SYSTEM AND METHOD FOR COMPUTER SYSTEM SECURITY AUTHORIZATION INTERFACES

Systems and methods for computer system security authorization interfaces are described, including a non-transitory computer readable medium having computer executable instructions that when executed cause a processor to direct a directory server to create a position group, the directory server storing position-access permissions assigned to a plurality of permission groups, and to assign the position group as a member within the permission groups; and to assign a username to the position group, thereby associating the position group with the person and assigning the position-access permissions to the person. The position groups contain no usernames and are each associated with no more than one person at any one time. An interface application may allow a user to communicate with a directory server to manage position-access permissions within a directory service domain based on positions within an organizational structure of an organization, rather than on usernames.

BACKGROUND

The security of technological systems is critical to the continuing operation of those systems. Technological security may include elements such as authentication of users and authorization of use of (that is, access to) individual technology for a user. This may include levels of authorizations that allow more or less access to one or more technological systems for a particular user based on what user-access permissions are assigned to the user. These technological systems may include, for example, software applications, reports, databases, network drives, and network-connected devices (such as network printers, network scanners, network photocopiers, network faxes, etc.).

Currently, there are electronic directory-based identity-related computer systems (also known as directory services) that fulfill these functions based on usernames for each user. One example of such a system is an enterprise identity service, which controls security based on usernames, which is sold under the trademark Active Directory, produced by Microsoft Corporation of One Microsoft Way, Redmond, WA 98052-7329.

It is not uncommon for a username to be associated with several hundred user-access permissions. However, a change of a user within an organization, such as a new user, a removed user, or a user moved within an organizational structure, necessitates an information technology administrator to change the username throughout the electronic directory services, which may be difficult, costly, and time-consuming. The current process of changing these permissions by username is error-prone and typically results in users having one or more wrong permissions or maintaining permissions that should be removed. Further, this may become unworkably complicated when performed at scale based on the current structures of directory services systems, for example, during a reorganization within, or acquisition by, an organization. In such cases, the user-access permissions for hundreds or thousands of users, and sometimes for hundreds of user-access permissions per user, must be changed, usually under short time constraints.

For example, organizations typically have an information technology (IT) department responsible for managing (assigning, changing, and deleting) user-access permissions to each of the organization's employees. To understand the scope of the problems, an IT department in a typical large organization may have a handful of employees to manage user-access permissions to hundreds of software applications, a thousand desktop and laptop computers, tens of thousands of reports, and volumes of servers and peripherals, based on employee usernames and needed access.

To be certain that an employee will only see the content that is relevant to their specific needs, each username is placed in each of the proper permission groups in a directory service system. To accomplish this, an IT employee typically spends many hours setting up the proper user-access permissions in a directory service system for the username, such as application groups, network resources (e.g., a desktop or laptop computer, a monitor, a phone, a printer, etc.), and reports. Former employees or moved employees must also have usernames moved or deleted from each and every user-access permission group.

Additionally, when organizations expand, new permission groups are created in the directory service and new usernames need to be established for each of the new employees and placed in each of the new permission groups. With the computer structure of current systems, this required a massive outlay of both computer resources and manhours (sometimes hundreds of manhours). Additionally, the structure of current user-access permission systems leads to errors and erroneous user-access permissions given or maintained, or needed user-access permissions not assigned. Keeping current user-access permission systems correct and “clean”—meaning that each employee has the proper access, resources, and information—is very difficult and time-consuming with current computer structures. In many cases, the permission groups that exist are inaccurate, outdated, and incomplete.

Accordingly, there exists a need for computer-implemented systems and methods configured to interface with a directory service to manage user access to network resources while being associated with real-world changes to an organization.

SUMMARY OF THE INVENTION

The problems described above involving managing electronic user access to computer network resources may be solved by computer-implemented systems and methods that transform organizational positions into user access, thereby eliminating the need for information technology personnel to change usernames throughout computer systems and thereby linking organizational position changes to user access. The computer-implemented systems and methods may change the structure of access permission systems to increase accuracy of those systems, while saving computer resources and/or IT resources. An interface application may allow a user to communicate with a directory server to manage access permissions within a directory service domain based on positions within an organizational structure of an organization (i.e., position-access permissions), rather than on usernames (i.e., username-based permissions).

In one implementation, a non-transitory computer readable medium may have computer executable instructions that when executed cause a processor to receive a first input from a user interface, the first input indicative of a username of a person to be associated or dissociated with a position within an organizational structure of an organization; and direct a directory server to assign the username to a position group within the directory server when the person is associated with the position and to remove the username from the position group when the person is dissociated with the position, thereby associating or dissociating correspondingly the position group with the person identified by the username, the position group associated with no more than one person at any one time, the directory server storing position-access permissions assigned to a plurality of permission groups, the plurality of permission groups containing no usernames, the position group associated with two or more permission groups of the plurality of permission groups, thereby assigning position-access permissions assigned to the two or more permission groups to the person associated with the position group or revoking the position-access permissions assigned to the two or more permission groups from the person dissociated with the position group.

In one implementation, a non-transitory computer readable medium may have computer executable instructions that, when executed, may cause a processor to receive a first input from a user interface, the first input indicative of a new position within an organizational structure of an organization; direct a directory server to create a position group for the new position within the directory server, the directory server storing position-access permissions assigned to a plurality of permission groups, the plurality of permission groups containing no usernames; direct the directory server to nest the position group within two or more permission groups of the plurality of permission groups by assigning the position group as a member within each of the two or more permission groups; receive a second input from the user interface, the second input indicative of a username associated with the new position, the username identifying a person assigned to the new position within the organization; and direct the directory server to assign the username to the position group, thereby associating the position group with the person identified by the username, the position group associated with no more than one person at any one time, and thereby assigning the position-access permissions within the two or more permission groups to the person associated with the position group.

In some implementations, the user interface may be a graphical user interface displayed on a display screen. The graphical user interface may comprise an interactive organizational chart corresponding to positions within a real-world organization.

The details of one or more implementations of the subject matter described in this specification are set forth in the accompanying drawings and the description below. Other aspects, features, and advantages of the subject matter will become apparent from the description, the drawings, and the claims.

DETAILED DESCRIPTION

Before explaining at least one embodiment of the inventive concept(s) in detail by way of exemplary language and results, it is to be understood that the inventive concept(s) is not limited in its application to the details of construction and the arrangement of the components set forth in the following description. The inventive concept(s) is capable of other embodiments or of being practiced or carried out in various ways. As such, the language used herein is intended to be given the broadest possible scope and meaning; and the embodiments are meant to be exemplary and not exhaustive. Also, it is to be understood that the phraseology and terminology employed herein is for the purpose of description and should not be regarded as limiting.

Headings are provided for convenience only and are not to be construed to limit the disclosure in any manner. Embodiments illustrated under any heading or in any portion of the disclosure may be combined with embodiments illustrated under the same or any other heading or other portion of the disclosure. Any combination of the elements described herein in all possible variations thereof is encompassed by the disclosure unless otherwise indicated herein or otherwise clearly contradicted by context.

Unless otherwise defined herein, scientific and technical terms used in connection with the presently disclosed inventive concept(s) shall have the meanings that are commonly understood by those of ordinary skill in the art. Further, unless otherwise required by context, singular terms shall include pluralities and plural terms shall include the singular. The foregoing techniques and procedures are generally performed according to conventional methods well known in the art and as described in various general and more specific references that are cited and discussed throughout the present specification.

All of the compositions, assemblies, systems, kits, and/or methods disclosed herein can be made and executed without undue experimentation in light of the present disclosure. While the compositions, assemblies, systems, kits, and methods of the inventive concept(s) have been described in terms of particular embodiments, it will be apparent to those of skill in the art that variations may be applied to the compositions and/or methods and in the steps or in the sequence of steps of the methods described herein without departing from the concept, spirit, and scope of the inventive concept(s). All such similar substitutions and modifications apparent to those skilled in the art are deemed to be within the spirit, scope, and concept of the inventive concept(s) as defined by the appended claims. In particular, where a method claim does not specifically state in the claims or description that the steps are to be limited to a specific order, it is no way intended that an order be inferred, in any respect. This holds for any possible non-express basis for interpretation, including matters of logic with respect to arrangement of steps or operational flow, plain meaning derived from grammatical organization or punctuation, or the number or type of embodiments described in the specification.

The use of the term “a” or “an” when used in conjunction with the term “comprising” in the claims and/or the specification may mean “one,” but it is also consistent with the meaning of “one or more,” “at least one,” and “one or more than one.” As such, the terms “a,” “an,” and “the” include plural referents unless the context clearly indicates otherwise. Thus, for example, reference to “a compound” may refer to one or more compounds, two or more compounds, three or more compounds, four or more compounds, or greater numbers of compounds. The term “plurality” refers to “two or more.”

The use of the terms “at least one” and “one or more” will be understood to include one as well as any quantity more than one, including but not limited to, 2, 3, 4, 5, 10, 15, 20, 30, 40, 50, 100, etc. The terms “at least one” and “one or more” may extend up to 100 or 1000 or more, depending on the term to which it is attached; in addition, the quantities of 100/1000 are not to be considered limiting, as higher limits may also produce satisfactory results. In addition, the use of the term “at least one of X, Y, and Z” or “one or more of X, Y, and Z” will be understood to include X alone, Y alone, and Z alone, as well as any combination of X, Y, and Z, including multiple Xs, Ys, and/or Zs. The use of ordinal number terminology (e.g., “first,” “second,” “third,” “fourth,” etc.) is solely for the purpose of differentiating between two or more items and is not meant to imply any sequence or order or importance to one item over another or any order of addition, for example.

The use of the term “or” in the claims is used to mean an inclusive “and/or” unless explicitly indicated to refer to alternatives only or unless the alternatives are mutually exclusive. For example, a condition “A or B” is satisfied by any of the following: A is true (or present) and B is false (or not present), A is false (or not present) and B is true (or present), and both A and B are true (or present).

As used herein, any reference to “one embodiment,” “an embodiment,” “some embodiments,” “one example,” “for example,” “one implementation,” “an implementation”, or “an example” means that a particular element, feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. The appearance of the phrase “in some embodiments,” “in some implementations,” or “some examples” in various places in the specification is not necessarily all referring to the same embodiments, for example. Further, all references to one or more embodiments, implementations, or examples are to be construed as non-limiting to the claims.

Throughout this application, the term “about” is used to indicate that a value includes the inherent variation of error for a composition/apparatus/device, the method being employed to determine the value, or the variation that exists among the study subjects. For example, but not by way of limitation, when the term “about” is utilized, the designated value may vary by plus or minus twenty percent, or fifteen percent, or twelve percent, or eleven percent, or ten percent, or nine percent, or eight percent, or seven percent, or six percent, or five percent, or four percent, or three percent, or two percent, or one percent from the specified value, as such variations are appropriate to perform the disclosed methods and as understood by persons having ordinary skill in the art. As used herein, qualifiers like “substantially,” “about,” “approximately,” and combinations and variations thereof, are intended to include not only the exact amount or value that they qualify, but also some deviations therefrom, which may be due to mathematical accumulated error, manufacturing tolerances, measurement error, wear and tear, stresses exerted on various parts, and combinations thereof, for example.

