Patent ID: 7103784
Filing Date: 2006-09-05
Classification: G06F,H04L

Abstract:
1. At a domain controller machine in a first domain of a distributed computing system, the domain controller machine configured from authenticating users in the first domain, a method for constructing and using an access-data-structure by a security principal, belonging to the first domain, to control access to a resource in a second domain of the distributed computing system that is restricted to authorised users, the access-data-structure including a plurality of entries corresponding to security groups, the security groups including a restricted nesting of groups having the security principal as a member and including at least one group controlling access to the resource, the method comprising the steps of: listing on the access-data-structure, in the domain controller machine in the first domain, an entry corresponding to a security principal; listing on the access-data-structure, in the domain controller machine in the first domain, additional entries, if any, corresponding to all global security groups wherein at least one member of each of the global security groups corresponds to an entry in the access-data-structure; listing on the access-data-structure additional entries, if any, corresponding to all universal security groups from any domain wherein at least one of the members of each of the universal security groups corresponds to an entry in the access-data-structure; and verifying the security principal's authorization to access the resource by checking to ensure that at least one entry on the security principal's access-data-structure is present in a list of objects authorized to access the resource.