Patent ID: 7725563

Claim:
A computer-implemented method for managing a directory server, the method comprising: creating an object class to which a nested AND role comprising at least two constituent roles belongs, the object class defining the nested AND role as a result of a logical AND operation on all of the constituent roles within the nested AND role, the nested AND role declaring itself as a member of the object class by including an identifier of the object class without indicating the logical AND operation; defining a plurality of entries in the directory server, at least one of the plurality of entries possessing the nested AND role by possessing all of the constituent roles within the nested AND role; querying each of the entries to determine whether the entry possesses the nested AND role by performing the logical AND operation on a plurality of results, each result indicating whether the entry possesses a corresponding one of the constituent roles of the nested AND role; and in response to querying, providing entries that possess the nested AND role to a client.