Patent ID: 7774433

Claim:
A computer-implemented method for managing a directory server, the method comprising: creating an object class to which a nested XOR role comprising at least two constituent roles belongs, the object class defining the nested XOR role as a result of a logical XOR operation on all of the constituent roles within the nested XOR role, the nested XOR role declaring itself as a member of the object class by including an identifier of the object class without indicating the logical XOR operation; defining a plurality of entries in the directory server, at least one of the plurality of entries possessing the nested XOR role by possessing only one of the constituent roles within the nested XOR role; querying each of the entries to determine whether the entry possesses the nested XOR role by performing the logical XOR operation on a plurality of results, each result indicating whether the entry possesses a corresponding one of the constituent roles of the nested XOR role; and in response to querying, providing entries that possess the nested XOR role to a client.