Patent ID: 7720881

Claim:
A computer-implemented method of a Lightweight Directory Access Protocol (LDAP) directory server for managing an LDAP directory, the method comprising: defining a group represented by an organization unit subtree in the LDAP directory, the group being identified by a first distinguished name and including a list for at least one of a plurality of entries in the LDAP directory; defining a group attribute for the at least one entry, the group attribute identified by the first distinguished name of the group; defining a group-based role, at a role management module of the LDAP directory server, the group-based role identified by a second distinguished name and represented by a node outside of the organization subtree, a definition of the group-based role comprising the first distinguished name of the group and the second distinguished name of the group-based role, wherein an entry possesses the group-based role based on being on the list as a member of the group; automatically updating the role of the at least one entry when the at least one entry is removed from membership of the group; determining which of the plurality of entries possess the group based role by querying members in the group; and providing the entries that possess the group based role to a client, the entries being the members of the group.