Remote user profile management administration in a computer network

Abstract

A security system interface which uses the message passing capability of the distributed application to send messages to remote copies of itself and the security system at the remote system to carry out the remote user profile administration function at the remote machine. A message for a remote user profile administration function is constructed in a syntax used by a distributed application. The message is sent by a local copy of the distributed application resident at a local system to a remote copy of the distributed application resident at a remote system. The message is translated by the security system interface resident at the remote system into a user profile function usable by the security system. Finally, the user profile function is performed by a security system resident at the remote system. In the preferred embodiment, the distributed application is a database management program and the message is a data structure containing information for the remote user profile administration function.

Claims

We claim:

1. A method for administering a remote user profile, comprising the steps of:

by a local copy of a distributed application, resident at the local system, constructing a message including a data structure for a remote user profile administration function in a syntax used by the distributed application;

by the local copy of the distributed application, sending the message to a remote copy of the distributed application resident at a remote system;

by a security system interface resident at the remote system, translating the message into a user profile administration function in a format used by a security system; and

by the security system resident at the remote system, performing the user profile administration function to change a user profile at the remote system according to the translated message;

wherein the distributed application is a program independent of the security system.

2. The method as recited in claim 1 wherein the distributed application is a database management program.

3. A method as recited in claim 1 wherein the remote user profile administration function is to add a user.

4. A method as recited in claim 1 wherein the remote user profile administration function is to add a user group.

5. A method as recited in claim 1 wherein the remote user profile administration function is to delete a group access to a resource.

6. A method as recited in claim 1 is to reset a maximum age for user passwords at a remote node.

7. A method as recited in claim 1 is set a minimum length for a user password.

8. A system for administering a remote user profile, comprising:

a local copy of a distributed application for constructing a message including a data structure for a remote user profile administration function in a syntax used by a distributed application and for sending the message to a remote copy of the distributed application resident at a remote system;

a remote copy of the distributed application for receiving the message;

a security system interface resident at the remote system for translating the message into a user profile administration function; and

a security system resident at the remote system for performing the user profile administration function to change a user access to resources at the remote system, wherein the security system interface translates the message into a format used by the security system and the security system performs the user profile administration function according to the translated message and wherein the security system is a program independent of the distributed application.

9. The system as recited in claim 8 wherein the distributed application is a database management program.

10. The system as recited in claim 8 further comprising:

a memory coupled to a system bus for storing sets of instructions to operate the system;

a processor coupled to the system bus for executing the sets of instructions; and

a display for displaying results of the execution of the sets of instructions.

11. The system as recited in claim 10 further comprising:

a plurality of nodes on which copies of a distributed application, a security system interface and a security system reside on a computer system;

a network to which the plurality of nodes are coupled;

wherein each copy of the distributed application is used for constructing messages in a syntax used by a distributed application and for sending and receiving messages to and from remote copies of the distributed application resident at remote systems;

wherein at least one security system interface is used for translating a message into a user profile administration function; and

wherein at least one security system is used for performing the user profile administration function to change a user access to resources so that the security system interface translates the message into a format used by the security system and the security system performs the user profile administration function according to the translated message.

12. The system as recited in claim 8 wherein the local copy of the distributed application further comprise means for requesting user profile information from the security system at the remote system.

13. The system as recited in claim 8 wherein the remote user profile administration function is to set a number of intervening passwords a user must input before reuse of a previous password is permitted.

14. A computer program product in a computer readable medium for administering a remote user profile in a distributed data processing system, comprising:

at least one copy of a distributed application including:

means for constructing a message including a data structure for a remote user profile administration function in a syntax used by the distributed application;

means for sending and receiving messages to and from copies of the distributed application resident at remote systems; and

a security system interface including means for translating the message into a user profile administration function in a format used by a security system resident at a remote system;

wherein the security system interface communicates with a security system which includes means for changing user access to resources according to the translated message and wherein the distributed application is program independent of the security system.

Description

BACKGROUND OF THE INVENTION

This invention relates generally to data processing systems in a network environment. More particularly, it relates to a method and system for administrating user profiles on remote machines in a distributed database environment.

