, all of the policies that apply to workstations, the class schema may be read to determine whether or not the attribute “policyworkstationtype” is present. If the desired attribute is discovered in the class schema, the directory system may note in step 532 that that policy applies to workstations. If the class schema does not contain the desired attribute, processing may proceed with step 516. Once all of the classes of the directory have been evaluated, processing may end at step 536.

[0055] The foregoing description of FIGS. 3-5 illustrates how a directory system may determine relationships between various classes by using specially named attributes in a class.

[0056] In an embodiment of the invention illustrated in FIGS. 6A-6B, a directory system may determine relationships between various classes by using a specially named relationship class. For ease of explanation, assume that a directory includes classes relating to workstations, as well as classes relating to different policies that may be used to manage workstations. A network administrator may, for administrative or other purposes, wish to create a relationship class named, for example, “WorkstationTypePolicy” to identify classes that apply to workstations.

[0057] FIG. 6A illustrates an example of a schema for a “WorkstationTypePolicy” relationship class 610 that may be created. The relationship class schema may include an attribute named, for instance, “ClassOfThisType.” When “WorkstationTypePolicy” relationship class 610 is created, however, no values may be assigned to the “ClassOfThisType” attribute. Rather, values for the “ClassOfThisType” attribute may be assigned in an object or instance of the “WorkstationTypePolicy” relationship class 610, once the object or instance of the “WorkstationTypePolicy” relationship class 610 is created in the directory.

[0058] FIG. 6B depicts an example of an object or instance of the “WorkstationTypePolicy” relationship class 610 that may be created in the directory and given a name, such as, for example, “WorkstationPolicies.” Once “WorkstationPolicies” object 620 is created, names of policy classes or other classes that apply to workstations may be assigned as values for the “ClassofThisType” attribute in “WorkstationPolicies” object 620. For example, if a help desk policy, remote control policy, and inventory policy may each be used to manage workstations, then “HelpDeskPolicyClass,” “RemoteControlPolicyClass,” and “InventoryPolicyClass” may all be assigned as values for the “ClassOfThisType” attribute in “WorkstationPolicies” object 620.

[0059] In an embodiment of the invention, more than one object or instance of the “WorkstationTypePolicy” relationship class 610 may exist in the directory, allowing for customization in different segments of the directory tree. Customization may be advantageous because, for example, the set of policies related to workstations may be different for different subtrees of the directory.

[0060] Additionally, the use of a relationship class allows for the relationships between classes to be modified over time, as there may be no restriction on adding or removing values from the “ClassOfThisType” attribute in “WorkstationPolicies” object 620. Accordingly, a network administrator or other individual may be afforded greater control when defining relationships between various classes.

[0061] After the “WorkstationPolicies” object 620 is created in the directory, the directory system may search (or perform a directed query of) the directory tree to locate an instance of the “WorkstationTypePolicy” relationship class 610 named “WorkstationPolicies.” Upon finding this object 620 in the tree, the directory system may read the value of the “ClassOfThisType” attribute to discover the names of the classes that participate in the relationship.

[0062] Although this embodiment has been described with respect to a relationship class based on workstation classes and policy classes, it should be recognized that a relationship class may define associations or relationships among classes of any type that may be related to other classes. For example, a relationship class named “UserTypePolicy” relationship class may be created to define a relationship between user classes and policy classes that manage users.

[0063] FIG. 7 illustrates a flowchart for creating a relationship class in a distributed directory according to the invention, in one regard. Processing may begin at step 700. In step 704, a network administrator or other individual may identify at least two classes in a directory which are related. The network administrator may then, in step 708, select a name that appropriately identifies the relationship between the at least two classes. In step 712, a relationship class having the selected name may be created in the distributed directory. The relationship class may have an attribute that is specially named to indicate that its multiple values may include the names of the classes participating in the relationship. However, when the relationship class is created, no values may be assigned to the attribute. Rather, values for the attribute may be assigned in an object or instance of the relationship class, after the object or instance of the relationship class is created in the directory, which may occur at step 716. Typically, objects based on the relationship class may be created by users having appropriate access rights. These objects may also have a specially selected name. Step 720 illustrates the step of assigning the values for the attribute in an object or instance of the relationship class, after the object or instance of the relationship class is created in the directory.