As used herein, the phrases “associated with” and “coupled to” include both direct association/binding of two components to one another as well as indirect association/binding of two components to one another.

As used herein, the term “organizational chart” refers to information pertaining to two or more positions belonging to an organization, and the relationship(s) between the two or more positions.

Circuitry, as used herein, may be analog and/or digital components, or one or more suitably programmed processors (e.g., microprocessors) and associated hardware and software, or hardwired logic. Also, “components” may perform one or more functions. The term “component,” may include hardware, such as a processor (e.g., microprocessor), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a combination of hardware and software, and/or the like.

The term “processor” as used herein means a single processor or multiple processors working independently or together to collectively perform a task.

One or more processors may be implemented as a single processor or a system of multiple processors working together or independently to execute computer executable instructions as described herein. Exemplary embodiments of the processor(s) include a digital signal processor (DSP), a central processing unit (CPU), a field programmable gate array (FPGA), a microprocessor, a multi-core processor, and/or combinations thereof. The processor(s) may be capable of communicating with the one or more non-transitory computer readable media. It is to be understood that in certain embodiments where the one or more processors is a system of multiple processors, the multiple processors may be located remotely from one another, may be located in the same location, or may comprise a unitary multi-core processor. The one or more processors may be capable of reading and/or executing the computer executable instructions and/or of retrieving, creating, manipulating, altering, and/or storing computer data structures into the one or more non-transitory computer readable media, such as into one or more databases.

The term “one or more non-transitory computer readable media” may refer to one or more non-transitory computer readable media implemented as a conventional non-transitory memory, such as, for example, random access memory (RAM), a hard drive, a solid-state drive, a flash drive, a memory card, a non-transitory optical drive, and/or combinations thereof. The one or more non-transitory computer readable media may be implemented as a “cloud memory” (i.e., one or more non-transitory computer readable media may be partially or completely based on or accessed using a network). The one or more non-transitory computer readable media may be located in the same or in a different physical location than other computer system components. When located in a different physical location, the one or more non-transitory computer readable media may communicate with the other components, for example, via a network.

Turning now to the inventive concept(s), in general, certain non-limiting implementations include systems and methods for transforming organizational position changes from a user, or an external data source, into access permission changes by interfacing between a user and a directory server structured to manage access permissions for network resources, while eliminating the need for time-consuming, error-prone, and costly access permission changes that are structured in current systems. An interface application may allow the user to communicate with a directory server, such as via a network, to manage access permissions within a directory service domain based on positions within the organizational structure of an organization (i.e., position-access permissions), rather than on usernames.

In one implementation, an exemplary system comprises a non-transitory computer readable medium having computer executable instructions that when executed may cause a processor to: receive a first input from a user interface, the first input indicative of a username of a person to be associated or dissociated with a position within an organizational structure of an organization; and direct a directory server to assign the username to a position group within the directory server when the person is associated with the position and to remove the username from the position group when the person is dissociated with the position, thereby associating or dissociating correspondingly the position group with the person identified by the username, the position group associated with no more than one person at any one time, the directory server may store position-access permissions assigned to a plurality of permission groups, the plurality of permission groups containing no usernames, the position group may be associated with two or more permission groups of the plurality of permission groups, thereby assigning position-access permissions assigned to the two or more permission groups to the person associated with the position group or revoking the position-access permissions assigned to the two or more permission groups from the person dissociated with the position group.

In one implementation, an exemplary system comprises a non-transitory computer readable medium having computer executable instructions that when executed may cause a processor to: receive a first input from a user interface, the first input indicative of a new position within an organizational structure of an organization; direct a directory server to create a position group for the new position within the directory server, the directory server storing position-access permissions assigned to a plurality of permission groups, the plurality of permission groups containing no usernames; direct the directory server to nest the position group within two or more permission groups of the plurality of permission groups by assigning the position group as a member within each of the two or more permission groups; receive a second input from the user interface, the second input indicative of a username associated with the new position, the username may identify a person assigned to the new position within the organization; and direct the directory server to assign the username to the position group, thereby associating the position group with the person identified by the username, the position group may be associated with no more than one person at any one time, and thereby assigning the position-access permissions assigned to the two or more permission groups to the person associated with the position group. Various aspects of the present disclosure are provided in detail below.

Referring now to the drawings and in particular toFIG.1, shown therein is a block diagram of an exemplary embodiment of a computer system100constructed in accordance with the present disclosure. The computer system100may include a directory server102(also referred to as a “name server” or a “domain controller”) and one or more user devices104. The directory server102and the one or more user devices104may be connected to, or be part of, a network106. The directory server102and the one or more user devices104may be configured to communicate, for example, via the network106. In some implementations, the computer system100may further comprise, and/or may be in bidirectional communication with, one or more host servers119connected to the network106. The computer system100may include, and/or may be in bidirectional communication with, one or more network resources121. The computer system100may include, and/or may be in bidirectional communication with, one or more external software applications132and/or one or more external databases134.

The one or more user devices104may include one or more first non-transitory computer readable media108. The one or more first non-transitory computer readable media108may store one or more databases110and/or interface computer executable instructions112(i.e., software code). The interface computer executable instructions112may be referred to herein as an interface application112. The one or more user devices104may further comprise one or more processors114, one or more input devices116, one or more displays118, and/or a network device120enabling the one or more user devices104to connect to the network106.

The one or more user devices104may be implemented as a desktop computer, a laptop computer, a smartphone, a computer tablet, a computer kiosk, or other computing device, for example.

The one or more input devices116of the one or more user devices104may be configured to receive information directly from a user (such as a person or other computer system), the processors114, and/or other components of the computer system100or external components, such as via the network106. The one or more input devices116may be implemented as a keyboard, a touchscreen, a mouse, a trackball, a microphone, a fingerprint reader, an infrared port, a cell phone, a personal digital assistant (PDA), a controller, a network interface, speech recognition system, gesture recognition system, eye-tracking system, brain-computer interface system, and/or combinations thereof, for example.

The one or more displays118of the one or more user devices104may be configured to output information in a form perceivable by a user and/or the one or more processors114and/or other components of the computer system100. The one or more displays118may be implemented as and/or be part of a computer monitor, a screen, a touchscreen, a speaker, a website, a television set, an augmented reality system, a smart phone, a personal digital assistant (PDA), a cell phone, a fax machine, a printer, a laptop computer, an optical head-mounted display (OHMD), a hologram, and/or combinations thereof, for example.

The interface application112may comprise program logic. The interface application112when executed by the one or more processors114may cause the one or more processors114to carry out one or more actions. For example, in some implementations, the interface application112may include a web browser and/or a native software application configured to communicate with the directory server102via the network106. The interface application112may be configured to access a website and/or communicate information and/or data with the directory server102via the network106. The interface application112may be configured to enable one or more users to indirectly interact with the directory server102.

In some implementations, the interface application112may be stored partially or completely on one or more external non-transitory computer readable media108a, such as located within the host server119. The host server119may have one or more processors114aand may be configured to communicate with the one or more user devices104and the directory server102, directly and/or through the network106. The host server119may store one or more databases110aon the one or more external non-transitory computer readable media108a. For simplicity, in describing how the interface application112is implemented, the one or more processors114of the one or more user devices104may be referred to interchangeably with the one or more processors114aof the host server119, but it will be understood that either or both may be used. Likewise, the one or more databases110of the one or more user devices104may be referred to interchangeably with the one or more databases110aof the host server119but it will be understood that either or both may be used.

The interface application112may cause the one or more processors114to generate a graphical user interface136. The graphical user interface136may be displayed on the display118of the one or more user devices104.

The interface application112of the one or more user devices104and/or the host server119may be configured to enable one or more users to interact with the user interface136on the display118in order to transform user input that is based on employee organization into commands to the directory server102, the commands indicative of structuring user access to the network resources121. The one or more users may be people and/or other components of the computer system100, such as, for example, the one or more external software applications132and the one or more external databases134, and/or other computer systems.

As illustrated inFIG.2, in some implementations, the graphical user interface136may include an organizational chart area200containing an organizational chart202depicting two or more positions204of employees within a real-world organization and relationship(s) between the two or more positions204. The organizational chart202is editable, such that the positions204may be created, edited, moved, or deleted within the organizational chart202. In some implementations, the graphical user interface136is configured to accept input from the user, such as by a user moving a cursor206for creating, editing, moving, or deleting the position(s)204within the organizational chart202, such as via “drag and drop” techniques.

Though the cursor206is used by way of example to describe a configuration for user input throughout the description, in some implementations, the graphical user interface136may be configured to accept input from the user in additional or alternative other manners, non-exclusive examples of which include, through one or more touch screens, bodily movement interpretation devices, and/or verbal commands recognition devices.

In some implementations, the graphical user interface136may include the organizational chart202along with position-builder icons208indicative of options to define the one or more positions204within the organization. The graphical user interface136may be configured such that a user may select one or more position-builder icons208, which provide corresponding group options210in a group option subwindow212for position-access for the positions204in the organizational chart202. In some implementations, the user may assign one or more of the group options210to one or more of the positions204within the organizational chart202with the graphical user interface136on the display118. In some implementations, the graphical user interface136is configured to accept input from the user moving the cursor206for assigning the group options210to the position(s)204, such as via “drag and drop” methods. In some implementations, the graphical user interface136is configured to accept text input from the user for assigning the group options210to the position(s)204. In some implementations, the group options210may be assigned to the positions204within the organizational chart202via other means, such as through the interface application112causing the one or more processors114to import information indicative of the group options210for one or more of the positions204without the use of the position-builder icons208.

In some implementations, the group options210may segment, divide, and/or identify particular portions of the organization, such as structural subgroups of the organization in the real world. Nonexclusive examples of structural subgroups include companies, divisions, areas, locations, and/or departments of an organization. For example, a position-builder icon208may be designated as “Divisions” and associated ones of the group options210may include two or more subgroups of the organization that are predetermined as divisions.

In some implementations, the position-builder icons208may be associated with group options210that are indicative of reports and/or software applications for use by the position204.

In some implementations, the position-builder icons208may be associated with group options210indicative of one or more lists of employees of the organization. In some implementations, the position-builder icons208may be associated with group options210indicative of templates (template groups316a-n) and/or projects (project groups317a-n), which includes predetermined combinations of group options210associated with other position-builder icons208.

One or more of group options210may be utilized to filter other ones of the group options210to further specify user permissions, such as to access to a portion of all access for the group option210. For example, a group option210associated with a particular one of the “Divisions” may be used to filter a group option210associated with a particular report, such that the report access is limited to user-permissions for reports having data about the particular one of the “Divisions” and/or limiting access within the reports to data about the particular one of the “Divisions”.