It is common to couple a plurality of data processing systems in an interconnected computing network such as a Local Area Network (LAN) or Wide Area Network (WAN). With the increasing complexity and size of such computer networks, it is also recognized that data within the system and transmitted data between the nodes on the LAN must be protected against unauthorized disclosure, destruction and modification. Typically, a userid and a password are used in the authentication process to prove the legitimacy of the user attempting to logon. After authentication on the systems to which the user is allowed access, information can be passed between the personal computers on the network. Most security systems require a fair amount of user profile administration, e.g., the addition and deletion of users, changing user passwords, and user group related activities. In these networks, the geographic location of nodes can be widespread. It is not practical to physically travel from machine to machine to accomplish administrative tasks connected with the authentication procedure.

Many of these tasks can be performed by using LAN management software which are sometimes called Network Operating Systems (NOS). Typically, the NOS utilizes a domain controller to access the user accounts data base for user profile management related tasks. Only a network administrator has the necessary clearance to access and modify this information. Further, the network administrator is limited to the user profile information stored at the server. For companies with diverse and intensive client server needs, the investment in a "NOS" such as IBM OS/2 LAN Server.TM. is worthwhile.

However, some companies use only a few specialized applications through the network.

Companies which only use a distributed database manager or another distributed application do not want to incur the additional cost and associated overhead of a LAN management system. However, present day database management system and distributed applications do not provide the facility to remotely administer the user profile related information. Some application programs do provide local user profile management. For example, the User Profile Management (UPM) Facility, part of the Extended Services.TM. program which is offered by the IBM Corporation, provides authorization checking by means of a logon facility and local administration of user ID's and passwords. Authorization through UPM is necessary before the local system or remote systems may be utilized. UPM can be used to define a local user logon profile which stores information enabling a user logon to remote systems. However, UPM does not allow user profile administration services to remote systems on the network. The network administrator must go to each individual system to accomplish these administration services.

The present invention provides a remote administration means for a distributed application.

SUMMARY OF THE INVENTION

It is therefore an object of the invention to administrate a user profile for a remote machine through a distributed application.

It is another object of the invention to minimize the coding effort to allow remote user profile administration.

These and other related objects are accomplished by a security system interface which uses the message passing capability of the distributed application to send messages to remote copies of itself and the security system at the remote system to carry out the remote user profile administration function at the remote machine. A message for a remote user profile administration function is constructed in a syntax used by a distributed application. The message is sent by a local copy of the distributed application resident at a local system to a remote copy of the distributed application resident at a remote system. The message is translated by the security system interface resident at the remote system into a user profile function usable by the security system. Finally, the user profile function is performed by a security system resident at the remote system. In the preferred embodiment, the distributed application is a database management program and the message is a data structure containing information for the remote user profile administration function .

BRIEF DESCRIPTION OF THE DRAWINGS

This invention will become more easily understood by the following detailed description of a preferred embodiment of the invention with reference to the attached drawings, in which:

FIG. 1 shows a computer comprising a system unit, a keyboard, a mouse and a display.

FIG. 2 is a block diagram of a components of the computer shown in FIG. 1.

FIG. 3 is a simplified depiction of a Local Area Network coupled to client and database server systems.

FIG. 4 is a code module diagram of the software code modules resident in the memories of the client and server systems.

FIGS. 5A, 5B and 5C is a flow diagram, of the remote user profile administration process on the client system.

FIG. 6 is a flow diagram of the remote user profile administration process on the server system.

DETAILED DESCRIPTION OF THE DRAWINGS

The invention may be run on a collection of computers under a number of different operating systems. The computers in the network could be, for example, a personal computer, a mini computer, mainframe computer or a computer running in a distributed network of other computers. Although the specific choice of computer is limited only by disk and disk storage requirements, computers in the IBM PS/2 (TM) series of computers could be used in the present invention. For additional information on IBM's PS/2 series of computers, the reader is referred to Technical Reference Manual Personal Systems/2 Model 50, 60 systems IBM Corporation, Part No. 68X2224 Order Number S68X-2224 and Technical Reference Manual Personal Systems/2 (Model 80) IBM Corporation Part No. 68X 2256 Order Number S68X-2254. One operating system which an IBM PS/2 personal computer may run is IBM's OS/2 2.0 (TM). For more information on the IBM OS/2 2.0 Operating System, the reader is referred to OS/2 2.0 Technical Library, Programming Guide Vol. 1, 2, 3 Version 2.00 Order Nos. 10G6261, 10G6495, 10G6494.

