Preserving LDAP hierarchy in a SCIM directory using special marker groups

A method for preserving Lightweight Directory Access Protocol (LDAP) hierarchy in a System for Cross-domain Identity Management (SCIM) directory, the method comprising:

• providing an LDAP Directory Information Tree (DIT) including a plurality of LDAP DIT entries that describe LDAP containers, users and groups, each LDAP DIT entry including a Distinguished Name (DN) and a plurality of LDAP attribute-value pairs, the DN providing LDAP DIT hierarchical information that uniquely identifies the LDAP DIT entry and describes a hierarchical position of the LDAP DIT entry in the LDAP DIT, each LDAP attribute-value pair including an attribute name and one or more attribute values;
• providing the SCIM directory including a plurality of SCIM resource entries that describe SCIM users and groups, each SCIM resource entry including a plurality of SCIM attributes including an externalID and a resource type identifying the SCIM resource entry as belonging to a user or a group, each SCIM attribute including a name and one or more values;
• migrating the plurality of LDAP DIT entries to the SCIM directory, including storing the LDAP DIT hierarchical information in the SCIM directory by mapping LDAP containers in the LDAP DIT to special marker SCIM groups in the SCIM directory;
• receiving, from an LDAP-based application over a network, an LDAP operation request including an LDAP add request, an LDAP delete request, an LDAP modify request, or an LDAP search request;
• processing the LDAP operation request;
• and
• returning an LDAP operation response to the LDAP-based application over the network.

A system for preserving Lightweight Directory Access Protocol (LDAP) hierarchy in a System for Cross-domain Identity Management (SCIM) directory, the system comprising:

• a first hardware processor, coupled to a network, configured to:
• provide an LDAP Directory Information Tree (DIT), stored in a first memory coupled to the first processor, including a plurality of LDAP DIT entries that describe LDAP containers, users and groups, each LDAP DIT entry including a Distinguished Name (DN) and a plurality of LDAP attribute-value pairs, the DN providing LDAP DIT hierarchical information that uniquely identifies the LDAP DIT entry and describes a hierarchical position of the LDAP DIT entry in the LDAP DIT, each LDAP attribute-value pair including an attribute name and one or more attribute values;
• a second hardware processor, coupled to the network, configured to:
• provide the SCIM directory, stored in a second memory coupled to the second processor, including a plurality of SCIM resource entries that describe SCIM users and groups, each SCIM resource entry including a plurality of SCIM attributes including an externalID and a resource type identifying the SCIM resource entry as belonging to a user or a group, each SCIM attribute including a name and one or more values;
• migrate the plurality of LDAP DIT entries to the SCIM directory, including storing the LDAP DIT hierarchical information in the SCIM directory by mapping LDAP containers in the LDAP DIT to special marker SCIM groups in the SCIM directory;
• receive, from an LDAP-based application over the network, an LDAP operation request including an LDAP add request, an LDAP delete request, an LDAP modify request, or an LDAP search request;
• process the LDAP operation request;
• and
• return an LDAP operation response to the LDAP-based application over the network.