[0064] Although not illustrated, more than one object or instance of the relationship class may be created in the directory in step 716, allowing for customization in different segments of the directory tree. Customization may be advantageous because, for example, relationships between classes may be different for different subtrees of the directory.

[0065] In step 724, an inquiry may be made to determine whether the relationship between classes (identified by the relationship class and its object) has changed. If a determination is made that the relationship has changed, values may, in step 728, be modified, added to, or deleted from the values of the attribute that were first included in the instance of the relationship class in step 720. If the relationship has not changed, processing may end at step 732.

[0066] Once an object or instance of the relationship class is created in the directory according to the process described above, the directory system may search (or perform a directed query of) the directory tree to locate an instance of the relationship class. Upon finding this object in the tree, the directory system may read the value of the attribute to discover the names of the classes that participate in the relationship.

[0067] The foregoing description of FIGS. 6A, 6B, and 7 illustrate how a directory system may determine relationships between various classes by using a specially named relationship class. A specially named relationship class may be created for each type of relationship that may exist.

[0068] In an embodiment of the invention, a general relationship class may be used to define or determine several types of relationships that may exist between classes in a directory. For illustrative purposes, assume that a directory includes classes relating to workstations, users, and features that may be scheduled, along with policy classes that may be used to manage each. Rather than creating a relationship class to define relationships between user classes and policy classes that manage users, and creating a relationship class to define relationships between workstation classes and policy classes that manage workstations, a single general relationship class may be created to define both relationships.

[0069] FIG. 8A illustrates an example of a schema for a general relationship class 810 that may be created and assigned a name, such as “GeneralRelationshipClass.” The schema of the general relationship class 810 may comprise a first attribute named, for example, “RelationshipTypes,” and a second attribute named, for example, “RelationshipPolicies.” When the general relationship class 810 is created, neither the “RelationshipTypes” attribute, nor the “RelationshipPolicies” attribute may be assigned values. Rather, values for these attributes may be assigned in an object or instance of the general relationship class 810, once the object or instance is created in the directory.

[0070] An example of an object or instance of general relationship class 810 that may be created in the directory is illustrated in FIG. 8B. When the object or instance is created, it may be given a name, such as, for example, “PolicyRelationships.” Once the “PolicyRelationships” object 820 is created, values for the “RelationshipTypes” and “RelationshipPolicies” attributes may be entered in object 820.

[0071] Values for the “RelationshipTypes” attribute may include names that were created to define various types of relationships that may exist between classes in a directory. For example, if a network administrator is aware that the directory comprises policy classes that relate to workstations, users, and features that may be scheduled, he or she may assign the “RelationshipTypes” attribute values including “WorkstationTypePolicies,” “UserTypePolicies,” and “ScheduleTypePolicies,” respectively. Values may then be assigned to the “RelationshipPolicies” attribute that correspond to the values assigned in the “RelationshipTypes” attribute. For example, in FIG. 8B, the first value field for the “RelationshipTypes” attribute is “WorkstationTypePolicies.” Accordingly, the first value field for the “RelationshipPolicies” attribute may include the names of policy classes that are relevant to, or may be used to manage workstations. For instance, if a help desk policy, inventory policy, and remote control policy each may be used to manage workstations, then “HelpDeskPolicyClass,” “InventoryPolicyClass,” and “RemoteControlPolicyClass,” may all be assigned as values in the first value field for the “RelationshipPolicies” attribute.