In the alternative, the computer system might be in the IBM RISC System/6000 (TM) line of computers which run on the AIX (TM) operating system. The various models of the RISC System/6000 are described in many publications of the IBM Corporation, for example, RISC System/6000, 7073 and 7016 POWERstation and POWERserver Hardware Technical reference, Order No. SA23-2644-00. The AIX operating system is described in General Concepts and Procedure--AIX Version 3 for RISC System/6000 Order No. SC23-2202-00 as well as other publications of the IBM Corporation.

In FIG. 1, a computer 10, comprising a system unit 11, a keyboard 12, a mouse 13 and a display 14 are depicted. The screen 16 of display device 14 is used to present the graphical user interface (GUI). The graphical user interface supported by the operating system allows the user to use a point and shoot method of input, i.e., by moving the mouse pointer 15 to an icon representing a data object at a particular location on the screen 16 and pressing one of the mouse buttons to perform a user command or selection.

FIG. 2 shows a block diagram of the components of the personal computer shown in FIG. 1. The system unit 11 includes a system bus or plurality of system buses 21 to which various components are coupled and by which communication between the various components is accomplished. The microprocessor 22 is connected to the system bus 21 and is supported by read only memory (ROM) 23 and random access memory (RAM) 24 also connected to system bus 21. A microprocessor in the IBM multimedia PS/2 series of computers is one of the Intel family of microprocessors including the 386 or 486 microprocessors. However, other microprocessors included, but not limited to, Motorola's family of microprocessors such as the 68000, 68020 or the 68030 microprocessors and various Reduced Instruction Set Computer (RISC) microprocessors manufactured by IBM, Hewlett Packard, Sun, Intel, Motorola and others may be used in the specific computer.

The ROM 23 contains among other code the Basic Input-Output system (BIOS) which controls basic hardware operations such as the interaction and the disk drives and the keyboard. The RAM 24 is the main memory into which the operating system and application programs are loaded. The memory management chip 25 is connected to the system bus 21 and controls direct memory access operations including, passing data between the RAM 24 and hard disk drive 26 and floppy disk drive 27. The CD ROM 32, also coupled to the system bus 21, is used to store a large amount of data, e.g., a multimedia program or large database.

Also connected to this system bus 21 are various I/O controllers: The keyboard controller 28, the mouse controller 29, the video controller 30, and the audio controller 31. As might be expected, the keyboard controller 28 provides the hardware interface for the keyboard 12, the mouse controller 29 provides the hardware interface for mouse 13, the video controller 30 is the hardware interface for the display 14, and the audio controller 31 is the hardware interface for the speakers 15a and 15b. The speakers 15a and 15b may be used to present audio objects to the user. An I/O controller 40 such as a Token Ring Adapter enables communication over a network 46 to other similarly configured data processing systems.

One of the preferred implementations of the present invention is as a set of instructions in a code module resident in the random access memory 24. Until required by the computer system, the set of instructions may be stored in another computer memory, for example, in the hard disk drive 26, in an optical disk for eventual use in the CD ROM 32 or in a floppy disk for eventual use in the floppy disk drive 27. The code modules in the computer memory are depcited in FIG. 4.

FIG. 3 is a greatly simplified illustration of a Local Area Network in which the present invention is implemented. Typically, a network environment is much more complicated, consisting of different LAN technologies, multiple vendors and multiple adapters. Most vendors write to a variety of protocols according to the IEEE and International Standard Organization standards ISO 8802-2, ISO, 8802-3, ISO 8802-4, ISO 8802-5 and ISO 8802-7 to assure compatibility. The connection medium 40 is preferably, an IBM Token Ring, however, it could also be an Ethernet or PCNet or other type of LAN network. The OS/2 Database Manager Client System 42 is coupled to the LAN 40 and communicates to the OS/2 Database Manager Server System 44. Database Manager is used as an example, those skilled in the art would be able to extend the invention to other distributed applications. The Client System 42 can use the server system 44 for a variety of functions such as file sharing, distributed applications and databases, communications printing and other services. Other systems such as a DOS Requester 45 and the OS/2 Client 47 may be equipped with the present invention. It is also possible that these services would be divided on a plurality of servers coupled to the LAN 40 to optimize efficiency.