Returning toFIG.1, in one implementation, the network106may be the Internet and a user using the one or more user devices104may communicate with the interface application112, such as on the host server119, via the network106using a series of web pages.

The network106may be almost any type of network and may be implemented as the World Wide Web (or Internet), a local area network (LAN), a wide area network (WAN), a metropolitan network, a wireless network, a cellular network, a Global System for Mobile Communications (GSM) network, a code division multiple access (CDMA) network, a 3G network, a 4G network, a 5G network, a satellite network, a radio network, an optical network, a cable network, a public switched telephone network, an Ethernet network, and/or combinations thereof. It is contemplated that implementations of the present disclosure may use more advanced networking topologies.

The one or more network resources121may include, for example, one or more of software applications, network drives, and network peripherals. Non-exclusive examples of network peripherals may include printers, scanners, photocopiers, faxes, servers, computer stations, computer kiosks, and so on. In certain embodiments, each of the one or more network resources121may be provided with one or more categories. Non-exclusive examples of categories include accounting, sales, operations, marketing, finance, C-suite, payroll, human resources, and manufacturing. The categories may be used by a user or a interface-application system administrator (i.e., a user associated with a position with administrator access to the interface application112) to filter the network resources121that are viewable in one or more of the application windows described herein. For example, one or more of the application windows may be provided with a category dropdown menu for selecting one of the categories. For example, selecting the “accounting” category from the category dropdown menu may filter out irrelevant network resources121, leaving only the network resources121that are relevant to an “accounting” position (e.g., an accounting software application, a printer in the accounting physical area, and so on).

As illustrated inFIG.1, the directory server102may include one or more second non-transitory computer readable media122and one or more processors128. The one or more second non-transitory computer readable media122may store one or more databases124and/or directory computer executable instructions126(i.e., software code). The directory computer executable instructions126may be referred to herein as the directory service application126. In some implementations, the directory server102may comprise a network device130enabling the directory server102to connect to the network106.

In some implementations, the directory server102may be implemented using a server system having multiple servers. One or more of the multiple servers may be a virtual machine server. The multiple servers may or may not be located in a single physical location.

The one or more databases124of the directory server102may store, for example, a directory service domain300, one or more usernames306, one or more position groups302, a plurality of permission groups304a-n, position-access permissions308, information regarding the network resources121, and/or combinations thereof. The one or more databases124may store information regarding users, components of the computer system100, and/or other computer hardware.

FIG.3illustrates a block diagram of an exemplary embodiment of a directory service domain300constructed in accordance with the present disclosure. As shown inFIG.3, the directory service domain300may be a collection of objects stored in the one or more databases124and managed by the directory server102. Nonexclusive examples of the objects include information indicative of the usernames306, the position groups302, the permission groups304a-n, the network resources121, and position-access permissions308a-n(which may be referred to in the plural or in the singular). In some implementations, the one or more databases124of the directory server102may store one or more of: a schema defining which types of objects may be added to the directory service domain300; a list of names for the objects added to the directory service domain300; references and interrelations between the objects added to the directory service domain300; and assignments of position-access permissions308to the plurality of permission groups304a-n.

In the example shown inFIG.3, the interface application112causes the one or more processors114to instruct the directory server102such that a position group302is nested within two or more permission groups304a-nof a plurality of permission groups304a-nby assigning the position group302as a member within each of the two or more permission groups304a-n. The interface application112may cause the one or more processors114to assign a username306to (or dissociate a username306from) the position group302, without directly assigning the username306to any permission group304.

The position group302may be associated with a particular position204within an organizational structure of an organization (e.g., a “CEO” position group302may be associated with a position204identified as a “CEO”). The username306may identify a person assigned to the position204or associated with the position204. The position group302may be associated with no more than one person (i.e., username306) at any one time.

Each of the plurality of permission groups304a-nmay be associated with one or more of the position-access permissions308and/or may be configured to function as a repository for the position-access permissions308. The plurality of permission groups304a-ncontain no usernames306.

The position group302may be configured to function as a connection point between the username306and the two or more permission groups304a-n. That is, the position group302being associated with no more than one person at a time, and the plurality of permission groups304a-ncontaining no usernames306, provide that the position-access permissions308are assigned to the position204associated with the position group302, rather than the person identified by the username306.

In some implementations, the plurality of permission groups304a-nmay include one or more permission groups304that correspond to the group options210. For example, in some implementations, as shown inFIG.3, the plurality of permission groups304a-nmay include one or more of: section groups310a-n, software application groups312a-n, report groups314a-n, template groups316a-n, and project groups317a-n.

In some implementations, the section group(s)310a-nmay comprise position-access permissions308abased on structural subgroups of the organization in the real world. Examples of the structural subgroups include companies, divisions, departments, areas, and geographic locations. The position-access permissions308aassigned to the one or more section groups310a-nmay include position-access permissions308for accessing one or more of the network resources121, such as network drives and/or one or more computer network peripherals, for example. The computer network peripherals may comprise network-connected devices, nonexclusive examples of which include one or more of network printers, network scanners, network photocopiers, and network faxes.

In some implementations, the software application group(s)312a-nmay comprise position-access permissions308bfor group members to access particular software applications. The report group(s)314a-nmay comprise position-access permissions308cfor group members to access one or more predetermined reports. The template group(s)316a-nand/or the project groups317a-nmay comprise position-access permissions308d,308efor group members to access a combination of two or more of the predetermined reports and/or the particular software applications.

In some implementations, the one or more section groups310a-nmay be configured to limit the position-access permissions308available to each username306based on the group options210assigned to the position204to define the location of the position204in the structural subgroups of the organization in the real world. For example, the position group302associated with the corresponding position204may be a member of a permission group304a-n(i.e., an application group312a-nor a report group314a-n) that is assigned position-access permissions308for a particular application or report. Nevertheless, because the position group302is a member of a particular section group310a-ncorresponding to the assigned group option210, the contents of the particular report or application that are available to the position204may be limited to contents or portions specific to that assigned group option210. The contents that are actually available to the user may include, for example, functionality or information that is specifically tailored to the structural subgroup.

In some implementations, though a position group302may be associated with a particular permission group304a-n, the contents of a particular application or report that are available to a position204(and therefore to a user associated with the position204) may be limited based on the position204of the user within the structural subgroups of the organization in the real world. That is, the position group302associated with the position204may be a member of a particular section group310a-nthat limits access of the user assigned to the position204to a particular application or report to, for example, functionality or information that is specifically tailored to the structural subgroup.

In some implementations, none of the plurality of permission groups304a-n(such as the section groups310a-n, the software application groups312a-n, the report groups314a-n, the template groups316a-n, and the project groups317a-n, for example) include the usernames306. Rather, each position group302may contain up to one single username306. Membership of the position group302within one or more of the plurality of permission groups304a-nconveys position-access permissions308from the permission groups304a-nthrough the position group302to the username306in the position group302.

For example, in some implementations, adding the single username306to the position group302may assign all of the position-access permissions308of the permission groups304a-nin which the position group302is a member to the username306in the position group302. Removing the single username306from the position group302may remove all of the position-access permissions308of the permission groups304a-nin which the position group302is a member from the username306.

Returning now toFIG.1, the directory service application126of the directory server102may comprise program logic which may include program logic to manage user access to the network resources121, such as described above. For example, the directory service application126when executed by the one or more processors128of the directory server102may cause the one or more processors128to carry out one or more actions, including, for example, writing data to the one or more databases124of the directory server102; reading data from the one or more databases124; receiving, interpreting, and enacting commands from the interface application112; maintaining a schema stored in the one or more databases124defining which types of objects (e.g., usernames306, position groups302, permission groups304a-n, network resources121, and position-access permissions308) may be added to the directory service domain300; adding objects to the directory service domain300; deleting objects from the directory service domain300; maintaining a list of names for the objects added to the directory service domain300to ensure that each is distinct; maintaining references and interrelations between the objects added to the directory service domain300; maintaining the assignment of position-access permissions308associated with the plurality of permission groups304a-nto one or more position groups302; and responding to authentication requests from users allowing or disallowing access to the one or more network resources121based on the position-access permissions308assigned to the users because of their membership within the one or more position groups302.

Exemplary methods of the computer system100in use will now be described. In one embodiment, the interface application112of the one or more user devices104and/or the host server119, when executed, may cause the one or more processors114to receive position input from the user interface136regarding one or more positions204within an organization and transform the position input into directions to the directory server102to update user access based on the position group302, which is nested in the one or more permission groups304a-n, stored in the non-transitory computer readable media122of the directory server102. In some implementations, the position input is received through an organizational chart202depicted in the user interface136. In some implementations, the position input is received from the one or more external software applications132and/or the one or more external databases134.

Referring now toFIG.4, shown therein is a process flow diagram of an exemplary embodiment of a computer-implemented method400practiced in accordance with the present disclosure. The computer-implemented method400generally comprises the steps of: receiving a first input indicative of a new position204within an organization (step402); directing the directory server102to create a corresponding position group302for the new position204(step404); directing the directory server102to nest the position group302within the two or more permission groups304a-n(step406). The method may further comprise receiving a second input indicative of a particular username306of a person associated with the position204(step408); and directing the directory server102to assign the username306to the position group302(step410). It will be understood that two or more of the steps of the method400may be performed simultaneously or may be performed in sequence or may be performed with a time delay between the steps.

As illustrated inFIG.5A, the step of receiving the first input indicative of the new position204(step402) may further comprise receiving, with one or more processors114, a first input through the user interface136, the first input indicative of the new position204within an organizational structure of an organization. The input may be received from a person, the one or more external software application132, and/or the one or more external databases134, for example.

In some implementations, the user interface136may include a position window500configured to accept the first input from a user. In some implementations, the position window500may include a create icon502, a positions list icon504, a position subwindow506, and/or an organizational chart area200.

The graphical user interface136may be configured to accept input from the user utilizing the input device116to move a cursor206, for example, to various locations on the display118and select one or more elements depicted in the user interface136. The create icon502may be configured to be selectable, such as by a user moving the cursor206over the create icon502and, upon being selected, to display an input screen, such as a pop-up window510(FIG.5B) over the position window500on the display118. Though the pop-up window510is used by way of example to describe a configuration for the input screen, in some implementations, the graphical user interface136may be configured to display the input screen in additional or alternative other manners (e.g., as an additional window). The positions list icon504may be configured to be selectable, such as by the user moving the cursor206over the positions list icon504and, upon being selected, to display a list of positions204when available.

The list of the positions204and/or information about the positions204may be stored in the one or more databases110of the user device104, the one or more databases110aof the host server119, the one or more databases124of the directory server102, and/or the one or more external databases134.

The position subwindow506may be configured to display the one or more position icons (e.g., a first position icon602and a second position icon604as shown inFIG.6A) indicative of the positions204, such as from the list of the positions204and/or as new ones of the positions204are created. The organizational chart area200may be configured to display an organizational chart202.

