Patent ID: 7945946

Claim:
A computer-implemented method, comprising: receiving, by a lightweight directory access protocol (LDAP) directory server, a request for access to perform an operation on an attribute of an entry in an LDAP directory, wherein the attribute is associated with one or more access control instructions (ACIs) that are stored in the LDAP directory as additional attributes and that specify a plurality of access control criteria and an associated plurality of permissions, the plurality of permissions including a first permission for a first operation that can be performed when the plurality of access control criteria are satisfied and a second permission for a second operation that is not permitted unless additional access control criteria are satisfied, the plurality of access control criteria including a first criterion that specifies a particular type of secure channel for the first operation on the attribute and a second criterion that specifies a particular authentication level for the first operation on the attribute; evaluating the request to determine whether the plurality of access control criteria are satisfied, including determining whether a channel between the directory server and a client that generated the request corresponds to the particular type of secure channel specified in the first criterion and determining whether a user authentication performed by the client corresponds to the particular authentication level specified in the second criterion; determining whether the requested operation corresponds to the first operation; and granting the access to perform the requested operation upon determining that the plurality of access control criteria are satisfied and that the requested operation corresponds to the first operation.