In the preferred embodiment, the security system resident on the client system 42 and server system 44 is the User Profile Management (UPM) Facility, which provides local user profile functions. UPM is part of the Extended Services.TM. program which is offered by the IBM Corporation. Extended Services comprises Communications Manager and Database Manager components which allow comprehensive communication and database functions within a network for computer systems which use the OS/2 operating system. Extended Services is described in many publications of the IBM Corporation including IBM Extended Services for OS/2 Hardware and Software Reference Order No. S04G-1014-00.

User Profile Management (UPM) is a security system which provides authorization checking by means of a logon facility and administration of user ID's and passwords. UPM always requires a user ID and usually also requires a password for access to the system. Authorization through UPM is necessary before the local system or remote systems may be utilized. UPM is local to each workstation and contains unique information specific to that system. To access a system either locally or remotely, the user's id and password must be defined through UPM on each system accessed. UPM can be used to define a user logon profile which stores information enabling user's logon to remote systems. The user logon profile contains, userid, password, the remote name of the system and the remote type of the system being accessed, e.g., LU 6.2. If the remote option is used, when the user logons on the local system, the user logon profile is activated to authorize access to the remote systems automatically. However, UPM does not provide automatic user profile update services to remote systems on the network. Further information on the present version of UPM may be found in IBM Extended Services for OS/2 Guide to User Profile Management (S04G-1114-00) available from the IBM Corporation and hereby incorporated by reference. This invention teaches certain improvements to the combination of Database Manager and UPM to provide remote administration services. While UPM and Database Manager are used in the preferred embodiment, those skilled in the art would recognize that other distributed applications and security systems can be improved according to the principles of the present invention.

Among the remote user profile administration functions added by the invention as follows:

Add a user,

Delete a user,

Return list of users,

Returns a user's information,

Set the user's information,

Set the user's password,

Return the group(s) of which a user is a member of,

Set a user to a group(s),

Return user Modal information,

Set user Modal information,

Validate a user's password,

Add a new group,

Delete a group,

Return list of group,

Add a user to a group,

Delete a user from a group,

Return list of users of a group,

Set a group to a list of users,

Return a group's information,

Set a group's information.

The invention utilizes the local user profile administration capabilities of UPM, together with the ability of database manager to pass data structures in a network to provide a remote user profile administration functions. Many of the functions listed above have corresponding and preexisting functions in UPM that are executable for the local system. However, as discussed above, with the present day configurations of these products the network administrator would be forced to go to system to system to perform these functions on a network-wide basis.

A sample table of remote user profile administration functions and the equivalent local UPM function follows:

    ______________________________________
    Remote User Profile Action
                       Equivalent UPM Function
    ______________________________________
    SQL.sub.-- ADD.sub.-- USER
                       NetUserAdd
    SQL.sub.-- DELETE USER
                       NetUserDel
    SQL.sub.-- LIST USERS
                       NetUserEnum
    SQL.sub.-- GET.sub.-- USER-INFO
                       NetUserGetInfo
    SQL.sub.-- GET.sub.-- USER-INFO
                       NetUserSetInfo
    SQL.sub.-- CHANGE.sub.-- PSWD
                       NetUserPasswordSet
    SQL.sub.-- USER.sub.-- GET.sub.-- GROUPS
                       NetUserGetGroups
    SQL.sub.-- USER.sub.-- SET.sub.-- GROUPS
                       NetUserGetGroups
    SQL.sub.-- VALIDATE.sub.-- USER
                       NetUserValidate
    SQL.sub.-- GET.sub.-- MODALS
                       NetUserModalsGet
    SQL.sub.-- SET.sub.-- MODALS
                       NetUserModalsSet
    SQL.sub.-- ADD.sub.-- GROUP
                       NetGroupAdd
    ______________________________________

    ______________________________________
    int far pascal /* REMOTE UPM ADMINIS-
                   TRATION */
     sqladupm (unsigned char *,
                   /* Node name */
      unsigned short,
                   /* UPM action to be taken */
      void *,      /* SQLUPM data structures */
      struct sqlca *);
                   /* SQLCA pointer */
     parameters
    ______________________________________