As shown inFIG.5B, in some implementations the pop-up window510may be used to define group options210for the position204. The pop-up window510may include one or more text fields512a-n, a submit icon514, and a cancel icon516. The one or more text fields512a-nmay be configured to receive one or more of the group options210from the user utilizing the input device116, the one or more inputs indicative of various descriptors (e.g., name, description, company, division, department, area, location, project, category) of the group options210for a new position204within the organizational structure of the organization. In some implementations, one or more of the one or more text fields is a dropdown menu.

In some implementations, the pop-up window510may further include one or more radio buttons518a-nwhich may be used to define one or more position-access permissions308for the position204, the one or more radio buttons518a-nconfigured to receive one or more binary inputs from the user utilizing the input device116. In some implementations, the one or more binary inputs are indicative of one or more software applications, one or more network resources, and/or one or more predetermined reports for which the position204is to be assigned position-access permissions308. The one or more radio buttons518a-nof the pop-up window510over the position window500may be similar in form and function to the one or more radio buttons1516a-nof the pop-up window1512over the template window1500, discussed in greater detail below.

In some implementations, the pop-up window510may further include a template dropdown menu520configured to receive a template from the user utilizing the input device116. Responsive to the user selecting a template from the template dropdown menu520, the interface application112may automatically select one or more of the radio buttons518a-ncorresponding to one or more position-access permissions308associated with the template. Responsive to the user de-selecting a first template from the template dropdown menu520(for example, by selecting a second template), the interface application112may automatically de-select the one or more radio buttons518a-ncorresponding to one or more position-access permissions308associated with the first template and then select the one or more radio buttons518a-ncorresponding to one or more position-access permissions308associated with the second template.

Referring now toFIGS.6A and6B, in some implementations, the position subwindow506may display one or more position icons (e.g., the first position icon602and the second position icon604) indicative of created ones of the positions204. The first position icon602and the second position icon604may be configured to be selectable, such as by a user moving the cursor206, for example, over the first position icon602and, upon being selected, to be movable by the user moving the cursor206and placeable in the organizational chart area200, and thereby placeable in the organizational chart202(seeFIG.6B). In some implementations, upon the first position icon602being graphically placed by the user in the organizational chart area200, the graphical user interface136may automatically update the organizational chart202by adding the first position icon602into the organizational chart202and displaying the organizational chart202, including the first position icon602, in the organizational chart area200. The organizational chart202may be an interactive organizational chart.

The step of directing the directory server102to create the position group302for the new position (step404) may further comprise the interface application112causing the one or more processors114to direct the directory server102to create the position group302for the new position204within the directory server102.

As shown inFIG.5B, in some implementations, the submit icon514may be configured to be selectable, such as by a user moving the cursor206over the submit icon514and, upon being selected, the interface application112may cause the one or more processors114to transmit (such as via the network106) a signal indicative of query directing the directory server102to create the position group302for the new position204, nest the position group302within the two or more permission groups304a-ncorresponding to the one or more inputs of the group options210received by the one or more text fields512a-n(i.e., the one or more section groups310a-ncorresponding to, for example, the division, department, area, and/or location received by the one or more text field512a-n), and store the position group302in the one or more databases124of the directory server102. The cancel icon516may be configured to be selectable, such as by a user moving the cursor206over the cancel icon516and, upon being selected, to close the pop-up window510and display the position window500on the display118. In one embodiment, the one or more inputs indicative of the new position204are received from the one or more external software applications132(e.g., a human resources software system) and/or the one or more external databases134.

The step of directing the directory server102to nest the position group302within the two or more permission groups304a-n(step406) may further comprise the interface application112causing the one or more processors114to direct the directory server102to nest the position group302within two or more permission groups304a-nof the plurality of permission groups304a-nby assigning the position group302as a member within each of the two or more permission groups304a-n. The plurality of permission groups304a-nmay be assigned the position-access permissions308and contain no usernames306.

As illustrated inFIGS.7A and7B, the step of receiving the second input indicative of the username306(step408) may further comprise receiving, with the one or more processors114, a second input from the user interface136, the second input indicative of a username306associated with the new position204, the username306identifying a person assigned to the new position204within the organization.

In some implementations, the user interface136may include an employee window700. The employee window700may include an employee list icon704, an employee subwindow706, and the organizational chart area200, for example. The employee list icon704may be similar in form and function to the positions list icon504, except that, upon being selected, the employee list icon704may be configured to display a list of employees associated with corresponding ones of the one or more usernames306. The employee subwindow706may be configured to display one or more employee icons702indicative of employees from the list of employees. The employee list(s) and/or the one or more usernames306may be stored in one or more of: the one or more databases110of the user device104, the one or more databases110aof the host server119, the one or more databases124of the directory server102, and the one or more external databases134. In some implementations, the list of employees and/or the one or more usernames306may be entered into the one or more databases110,110aand/or imported from the one or more external databases134into the one or more databases110,110aof the user device104and/or the host server119.

In some implementations, the one or more employee icons702may be configured to be selectable, such as by a user moving the cursor206over the one or more employee icons702and, upon being selected, to be movable by the user moving the cursor206and placeable in the organizational chart area200on a position icon602, such as by using “drag and drop” methods, for example, thereby assigning the person associated with the employee icon702to the position204associated with the position icon602.

The step of directing the directory server102to assign the username306to the position group302(step410) may further comprise the interface application112causing the one or more processors114to direct the directory server102to assign the username306to the position group302, thereby associating the position group302with the person identified by the username306, the position group302associated with no more than one person at any one time, and thereby assigning the position-access permissions308assigned to the two or more permission groups304a-nto the person associated with the position group302.

In some implementations, upon an employee icon702being placed in the organizational chart area200on a position icon602, the interface application112may cause the one or more processors114to transmit via the network106a signal indicative of a query directing the directory server102to assign the username306associated with the employee icon702to the position group302associated with the position icon602. Assigning the username306to the position group302may have the effect of assigning the position-access permissions308within the two or more permission groups304a-nto the username306based on membership of the username306within the position group302.

FIG.8illustrates an exemplary computer-implemented method800for associating or dissociating a person with an existing position204. In a step802, the interface application112may receive from a user input indicative of person associated or dissociated with a position204. The user may be a person and the input may be received via the user interface136and/or the user may be the one or more external software applications132or external databases134, for example. In a step804, the interface application112may cause the one or more processors114to direct the directory server102to associate or dissociate the username306from the position group302, thereby associating or dissociating corresponding position-access permissions308assigned to the permission groups304a-nin which the position group302is nested with the person.

In one implementation, as shown inFIG.7B, the one or more employee icons702, upon being placed in the organizational chart area200on the position icon602, may be configured to be selectable, such as by a user moving the cursor206over the one or more employee icons702and, upon being selected, to be movable by the user moving the cursor206and placed outside of the organizational chart area200. Upon an employee icon702being removed from the position icon602and the organizational chart area200, the interface application112may cause the one or more processors114to transmit via the network106a signal indicative of a query directing the directory server102to dissociate the username306associated with the employee icon702from the position group302associated with the position icon602. Dissociating the username306from the position group302may revoke the position-access permissions308assigned to the permission groups304a-nin which the position group302is nested from the username306.

Inputs received by the interface application112(through the graphical user interface136or external sources) may automatically be used by the interface application112to cause the one or more processors114,114ato update the organizational chart202by adding the username306to the first position icon602or removing the username306from the first position icon602, and displaying the organizational chart202, so updated, in the organizational chart area200. In one embodiment, the one or more inputs indicative of the username306to be associated with or dissociated from the new position204is received from the one or more external software applications132(e.g., a human resources software system) and/or the one or more external databases134(e.g., employee databases).

FIG.9illustrates an exemplary computer-implemented method900in accordance with the present disclosure for adding additional ones of the positions204to the organizational chart202. In a step902, the interface application112may cause the one or more processors114to receive a third input indicative of a second new position204; in a step904, the interface application112may cause the one or more processors114to direct the directory server102to create a second position group302for the second new position204. In some implementations, in a step906, the interface application112may cause the one or more processors114to direct the directory server102to nest the second position group302within the two or more permission groups304a-nin which the first position group302is nested.

For example, referring now toFIGS.10A and10B, upon a position group302being created for the first new position204, the position window500may be configured to allow a user to define and create one or more additional positions204(or edit the first new position204previously created) in a manner similar to that previously described for defining and creating the first new position204.

As illustrated inFIGS.11A and11B, in some implementations, the position subwindow506may display the second position icon604. In some implementations, the position subwindow506may display the second position icon604in response to the second position204being created. The second position icon604may be configured to be selectable, such as by a user moving the cursor206over the second position icon604and, upon being selected, to be movable by the user moving the cursor206and placeable in the organizational chart area200on the first position icon602, and thereby placeable in the organizational chart202such that the second position icon604is in a relationship with the first position icon602that is indicative of the relationship between the first position204and the second position204. For example, the second position icon604may be subordinate the first position icon602, and such that first position204associated with the first position icon602represents a supervisory position204to the second position204.

In some implementations, the interface application112may cause the one or more processors114to store relationship information indicative of the supervisory and/or subordinate relationships of the positions204to one another in the one or more databases110and/or the one or more external databases134. Changes to the organizational chart202may be stored in the one or more databases110and/or the one or more external databases134.

In some implementations, upon the second position icon604being placed in the organizational chart area200in relation to the first position icon602, the interface application112may cause the one or more processors114to transmit (such as via the network106) a signal indicative of a query directing the directory server102to nest the position group302for the second position204within the same one or more permission groups304a-nas those associated with the position group302for the first new position204.

In some implementations, as shown inFIGS.12A and12B, the first position icon602may be configured to display a first position tooltip1200aon the display118, such as upon the user moving the cursor206near the first position icon602. The first position tooltip1200amay display the various descriptors corresponding to the group options210for the first position204. Additionally, the second position icon604may be configured to display a second position tooltip1200bon the display118, such as upon the user moving the cursor206near the second position icon604. The second position tooltip1200bmay display the various descriptors corresponding to the group options210for the second position204. In this example, the position group302for the second position204and the position group302for the first position204are associated with the same group options210.

In some implementations, the one or more positions204may be editable such that the group options210associated with the one or more positions204may be added, updated, changed, or deleted. In some implementations, one or more of the group options210associated with a particular position204may be the same as the group options210associated with a supervisory position204to the particular position204. In some implementations, one or more of the group options210associated with the particular position204may differ from the group options210associated with the supervisory position204to the particular position204.

For example, in some implementations, upon being placed in the organizational chart area200, the one or more position icons (e.g., the first position icon602and the second position icon604) may be configured to be selectable, such as by a user moving the cursor206over the one or more position icons602,604and, upon being selected, to allow editing of the group options210of the position204.