[0072] As an additional example, in FIG. 8B, the second value field for the “RelationshipTypes” attribute is “UserTypePolicies.” Accordingly, the second value field for the “RelationshipPolicies” attribute may include the names of policy classes that are relevant to, or may be used to manage users. For instance, if a help desk policy may be used to manage users, then “HelpDeskPolicyClass,” may; be entered as a values in the second value field for the “RelationshipPolicies” attribute.

[0073] In an embodiment of the invention, more than one object or instance of the general relationship class 810 may exist in the directory, allowing for customization in different segments of the directory tree. Customization may be advantageous because, for example, the set of policies related to, for example, users or workstations, may be different for different subtrees of the directory.

[0074] Additionally, the use of a general relationship class allows for the relationships between classes to be modified over time, as there may be no restriction on adding or removing values from the “RelationshipTypes” and “RelationshipPolicies” attributes in the “PolicyRelationships” object 820. Accordingly, a network administrator or other individual may be afforded greater control when defining relationships between various classes.

[0075] Once the “PolicyRelationships” object 820 is created in the directory, the directory system may search (or perform a directed query of) the directory tree to locate an instance of the “GeneralRelationshipClass” 810 named “PolicyRelationships.” Upon finding this object 820 in the tree, the directory system may first read the value fields of the “RelationshipTypes” attribute to discover the various relationships that are represented. Next, the directory system may read the corresponding value fields for the “RelationshipPolicies” attribute to find the names of the classes that are participating in the respective relationships.

[0076] Again, it should be recognized that, although this embodiment has been described with respect to specific relationships for illustrative purposes, the general relationship class may be used to define associations or relationships among classes of any type that may be related to any other classes in a directory.

[0077] FIG. 9 illustrates a flowchart for creating a general relationship class in a distributed directory according to the invention, in one regard.

[0078] Processing may begin at step 900. In step 904, a network administrator or other individual may identify several types of relationships that may exist between classes in a directory. The network administrator may then, in step 908, select names that appropriately identify the relationship between the classes. In step 912, a general relationship class may be created in the distributed directory, and given a name such as, for example, “GeneralRelationshipClass.” The general relationship class may have a first attribute and a second attribute. When the general relationship class is first created, however, neither of the attributes may be assigned any values. Rather, values for these attributes may be assigned in an object or instance of the general relationship class once the object or instance is created in the directory, which may occur at step 916. Typically, objects based on the relationship class may be created by users having appropriate access rights. These objects may also have a specially selected name.

[0079] Step 920 illustrates the step of assigning the values for the attribute in an object or instance of the relationship class, after the object or instance of the relationship class is created in the directory. Various value fields for the first attribute may include names that were created to define various types of relationships that may exist between classes in a directory. The names of classes that participate in the relationships named in the value fields of the first attribute may then be assigned to corresponding value fields in the second attribute.

[0080] Although not illustrated, more than one object or instance of the general relationship class may be created in the directory in step 916, allowing for customization in different segments of the directory tree. Customization may; be advantageous because, for example, relationships between classes may be different for different subtrees of the directory.

[0081] In step 924, an inquiry may be made to determine whether the various types of relationships that may exist between classes in a directory have changed, as well as whether the names of any classes participating in the relationships have changed. If a determination is made that either have changed, values may, in step 928, be modified, added to, or deleted from the value fields of the two attributes that were first defined in the instance of the general relationship class in step 920. If the relationship has not changed, processing may end at step 932.

[0082] Once an object or instance of the general relationship class is created in the directory according to the process described above, the directory system may search (or perform a directed query of) the directory tree to locate an instance of the general relationship class. Upon finding this object in the tree, the directory system may first read the value fields of the first attribute to discover the various relationships that are represented. Next, the directory system may read the corresponding value fields for the second attribute to find the names of the classes that are participating in the respective relationships.

[0083] Other embodiments, uses and advantages of the invention will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. The specification should be considered exemplary only, and the scope of the invention is accordingly intended to be limited only by the following claims.