    __________________________________________________________________________
    struct sqlupm.sub.-- user.sub.-- info
                      /* USER INFORMATION STRUCTURE */
     {
    unsigned char userid›8!;
                      /* user's name */
    unsigned char comment›40!;
                      /* user's comment/description*/
     };
    struct sqlupm.sub.-- user
                      /* USER STRUCTURE */
    unsigned char userid›8!;
                      /* user's name */
    unsigned char password›8!;
                      /* user's password */
    unsigned char new.sub.-- password›8!;
                      /* user's new password*/
    bool password.sub.-- required;
                      /* is user's password required*/
    unsigned short type;
                      /* user's type: USER,ADMIN*/
    unsigned char comment›40!;
                      /* user's comment*/
    char far * buffer;
                      /* ptr to sqlupm struct or groupid*/
    unsigned short buflen;
                      /* size of buffer*/
    unsigned short entries;
                      /* number of entries received/sent*/
    unsigned short total.sub.-- entries;
                      /* total entries available*/
     };
     struct sqlupm.sub.-- modal
                      /* MODAL STRUCTURE */
     {
     unsigned short min.sub.-- password.sub.-- length;
                      /* password length 0-8*/
     unsigned short max.sub.-- password.sub.-- age;
                      /* expiration age in seconds
    */
     unsigned short min.sub.-- password.sub.-- age;
                      /* minimum password age in
                      seconds */
     unsigned short password.sub.-- history;
                      /* reuse of previous passwords
                      */
     };
     struct sqlupm.sub.-- group.sub.-- info
                      /* GROUP INFORMATION STRUC-
                      TURE */
     {
      unsigned char groupid›8!;
                      /* group's name */
      unsigned char comment›40!;
                      /* group's comment/description */
     };
     struct sqlupm.sub.-- group
                      /* GROUP STRUCTURE */
     {
      unsigned char groupid›8!;
                      /* group's name*/
      unsigned char comment›40!;
                      /* group's comment/description
                      */
      char far * buffer;
                      /* ptr to sqlupm struct or userid
                      */
      unsigned short buflen;
                      /* size of buffer */
      unsigned short entries;
                      /* number of entries
                      received/sent */
      unsigned short total.sub.-- entries;
                      /* total entries available
                      */
     };
    __________________________________________________________________________

    ______________________________________
    Action          Buffer representation
                                     Status
    ______________________________________
    SQL.sub.-- LIST.sub.-- USERS
                    sqlupm.sub.-- user.sub.-- info struc-
                                     output
                    ture(s)
    SQL.sub.-- USER.sub.-- GET.sub.-- GROUPS
                    groupid›8! string(s)
                                     output
    SQL.sub.-- USER.sub.-- SET.sub.-- GROUPS
                    groupid›8! string(s)
                                     output
    SQL.sub.-- LIST.sub.-- GROUPS
                    sqlupm.sub.-- group.sub.-- info struc-
                                     output
                    ture(s)
    SQL.sub.-- GROUP.sub.-- ADD.sub.-- USER
                    userid›8! string input
    SQL.sub.-- GROUP.sub.-- GET.sub.-- USERS
                    userid›8! string(s)
                                     output
    SQL.sub.-- GROUP.sub.-- SET.sub.-- USERS
                    userid›8! string(s)
                                     input
    ______________________________________

    ______________________________________
     struct sqlupm.sub.-- user.sub.-- info *user.sub.-- info;
     unsigned short rc,i;
     rc = sqladupm("DOMAIN1", SQL.sub.-- LIST.sub.-- USERS,
    &sqlupm.sub.-- user, &sqlca);
     if(sqlupm.sub.-- user.total.sub.-- entries > 0) && (rc == 0)
     {
      sqlupm.sub.-- user.buflen = sizeof(struct
    sqlupm.sub.-- user.sub.-- info)
         * sqlupm.sub.-- user.tota1.sub.-- entries;
      sqlupm.sub.-- user.buffer = malloc(sqlupm.sub.-- user.buflen);
      rc =
    sqladupm("DOMAIN1", SQL.sub.-- LIST.sub.-- USERS, &sqlupm.sub.-- user,
    &sqlca);
      if (rc == 0)
      {
       *user.sub.-- info = *sqlupm.sub.-- user.buffer;
       for(i=1;i<=sqlupm.sub.-- user.entries;i++,user.sub.-- info++)
       {
        printf("%s %s
    /n",user.sub.-- info->userid,user.sub.-- info->comment);
       }
      }
     }
    ______________________________________