In some implementations, the interface application112may display a position edit screen over the window (e.g., the position window500, the employee window700, and/or the template window1500) on the display118. The position edit screen may be similar in form and function to the input screen (e.g., the pop-up window510shown inFIG.5B), and/or the one or more text fields512a-nmay be pre-filled with the various descriptors (e.g., the name, the description, the division, the department, the area, and the location) for the position204, and the position edit screen may be configured to allow a user to edit one or more of the various descriptors of the group options210.

The one or more text fields512a-nmay be configured to receive one or more inputs indicative of a change to the group options210(e.g., a new name, a new description, a new department, a new area, and/or a new location). In response to the change (such as in response to the submit icon514being selected), the interface application112may cause the one or more processors114to transmit (such as via the network106) a signal indicative of a query directing the directory server102to remove the position group302from the two or more permission groups304a-ncorresponding to the original group options210and to nest the position group302within the two or more permission groups304a-ncorresponding to the new group options210.

In some implementations, creating or editing a position204may include assigning position-access permissions308b,308cfor accessing one or more software applications and/or one or more reports to the position204(or removing the position-access permissions308b,308ctherefrom). For example, as shown inFIGS.13and14, one or more application icons1308and/or one or more report icons1408may be configured to be selectable, such as by a user moving the cursor206over the one or more application icons1308and/or the one or more report icons1408and, upon being selected, to be movable by the user, such as by moving the cursor206, and placeable in the organizational chart area200on a position icon602, such as via “drag and drop” methods, for example, thereby assigning the position-access permissions308b,308cassociated with the one or more application icons1308and/or the one or more report icons1408to the position204associated with the position icon602. In some implementations, the graphical user interface136may be configured to receive input from a user for assigning the position-access permissions308for the software applications and/or reports to the position(s)204through text fields and/or selection fields.

For example, as shown inFIG.13, in some implementations, the user interface136may include an application window1300. The application window1300may include, for example, a create icon1302, an application list icon1304, an application subwindow1306, and the organizational chart area200. The interface application112when executed may cause the one or more processors114to cause the graphical user interface136on the display118to display the application icons1308in the application subwindow1306representing corresponding software applications. In this example, five application icons1308are shown, but it will be understood that any number of application icons1308may be displayed, such as determined by the user and/or added via a create icon1302. The create icon1302may be configured to be selectable, such as by a user moving the cursor206over the create icon1302and, upon being selected, to display an input screen, such as an application definition window1900b(FIG.19B) over the application window1300on the display118. The application list icon1304may be configured to be selectable, such as by the user moving the cursor206over the application list icon1304and, upon being selected, to display a list of applications when available.

The interface application112may cause the one or more processors114to receive input from the user indicative of software applications assigned to one or more of the positions204, such as the positions204associated with the first position icon602and the second position icon604. The assignment of the software applications may be through drag-and-drop, pop-up box interface, text entry, and/or other input methods. The interface application112may then cause the one or more processors114to direct the directory server102to assign the position group302for the corresponding position204to the application group(s)312a-ncorresponding to the software applications assigned through the user interface136to the position204. Assigning the position group302to the application group(s)312a-nmay cause position-access permissions308assigned to the application group(s)312a-nto be assigned to the position group302. Nonexclusive examples of software applications include word processing software, spreadsheet software, pdf editing or viewing software, the interface application112, human resource management software, website management or creation software, drafting software, data management software, specialty software, bespoke software, manufacturing software, production software, supply chain software, electronic health record software, and software suites.

Similarly, in the example shown inFIG.14, in some implementations, the user interface136may include a report window1400. The report window1400may include a create icon1402, a report list icon1404, a report subwindow1406, and the organizational chart area200. The interface application112when executed may cause the one or more processors114to cause the graphical user interface136on the display118to display the report icons1408representing corresponding reports. In this example, five report icons1408are shown, but it will be understood that any number of report icons1408may be displayed, such as determined by the user and/or added via a create icon1402. The create icon1402may be configured to be selectable, such as by a user moving the cursor206over the create icon1402and, upon being selected, to display an input screen, such as a report definition window1900a(FIG.19A) over the report window1400on the display118. The report list icon1404may be configured to be selectable, such as by the user moving the cursor206over the report list icon1404and, upon being selected, to display a list of reports when available.

The interface application112may cause the one or more processors114to receive input from the user indicative of reports assigned to one or more of the positions204, such as the positions204associated with the first position icon602and the second position icon604. The assignment of the reports may be through drag-and-drop, pop-up box interface, text entry, and/or other input methods. The interface application112may then cause the one or more processors114to direct the directory server102to assign the position group302for the corresponding position204to the report group(s)314a-ncorresponding to the reports assigned through the user interface136to the position204. Assigning the position group302to the report group(s)314a-nmay cause position-access permissions308assigned to the report group(s)314a-nto be assigned to the position group302. Nonexclusive examples of reports include accounting reports, human resource reports, and organizational performance metrics reports. Reports may include, for example, raw data, compiled data, graphics, charts, graphs, and/or images.

As shown inFIG.15A, in some implementations, creating or editing a position204may include assigning one or more templates to the position204. The one or more templates may be indicative of predetermined combinations of group options210. In this example, the graphical user interface136is shown including a template window1500which may include a create icon1502, a list icon1504, a template subwindow1506, and/or the organizational chart area200with the organizational chart202.

The create icon1502may be configured to be selectable, such as by a user moving the cursor206over the create icon1502and, upon being selected, to display a pop-up window1512over the template window1500on the display118. The templates list icon1504may be similar in form and function to the positions list icon504and the employee list icon704, except that, upon being selected, the templates list icon1504may be configured to display a list of one or more templates. The template subwindow1506may be configured to display one or more template icons1510corresponding to the one or more templates. The one or more templates and associated information regarding the one or more templates may be stored in the one or more databases110,110aof the user device104and/or the host server119.

Referring now toFIG.15B, in some implementations the pop-up window1512may include one or more of: text fields1514a-n, radio buttons1516a-n, a submit icon1518, and a cancel icon1520. The one or more text fields1514a-nmay be configured to receive one or more inputs from the user utilizing the input device116, the one or more inputs indicative of various descriptors (e.g., name, description, category) for a template to be assigned to the position204. The one or more radio buttons1516a-nmay be configured to receive one or more binary inputs from the user utilizing the input device116, the one or more binary inputs indicative of one or more predetermined reports, one or more network resources, and/or one or more software applications for which the template is to be assigned position-access permissions308. The submit icon1518may be configured to be selectable, such as by a user moving the cursor206over the submit icon1518and, upon being selected, the interface application112may cause the one or more processors114to transmit via the network106a signal indicative of a query directing the directory server102to create a template group316a-nfor the template.

In some implementations, as illustrated inFIGS.16A and16B, the template subwindow1506may display one or more template icons1510corresponding to one or more templates. The one or more template icons1510may be configured to be selectable, such as by a user moving the cursor206over the one or more template icons1510and, upon being selected, to be movable by the user moving the cursor206and placeable in the organizational chart area200on a position icon602indicative of the position204. Upon a template icon1510of the one or more template icons1510being placed in the organizational chart area200on the position icon602, the interface application112may cause the one or more processors114to transmit (such as via the network106) a signal indicative of a query directing the directory server102to assign the position group302associated with the position icon602to the template group316a-nassociated with the template icon1510. Assigning the position group302to the template group316a-nmay cause position-access permissions308assigned to the template group316a-nto be assigned to the position group302.

Turning now toFIGS.17A and17B, in some implementations, the interface application112stored by the one or more first non-transitory computer readable media108when executed may cause the one or more processors114to: receive input from a user through the user interface136, the input indicative of one or more positions204being moved within the organizational chart202; and direct the directory server102to re-assign position-access permissions308for the moved positions204. In some implementations, the moved position204may inherit the group options210from the supervisory position204to which it is re-assigned. The group options210for the moved position204may be changed.

In some implementations, two or more of the positions204may be moved within the organizational chart202simultaneously. For example, as illustrated inFIGS.17A and17B, a user may move a sub-set of the organizational chart202, the subset containing two or more position icons602associated with two or more positions204. The interface application112may cause the one or more processors114to direct the directory server102to re-assign position-access permissions308for the two or more moved positions204based on the new relationship within the organizational chart202. For example, the group options210for the two or more moved positions204may be automatically changed to match the group options210designated for the new supervisory position204and/or may be manually edited to maintain or change the group options210. The interface application112may cause the one or more processor114to direct the directory server102to nest the corresponding position groups302of the two or more positions204in the permission groups304a-ncorresponding to the group options210.

In some implementations, the interface application112stored by the one or more first non-transitory computer readable media108when executed may cause the one or more processors114to: receive a third input from the user interface136, the third input indicative of an access request by the person associated with the position group302to access one or more of particular software applications and predetermined reports; and direct the directory server102to determine, based upon the two or more permission groups304a-nwithin which the position group302is a member, whether the position-access permissions308assigned to the position group302include position-access permissions308to access the one or more of particular software applications and predetermined reports.

Additionally, the interface application112may cause the one or more processor114to carry out one or more of the following: receiving an organizational input via the user interface136; constructing one or more commands interpretable by the directory service application126based on the organizational input; and transmitting the one or more commands to the directory server102(such as via the network106or directly).

In some implementations, the interface application112may cause the one or more processors114,114aof the user device104and/or the host server119to receive communication from the directory server102if the directory service domain300is modified by a source external to the interface application112. In some implementations, the interface application112may cause the one or more processors114,114ato identify discrepancies between information stored in the one or more databases110,110aof the user device104and/or the host server119and information stored in the one or more databases124of the directory server102. For example, the user interface136may include an errors page displaying such discrepancies.

The organizational input may be indicative of a desired modification to the directory service domain300, including, for example, adding a username306as a member within a position group302, where the position group302is assigned to two or more permission groups304a-n, each of the two or more permission groups304a-nhaving one or more position-access permissions308. The command may, for example, direct the directory server102to assign the username306to the position group302. In response to receiving the command via the network106, the directory service application126may be configured to cause the one or more processors128to assign the position-access permissions308within the two or more permission groups304a-nto the username306based on its membership within the position group302. The interface application112may cause the one or more processors114to synchronize with the directory server102, and/or cause the user interface136to reflect that the position-access permissions308assigned to the position group302have been assigned to the username306. The interface application112may allow the user to communicate with the directory server102via the network106to manage position-access permissions308within the directory service domain300based on positions204within the organizational structure of an organization, rather than on usernames306.

It will be understood by persons having ordinary skill in the art that, while the organizational chart202is shown as having one to four levels, the organizational chart202may have any number of levels as necessary to accommodate the organizational structure of the organization.

As illustrated inFIG.18, in some implementations, the user interface136may include a section window1800. The section window1800may be used to define the group option210for the structural subgroups (such as Companies, Divisions, Areas, Locations, Departments, and so on) which may cause the interface application112to cause the one or more processors114to direct the directory service application126to define the corresponding section group310a-n. The section window1800may include one or more text fields1802a-nand/or a create icon1804. The one or more text fields1802a-nmay be configured to receive one or more descriptors (which may include, but are not limited to, a name, a description, a company, a street address, a city, a state, and/or a ZIP code) of one or more of the structural subgroups of the organization in the real world (which may include, but are not limited to, a company, a department, a division, an area, and/or a location).

The create icon1804may be configured to be selectable, such as by a user moving the cursor206over the create icon1804and, upon being selected, the interface application112may cause the one or more processors114to transmit (such as via the network106) a signal indicative of a query directing the directory server102to create a section group310a-nfor the new section and store the section group310a-nin the one or more databases124of the directory server102. Of course, it will be understood that the creation and/or definition of the group options210for the structural subgroups may be accomplished in other ways, including but not limited to, text fields, selection options, and radio buttons.

Each of the section groups310a-nmay be utilized by the directory service application126to cause the one or more processors128to restrict portions of the one or more reports, the one or more network resources, and/or the one or more software applications that are accessible by the position group302. For example, a position204may be in a first Division of the structural subgroups of the organization and be assigned the corresponding group option210, which is then associated with a first section group310aof the section groups310a-n. A particular username306may be associated with the position204which may be associated with the position group302, while the position group302may be a member of the first section group310a. A particular report and/or software application may include first contents which are relevant to the position204, such as sales data for the first Division, as well as second contents which are not relevant to the position204, such as sales data for a second Division of the structural subgroups associated with a second one of the section groups310a-n. The directory service application126may cause the one or more processors128to allow the employee with the username306associated with the position204to access to the first contents based on the membership of the position group302in the first section group310a, while also restricting the employee with the username306associated with the position204from accessing the second contents based on the exclusion of the position group302from the second one of the section groups310a-n.

As illustrated inFIG.19A, in some implementations, the user interface136may include a report definition window1900a. The report definition window1900amay be used to define a report. The report definition window1900amay include one or more text fields1902a-nand/or a create icon1904. The one or more text fields1902a-nmay be configured to receive one or more descriptors (which may include, but are not limited to, a name, a description, a category, and/or a path) of a report. The create icon1904may be configured to be selectable, such as by a user moving the cursor206over the create icon1904and, upon being selected, the interface application112may cause the one or more processors114to transmit (such as via the network106) a signal indicative of a query directing the directory server102to create (or edit) the report group314a-nfor the new (or edited) report and/or store the report group314a-nin the one or more databases124of the directory server102.

As illustrated inFIG.19B, in some implementations, the user interface136may include an application definition window1900b. The application definition window1900bmay be used to define a software application. The application definition window1900bmay include one or more text fields1906a-nand/or a create icon1908. The one or more text fields1906a-nmay be configured to receive one or more descriptors (which may include, but are not limited to, a name, a description, a category, and/or a path) of a software application. The create icon1908may be configured to be selectable, such as by a user moving the cursor206over the create icon1908and, upon being selected, the interface application112may cause the one or more processors114to transmit (such as via the network106) a signal indicative of a query directing the directory server102to create (or edit) an application group312a-nfor the new (or edited) software application and/or store the application group312a-nin the one or more databases124of the directory server102.

As illustrated inFIG.20, in some implementations, the user interface136may include an administration window2000. The administration window2000may include one or more administration icons2002a-n, which may include, for example, an approval workflow setup icon, a category setup icon, an API setup icon, an interface application security icon, an API console icon, a network resource setup icon, an API audit log icon, and a position audit log icon. Each of the one or more administration icons2002a-nmay be configured to be selectable, such as by a user moving the cursor206over the icon2002a-n, and, upon being selected, to display one of the windows on the display118as described herein (see, for example,FIGS.22-30). For example, selecting the approval workflow setup icon may cause the approval workflow setup window2400(FIG.24) to be displayed, selecting the category setup icon may cause the category setup window2600(FIG.26) to be displayed, selecting the API setup icon may cause the API setup window2900(FIG.29) to be displayed, selecting the interface application security icon may cause the interface application security window2500(FIG.25) to be displayed, selecting the API console icon may cause the API console window3000(FIG.30) to be displayed, selecting the network resource setup icon may cause the network resource setup window2700(FIG.27) to be displayed, selecting the API audit log icon may cause the API audit log window2300(FIG.23) to be displayed, and selecting the position audit log icon may cause the position audit log window2200(FIG.22) to be displayed. Additional or alternative selectable icons and windows may be displayed. Though icons and windows are described in this and other examples herein, in will be understood that other user interfaces may be used.

In some implementations, the integration between the interface application112and the directory service application126is bi-directional, meaning that any modifications to the directory service domain300made by a user in the interface application112may be applied automatically in the directory service application126, and vice-versa.

In one embodiment, the interface application112when executed may cause the one or more processors114to print a graphical representation of the organizational chart202. In some implementations, access to and/or printing of the organizational chart202may be controlled by position-access permissions308. For example, particular positions may be assigned position-access permissions308such that particular positions have access to, and/or the ability to print, parts of the organizational chart202while being blocked from access to and/or printing other parts of the organizational chart202.

In some implementations, printing the graphical representation of the organizational chart202may include copying the organizational chart202to a file, which may be saved in a portable document format (e.g., PDF) or printed on, for example, one or more pieces of paper utilizing a printer. The one or more databases110,110aof the user device104and/or the host server119may store the organizational chart202.

In one embodiment, the interface application112of the one or more user devices104and/or the host server119, when executed, may cause the one or more processors114to receive a first input from the user interface136, the first input indicative of a new position204within an organizational structure of an organization. The interface application112may cause the one or more processors114to direct the directory server102to create a corresponding position group302for the new position204within the directory server102, the directory server102storing position-access permissions308assigned to a plurality of permission groups304a-n, the plurality of permission groups304a-ncontaining no usernames306; direct the directory server102to nest the position group302within two or more permission groups304a-nof the plurality of permission groups304a-nby assigning the position group302as a member within each of the two or more permission groups304a-n; receive a second input from the user interface136, the second input indicative of a username306associated with the new position204, the username306identifying a person assigned to the new position204within the organization; and direct the directory server102to assign the username306to the position group302, thereby associating the position group302with the person identified by the username306, the position group302associated with no more than one person at any one time, and thereby assigning the position-access permissions308assigned to the two or more permission groups304a-nto the person associated with the position group302.

Referring now toFIG.21, shown therein is a data flow diagram of cascading position-access permissions308in an exemplary embodiment of another directory service domain300aconstructed in accordance with the present disclosure. As in the previous directory service domain300, the position group302does not include any position-access permissions308a-n. Rather, the position group302may inherit one or more position-access permissions308a-nfrom one or more permission groups304a-n, which may include: position-access permissions308afor accessing one or more network resources121, which may be inherited from one or more section groups310a-n; position-access permissions308bfor accessing one or more applications, which may be inherited from one or more application groups312a-n; position-access permissions308cfor accessing one or more reports, which may be inherited from one or more report groups314a-n; and/or a combination of position-access permissions308b,308cfor accessing one or more applications and/or one or more reports (i.e., position-access permissions308d), which may be inherited from one or more template groups316a-nand/or one or more project groups317a-n.

Additionally, the directory service domain300amay be configured such that one or more of the section groups310a-nmay act as a filter for position-access permissions for the one or more of the application groups312a-nand/or the report groups314a-n. The group options210and corresponding section groups310a-nmay act as a filter for position-access permissions for the position group302and thereby for the position204, and the employee assigned to the position204. For example, the position group302may be assigned to a first one of the section groups310a-nthat is associated with an Area Group and gain position-access permissions308athat are determined by the area in the organization to which the position204belongs. The position-access permissions308afor that Area Group may limit the position-access permissions308cfor the report group(s)314a-nand/or the application group(s)312a-nassociated with assigned to the position group302. The position-access permissions308afor the section groups310a-nmay determine, for example, how much and/or what type of data is accessible in reports and/or software applications for the position204. The position-access permissions308for the section groups310a-nmay determine, for example, the functions accessible to the position204in the software applications.

Position-access permissions308aflow from section groups310, application groups312, report groups314, template groups316, and/or project groups317to the position group302. There are no position-access permissions308aassigned to a username306. Rather, all position-access permissions308aare assigned to the position302. Then, a username306may be assigned to the position group302, thereby gaining the position-access permissions308athrough the assignment to the position group302.

As illustrated inFIG.22, in some implementations, the user interface136may include a position audit log window2200. The position audit log window2200may include a position audit “date range” text field2204, one or more position audit “data transfer” icons2208, and a position audit viewing subwindow2212. In some embodiments, the one or more position audit “data transfer” icons2208includes, for example, a position audit export icon2208aand a position audit report icon2208b.

The interface application112may be configured to maintain a position audit log2214comprising one or more position audit log entries2216. In some implementations, each of the position audit log entries2216may be representative of a single user/position interaction with the interface application112, as described herein. The position audit log2214(and the position audit log entries2216contained therein) may be stored in one or more of: the one or more databases110of the user device104, the one or more databases110aof the host server119, the one or more databases124of the directory server102, and the one or more external databases134. Each of the position audit log entries2216may comprise one or more of: the position204and/or the position group302of the user interacting with the interface application, the username306associated with the position204and/or the position group302at the time of the interaction; the real name of the user associated with the username306assigned to the position group302at the time of the interaction; the email address of the user associated with the username306assigned to the position group302at the time of the interaction; the date and/or time of the interaction between the position group302and the interface application112; and details of the interaction, as described below.

In some embodiments, the interface application112may cause the one or more processors114to add a position audit log entry2216to the position audit log2214in response to a position accessing one or more of the databases110,110a,124,134described herein. For example, a user may be required to enter a username306and a password associated with the position204to initiate an interaction through the interface application112or an interaction with the network resources, applications, and/or reports.

In response to the interaction, the interface application112may cause the one or more processors114to create a new position audit log entry2216and store the new position audit log entry2216in the position audit log2214in one or more of: the one or more databases110of the user device104, the one or more databases110aof the host server119, the one or more databases124of the directory server102, and the one or more external databases134. The new position audit log entry2216may comprise, for example, one or more of (but not limited to): the position204and/or the position group302initiating the interaction, the username306associated with the position204and/or the position group302at the time of the interaction, the real name of the user associated with the username306associated with the position204and/or the position group302at the time of the interaction, the email address of the user associated with the username306associated with the position204and/or the position group302at the time of the interaction, the date and time of the interaction, and a record indicative of a success or failure of the interaction.

In some embodiments, the interface application112may cause the one or more processors114to add a position audit log entry2216to the position audit log2214in response to a user using the interface application112to create, delete, and/or modify one or more aspects of the directory service domain300, which may include one or more employees, one or more network resource121, one or more organizational charts202, one or more position groups302, one or more permission groups304a-n, one or more usernames306, one or more position-access permissions308a-n, one or more section groups310a-n, one or more software application groups312a-n, one or more report groups314a-n, one or more template groups316a-n, and/or one or more project groups317a-n.