    ______________________________________
     strcpy( sqlupin.sub.-- user.userid, "USER1");
     strcpy(sglupm.sub.-- user.password, "PASS1");
     sglupm user.password.sub.-- required = TRUE;
     sqlupm.sub.-- user.type = ADMIN;
     strcpy(sglupm.sub.-- user.comment, "User1 is administrator
    for dept. 5");
     rc =
    sqladupm("DOMAIN1",SQL.sub.-- SET.sub.-- USER.sub.-- INFO,&sqlupm.sub.--
    user,
    &sqlca)
    ______________________________________

    ______________________________________
     /*seconds in 30days = 60sec .times. 60min .times. 24hrs .times. 30days
      */
     sqlup.sub.-- modals.max.sub.-- password.sub.-- age = (60*60*24*30);
    rc=qladupm("DOMAIN1",SQL.sub.-- SET.sub.-- MODALS,&sqlupm.sub.-- modals,
    &sqlca
    );
    ______________________________________

    ______________________________________
     strcpy(sqlupm.sub.-- group.groupid, "GROUP5");
     strcpy(userid, "USER1");
     sqlupm.sub.-- group.buffer = &userid;
     rc=
    sqladupm("NODE5",SQL.sub.-- GROUP.sub.-- ADD.sub.-- USER,&sqlupm.sub.--
    group,
    &sqlca)
    ______________________________________

    ______________________________________
     strcpy(sqlupm.sub.-- group.groupid, "GROUP7");
     sqlupm.sub.-- group.buflen = 3*sizeof(userid);
     sqlupm.sub.-- group.buffer = malloc(sqlupm.sub.-- group.buflen);
     *user = *sqlupm.sub.-- group.buffer;
     strcpy(*user, "USER25");
     for(j=0;j<=8;user++); /* move user ptr to next userid
    location*/
     strcpy(*user, "USER26");
     for(j=0;j<=8;user++); /* move user ptr to next userid
    location*/
     strcpy(*user, "USER27");
     sqlupm.sub.-- group.entries = 3;
     rc =
    sqladupm("NODE7",SQL.sub.-- GROUP.sub.-- ADD.sub.-- USERS,&sqlupm.sub.--
    group,
    &sqlca
    );
    ______________________________________

    ______________________________________
     unsigned char *user;
     unsigned short rc,i,j;
     rc = sqladupm("DOMAIN1", SQL.sub.-- GROUP.sub.-- GET.sub.-- USERS,
    &sqlupm.sub.-- group, &sqlca);
     if(sqlupm.sub.-- group.total.sub.-- entries > 0) && (rc == 0)
     {
      sqlupm.sub.-- group.buflen = sizeof(userid) *
        sqlupm.sub.-- group.total.sub.-- entries;
      sqlupm.sub.-- group.buffer = malloc(sqlupm.sub.-- group.buflen);
       rc =
    sqladupm("DOMAIN1", SQL.sub.-- GROUP.sub.-- GET.sub.-- USERS,&sqlupm.sub.-
    - group,
       &sqlca);
      if (rc == 0)
      {
       *user = *sqlupm.sub.-- group.buffer;
       for(i=1;i<=sqlupm.sub.-- group.entries;i++)
       {
        printf("%s /n",*user);
        for(j=0;j<=8;user++); /* move user ptr to next
    userid */
        }
       }
      }
    ______________________________________

• Inventors
  Jacobs, Dwayne Charles; Ibanez, Jesus Gerardo;
• Assignee
  International Business Machines, Corporation (Armon, NY)
• Published
  Dec-2-1997
• Current US Classes:
  707/10
  707/9
  709/225
  713/201
• Application #
  514795
• International Classes
  G06F 013/14
• Field of Search
  395/186 395/200.06 395/609 395/610 395/187.01 395/200.12
• Examiner
  Black; Thomas G.
• Agent
  LaBaw; Jeffrey S.
• US Patent References:
  4768150
  4805134
  5048085
  5058000
  5072370
  5239648
  5263157
  5305456
  5349678
  5481720
  5560008