Each of the one or more position audit “data transfer” icons2208may be configured to be selectable, such as by a user moving the cursor206over the icon2208, and, upon being selected, the interface application112may cause the one or more processors114to transfer one or more entries of the position audit log2214to a new location, such as for example the first non-transitory computer readable media108of one of the one or more user devices104. In some implementations, the position audit export icon2208amay be configured to be selectable, such as by user moving the cursor206over the icon2208a, and, upon being selected, the interface application112may cause the one or more processors114to copy the audit log2214to a file, which may be saved by the user in a readable format (e.g., a PDF, an Excel spreadsheet, a text document, etc.) or printed on, for example, one or more pieces of paper by the user utilizing a printer.

In some embodiments, the position audit report icon2208bis configured to be selectable, such as by the user moving the cursor206over the icon2208b, and, upon being selected, the interface application112may cause the one or more processors114to generate a report based on the position audit log2214. This report may be copied to a file, which may be saved by the user in a readable format (e.g., a PDF, an Excel spreadsheet, a text document, etc.) or printed on, for example, one or more pieces of paper by the user utilizing a printer. In some embodiments, the report may be searchable by one or more key values (e.g., the date of the position audit log entry2216, the user associated with the position audit log entry2216at the time of the interaction, the position204associated with the user at the time of the interaction, the action associated with the position audit log entry2216, etc.).

As illustrated inFIG.23, in some implementations, the user interface136may include an application programming interface (API) audit log window2300. In some implementations, the API audit log window2300may be accessible only by a system administrator (i.e., a user with administrator access to the interface application112) or other designated user. The API audit log window2300may include an API “date range” text field2304, one or more API “data transfer” icons2308, and an API viewing subwindow2312. In some implementations, the one or more API “data transfer” icons2308includes, for example, an API export icon2308aand an API report icon2308b. The interface application112may be configured to maintain an API log2314comprising one or more API log entries2316.

The API audit log window2300may function similarly to the position audit log window2200, except that the position audit log entries2216are representative of a single user/position interaction with the interface application112, while the API log entries2316are representative of a single API interaction with the interface application112(i.e., one or more aspect of the interface application112being modified by one or more of the external software applications132and/or one or more of the external databases134).

In some implementations, certain API log entries2316indicative of API mismatches and/or API errors (as will be described below) may be highlighted for a user. Each of such API log entries2316may comprise one or more of: the date and/or time of the API mismatch and/or API error; an identifier (e.g., a name and/or an identification number) of the external software application132and/or the external database134associated with the API log entry2316; a description of the API mismatch and/or API error; a priority and/or severity level of the API mismatch and/or API error; and a completion indicator for the API mismatch and/or API error indicative of a resolution status of the API mismatch and/or API error.

The API log entries2316may include API mismatches between data stored by the interface application112and data received from the one or more external software applications132and/or the one or more external databases134. If it is determined that there is an API mismatch, the interface application112may be provided with one or more rules for determining how to resolve the API mismatch. For example, a first rule may be to prioritize data that is most recent, and a second rule may be to prioritize data received from a particular one of the one or more external software applications132and the one or more external databases134. The interface application112may give priority to one of the one or more rules; in the previous example, the interface application112may give priority to the second rule such that the data received from the particular one of the one or more external software applications132and the one or more external databases134is prioritized even if the data is less recent than the data stored by the interface application112. It will be understood by persons having ordinary skill in the art that the interface application112may be provided with any manner of rules for determining the priority of data and resolving an API mismatch.

In some embodiments, the API log entries2316include API errors encountered by the interface application112while attempting to communicate data with the one or more external software applications132and/or the one or more external databases134. The interface application112may assign a severity level to each API error to assist the user in determining which API error to address first. That is, an API error with a higher severity level may have a greater impact on the normal functioning of the interface application112, while an API error with a lower severity level may have a lesser impact on the normal functioning of the interface application112.

Referring now toFIG.24, shown therein is an exemplary screenshot of an approval workflow setup window2400of a graphical user interface136on a display118in accordance with the present disclosure. As shown inFIG.24, in some implementations, the user interface136may include an approval workflow setup window2400for creating and/or editing approval workflows. The approval workflow setup window2400may include one or more approval workflow text fields2404a-n, an approval workflow submit icon2408, and an approval workflow cancel icon2412. The one or more approval workflow text fields2404a-nmay be configured to receive, for example, an access group to which an approval workflow is attached, a position of an approving-employee that is able to accept or deny the approval workflow, a requesting-user that is requesting a modification to the access group, and/or a requested modification to the access group. In some implementations, the approval workflow submit icon2408may be configured to be selectable, such as by a user moving the cursor206over the submit icon2408, and, upon being selected, the interface application112may cause the one or more processors114to create an approval workflow with the parameters received by the one or more approval workflow text fields2404a-nand store the approval workflow in the one or more databases124of the directory server102. The approval workflow cancel icon2412may be configured to be selectable, such as by a user moving the cursor206over the approval workflow cancel icon2412, and, upon being selected, to close the approval workflow setup window2400and display the administration window2000on the display118.

In some implementations, a system administrator (i.e., a user assigned to a position with administrator access to the interface application112) may determine that one or more of the access groups (for example, the position groups302a-n, the permission groups304a-n, the section groups310a-n, the software application groups312a-n, the report groups314a-n, the template group316a-n, and/or the project groups317a-n) should be given stronger protection from, for example, being modified. In such a case, the system administrator may determine that an approval workflow will be required to modify an aspect of the access group.

In doing so, the system administrator may specify a position group302that will be given approval privileges for the access group; that is, an approving-employee (for example, a manager) associated with the specified position group302will be able to accept or deny an approval workflow to approve or deny the modification.

For example, for a user to request to modify the access group, the requesting user may be required to create an approval workflow specifying the requested modification they wish to make (e.g., adding/removing position-access permissions308a-n, adding/removing employees, modifying nested access groups, etc.). In some implementations, the requested modification and the approval workflow may be limited to a specific area of the workflow and/or a specific organizational area. Upon the approval workflow being created, the approval workflow may be viewable by the approving-employee associated with the position group302that was given the approval privileges. At that point, the approving-employee may determine whether to accept or deny the approval workflow. If the approving-employee associated with the position group302that was given the approval privileges denies the approval workflow, the interface application112may present a notification (e.g., an alert) to the requesting user that the approval workflow was denied. If the approving-employee associated with the position group302that was given the approval privileges accepts the approval workflow, the interface application112may present a notification (e.g., an alert) to the requesting user that the approval workflow was accepted, and/or the interface application112may perform the requested modification automatically and present a notification (e.g., an alert) to the requesting user that the requested modification was completed. For example, the notification may be sent to the requesting user in the form of a message (e.g., an email message, a text message, a message within an intra-company communication system, etc.).

In an illustrative example, an interface-application system administrator determines that a section group310for a particular department should require approval from a department lead (i.e., a lead for the particular department) before the section group310may be modified by a user. The system administrator creates an approval workflow specifying that the access group is the section group310and the approving-employee is a position group302associated with the department lead. A requesting user within the department creates an approval workflow specifying that they themselves are the requesting user and the requested modification is the addition of a position-access permission308to their position group302. The approval workflow is then viewable by the approving-employee (for example, a department lead), who determines to accept the approval workflow, thereby granting the position-access permission308to the employee. The requesting employee receives an indication (e.g., an alert) from the interface application112indicating that the approval workflow was accepted and the requested modification was completed.

As illustrated inFIG.25, in some implementations, the user interface136may include an interface application security window2500for approving and/or denying one or more interface application permissions for the positions204described herein. The interface application security window2500may comprise a position list2502and one or more permissions radio buttons2504a-n. The position list2502may list each of the positions204that have been defined. For each of the positions204listed in the position list2502, one or more permissions radio buttons2504a-nmay be used for defining one or more interface applications permissions for the position204, the one or more permissions radio buttons2504a-nconfigured to receive one or more binary inputs from the user utilizing the input device116.

In some implementations, as shown inFIG.25, the one or more permissions radio buttons2504a-nmay be indicative of a permission to view one or more aspect of the interface application112, a permission to create new groups using the interface application112, a permission to edit groups using the interface application112, and/or a permission to deactivate groups using the interface application112.

In some implementations, the interface application security window2500may further comprise an interface application security back icon2506configured to be selectable, such as by the user moving the cursor206over the interface application security back icon2506, and, upon being selected, to close the interface application security window2500and display the administration window2000on the display118.

As illustrated inFIG.26, in some implementations, the user interface136may include a category setup window2600for defining and/or editing a category. The category setup window2600may comprise one or more category text fields2602a-nand a category submit icon2604. The one or more category text fields2602a-nmay be configured to receive one or more descriptors (which may include, but are not limited to, a name, a description, a section, etc.) of a category. The category submit icon2604may be configured to be selectable, such as by a user moving the cursor206over the category submit icon2604and, upon being selected, the interface application112may create a new category with the descriptors as received by the one or more category text fields2602a-n.

In some implementations, the category setup window2600may further comprise a category cancel icon2606configured to be selectable, such as by a user moving the cursor206over the category cancel icon2606, and, upon being selected, to close the category setup window2600and display the administration window2000on the display118.

As illustrated inFIG.27, in some implementations, the user interface136may include a network resource setup window2700for defining and/or editing a network resource121. The network resource setup window2700may comprise one or more network resource text fields2702a-nand a network resource submit icon2704. The one or more network resource text fields2702a-nmay be configured to receive one or more descriptors (which may include, but are not limited to, a name, a description, an address such as for example an Internet Protocol address, and/or a category) of a network resource121. The network resource submit icon2704may be configured to be selectable, such as by a user moving the cursor206over the network resource submit icon2704, and, upon being selected, the interface application112may create a new network resource121with the descriptors as received by the one or more network resource text fields2702a-n.

In some implementations, the network resource setup window2700may further comprise a network resource cancel icon2706configured to be selectable, such as by a user moving the cursor206over the network resource cancel icon2706, and, upon being selected, to close the network resource setup window2700and display the administration window2000on the display118.

As illustrated inFIG.28, in some implementations, the user interface136may include a project setup window2800for defining and/or editing a project317a-n. A project317may be indicative of a predetermined combination of group options210, similar to a template316. However, the group options210may be associated with position-access permissions308that are to be assigned to a position204only during a period in which the position204is assigned to the project317(i.e., position-access permissions308that will be removed from the position204once the position204is no longer assigned to the project317). The project setup window2800may comprise one or more project text fields2802a-n, one or more project radio buttons2804a-n, and a project submit icon2806.

The one or more project text fields2802a-nmay be configured to receive one or more descriptors (which may include, but are not limited to, a name, a description, and/or a category) of a project217. The one or more project radio buttons2804a-nmay be used for defining one or more position-access permissions308for the project317, the one or more project radio buttons2804a-nconfigured to receive one or more binary inputs from the user utilizing the input device116. In some implementations, as shown inFIG.28, the one or more project radio buttons2804a-nmay be indicative of one or more software applications, one or more network resources, and/or one or more predetermined reports to associate with the project317, for example. The project submit icon2806may be configured to be selectable, such as by a user moving the cursor206over the project submit icon2806, and, upon being selected, the interface application112may create a new project317with the descriptors and the position-access permissions308as received by the one or more project text fields2802a-nand/or the one or more project radio buttons2804a-n, respectively.

In some implementations, the project setup window2800may further comprise a cancel icon2808configured to be selectable, such as by a user moving the cursor206over the cancel icon2808, and, upon being selected, to close the project setup window2800and display the administration window2000on the display118.

As illustrated inFIG.29, in some implementations, the user interface136may include an API setup window2900for defining and/or editing communication with the one or more external software applications132and the one or more external databases134. The API setup window2900may comprise an API list2902and one or more API setup text fields2904a-n. The API list2902may list each of the one or more external software applications132and the one or more external databases134that have been defined.

The one or more API setup text fields2904a-nmay be configured to receive one or more descriptors (which may include, but are not limited to, a name, an address such as a Uniform Resource Locator, a login such as a username and a password, and data to be imported from the external software application132or the external database134) for the external software application132or the external database134.

For each particular one of the one or more external software applications132and the one or more external databases134listed in the API list2902, an API sync button2906may be configured to be selectable, such as by the user moving the cursor206over the API sync button2906, and, upon being selected, the interface application112may cause the one or more processors114to synchronize the one or more databases110of the one or more user devices104, the one or more databases110aof the host server119, and/or the one or more databases124of the directory server102with the particular one of the one or more external software applications132and the one or more external databases134. Of course, it will be understood that the interface application112may cause the one or more processors114to synchronize based on other factors, such as predetermined times, time frames, and/or external input detection.

In some implementations, the interface application112, when executed, may cause the one or more processors114to synchronize with the one or more external software applications132, the one or more external databases134, the one or more databases110of the one or more user devices104, the one or more databases110aof the host server119, and/or the one or more databases124of the directory server102at a predetermined time. In some implementations, the interface application112, when executed, may cause the one or more processors114to synchronize with the one or more external software applications132, the one or more external databases134, the one or more databases110of the one or more user devices104, the one or more databases110aof the host server119, and/or the one or more databases124of the directory server102at regular intervals (non-exclusive examples of which include hourly, daily, weekly, monthly, quarterly, and/or yearly).

In one embodiment, the interface application112, when executed, may cause the one or more processors114to synchronize with the one or more external software applications132and/or the one or more external databases134through external application programming interfaces (API) and/or direct queries (for example, using SQL and/or LDAP). The one or more external software applications132and/or the one or more external databases134may communicate with the host server119and/or the one or more user devices104via the network106.

In some implementations, the one or more external software applications132may be one or more of, but not limited to: human resources software systems, customer relationship management software systems, enterprise resource planning software systems, payroll systems, and office productivity software systems. The one or more external software applications132may be part of or external to software applications of the organization. For example, when the one or more external software applications132is a payroll system, the payroll system may be internal to the organization or external (such as a third-party vendor) to the organization.

The one or more external databases134may, for example, store information regarding employees of one or more real-world organizations. In some implementations, the one or more external databases134may store data associated with the one or more external software applications132. In some implementations, the one or more external databases134may store hierarchy data regarding the positions204. In some implementations, the one or more external databases134may store information associated with the group options210.

In one implementation, the interface application112when executed may cause the one or more processors114to receive an input indicative of a particular data source (e.g., the one or more software applications132, the one or more external databases134, the one or more databases110of the one or more user devices104, the one or more databases110aof the host server119, and/or the one or more databases124of the directory server102, for example) to identify as a master data source for a particular dataset (e.g., the group options210, the positions204, and/or the employees). The interface application112may utilize the master data source when synchronizing the particular dataset with the one or more external software applications132, the one or more external databases134, the one or more databases110of the one or more user devices104, the one or more databases110aof the host server119, and/or the one or more databases124of the directory server102, as described above. That is, the interface application112when executed may cause the one or more processors114to copy the particular dataset from the master data source to each of the other data sources. In one embodiment, all of the datasets have the same master data source. However, in other embodiments, one or more of the datasets has a different master data source.

In some implementations, one or more of the usernames306may be imported into the one or more databases110,110aof the user device104and/or the host server119as they are added to the master data source. In some implementations, once added, the usernames306may appear in the employee subwindow706of the employee window700.

If an employee is no longer with the organization, synchronizing the interface application112with the master data source may remove the employee from the one or more databases110,110aof the user device104and/or the host server119, ensuring the one or more databases110,110aof the user device104and/or the host server119and the directory service application126are accurate and complete without manual intervention.

In some implementations, the API setup window2900may further comprise an API setup back icon2908configured to be selectable, such as by a user moving the cursor206over the setup back icon2908, and, upon being selected, to close the API setup window2900and display the administration window2000on the display118.

As illustrated inFIG.30, in some implementations, the user interface136may include an API console window3000for monitoring statuses of the one or more external software applications132and/or the one or more external databases134. The API console window3000may comprise an API list3002, a status column3004, and a description column3006. The API list3002may list each of the one or more external software applications132and/or the one or more external databases134that have been defined.

For each of the external software applications132and the external databases134listed in the API list3002, the status column3004may contain a status indicator and the description column3006may contain a description of the status indicator. The status indicator may be indicative of a synchronization status of the external software application132or the external database134; that is, a “green” status indicator may indicate that the external software application132or the external database134is synchronized, a “yellow” status indicator may indicate that the external software application132or the external database134is synchronized with a warning or error, and a “red” status indicator may indicate that the external software application132or the external database134is not synchronized.

In some implementations, the API console window3000may further comprise an API console back icon3008configured to be selectable, such as by a user moving the cursor206over the API console back icon3008and, upon being selected, to close the API console window3000and display the administration window2000on the display118.

An example of the computer system100ofFIG.1in a hypothetical use case will now be described. For the purposes of this hypothetical, an exemplary organization is a single company having over one thousand employees spread across two divisions, six departments, more than one hundred locations (between all divisions and departments), and hundreds of areas (including, for example, sales territories, operational areas, etc.).

A user in the organization interacts with the interface application112to cause the one or more processors114to instruct the directory service application126to create and/or delete permission groups304a-nand position-access permissions308a-nin the directory service domain300,300autilizing permissions structures that are “position”-based, rather than “person”-based. Although organizations make changes to positions from time to time, these changes are much less frequent than changes in personnel. Additionally, if the organization is involved in a reorganization, acquisition, or expansion, the interface application112may allow a user to drag a branch of the organization that is being reassigned or removed and drop the branch in a new place in the organizational structure (see, for example,FIGS.17A and17B) or remove the branch altogether. At this point, the interface application112may send a signal indicative of a query directing the directory server102to make the necessary changes to the directory service domain300, and the changes may be made without further user intervention.

It is anticipated that using the computer system100and associated methods may reduce the resources required by over 95%, and in some cases over 98%, in comparison to prior art systems and methods.

Additionally, the interface application112allows changes to positions204at the top of an organizational structure to be propagated to each of the subordinate positions204below them. Further, removing a position204or other object (e.g., an employee, a permission group304a-n, etc.) is also made simple by the interface application112, which may allow a user to remove any object using drag-and-drop methods or other interface methods.

An example of the computer-implemented method400(shown inFIG.4) in a hypothetical will now be described. At step402of the presently described method400, the creation of a position group302for a sales associate position204may be initiated by using the interface application112to interface with the directory service domain300. The pop-up window510for the position window500may allow a user to input descriptors identifying the group options210for the sales associate position204, which in this example are software division, sales department, Los Angeles location, and West Coast area.

At step404, the interface application112may cause the one or more processors114to transmit via the network106a signal indicative of a query directing the directory server102to create the sales associate position group302and add the sales associate position group302to the directory service domain300.

The directory service domain300may be automatically adjusted to add the section groups310a-nbased on the group options210input at step402, which in this example would be a software division section group310a, a sales department section group310b, a Los Angeles location section group310c, and a West Coast area group310d. Of course, it will be understood that in some implementations, the section groups310a-dmay have been previously created. At step406, the sales associate position group302may be added to the section groups310a-d, thereby assigning position-access permissions and/or position-access limitations from the section groups310a-dto the sales associate position group302.

Additionally, sales associate position group302may be added to the one or more template groups316a-nto assign a combination of position-access permissions308b,308cfor accessing one or more software applications and/or one or more reports (i.e., position-access permissions308d) to the sales associate position204, such as for accessing a Customer Relationship Management software application and the sales report for the West Coast area.

At step408, once the sales associate position group302is created and assigned the above-described position-access permissions308, a user may access the employee subwindow706of the employee window700using the interface application112and drag-and-drop an employee icon702associated with a “janedoe” username306onto a position icon602for the sales associate position204to assign the “janedoe” username306to the sales associate position204.

At step410, because the sales associate position group302has already been assigned the above-described position-access permissions308, the interface application112need only transmit via the network106a signal indicative of a query directing the directory server102to assign the “janedoe” username306to the sales associate position group302, thereby assigning the position-access permissions308associated with the sales associate position group302to the “janedoe” username306(i.e., the position-access permissions308associated with the section groups310a-dfor the software division, the sales department, the Los Angeles location, and the West Coast area, and the template group316a-nfor the CRM application and the sales report for the West Coast area).

Performing the presently described method400may ensure that the “janedoe” username306assigned to the sales associate position group302is able to access only the content that the sales associate position204is authorized to access, whether the content is included in a report or a software application. That is, while the “janedoe” username306may be able to access the sales report for the West Coast area, the “janedoe” username306may not be able to access one or more portions of the sales report that are specifically relevant to a hypothetical San Francisco location, because the sales associate position group302is not a member of a section group310a-nfor a San Francisco location.

Though particular user interfaces136and user input devices have been described, it will be understood by a person having ordinary skill in the art that adaptations and variations of user interfaces136are contemplated.

From the above description and examples, it is clear that the inventive concepts disclosed and claimed herein are well adapted to attain the advantages mentioned herein. The interface application112may allow the user to communicate with the directory server102, such as via the network106, to manage position-access permissions308within the directory service domain300based on positions204within the organizational structure of an organization, rather than on usernames306. While exemplary embodiments of the inventive concepts have been described for purposes of this disclosure, it will be understood that numerous changes may be made which will readily suggest themselves to those skilled in the art and which are accomplished within the spirit of the inventive concepts disclosed and claimed herein. However, it is to be understood that the example is for illustrative purposes only and is not to be construed as limiting the scope of the disclosure. Even though particular combinations of features are recited in the claims and/or disclosed in the specification, these combinations are not intended to limit the disclosure. In fact, many of these features may be combined in ways not specifically recited in the claims and/or disclosed in the specification. Although each dependent claim listed below may directly depend on only one other claim, the disclosure includes each dependent claim in combination with every other claim in the claim set. No element, act, or instruction used in the present application should be construed as critical or essential to the invention unless explicitly described as such.