Distributed system and method for providing SQL access to management information in a secure distributed network

An access control system for controlling access to management objects in a distributed network, comprising:

• an access control database, including access control objects, the access control objects including:
• group objects, each defining a group and a set of users who are members of the group;
• and
• rule objects,
• a first subset of the rule objects each specifying:
• a set of the group objects, a set of the management objects, and access rights by the users who are members of the groups defined by the specified set of the group objects to the specified set of management objects;
• and
• a second subset of the rule objects in the access control database each specify:
• a set of the group objects, a set of the management objects, and access rights by the users who are members of the groups defined by the specified set of the group objects to event notifications generated by the specified set of management objects;
• an event router that receives event notifications generated by the management objects and sends corresponding event notification messages only to users in groups who have access rights to those event notifications in accordance with the access rights specified in the access control database;
• at least one access control server that receives access requests from users and controls access to the management objects in accordance with the access rights specified in the access control database;
• a subset of the access requests specifying operations to be performed on specified sets of the management objects;
• the at least one access control server responding to the access requests from the users by granting, denying and partially granting and denying each access request in accordance with the access rights specified in the access control database;
• and
• a database management system distinct from the access control database and from the management objects;
• the event router including means for automatically sending at least a subset of the event notifications generated by the management objects to the database management system;
• the database management system including:
• database tables for storing the event notifications sent by the event router in a set of database tables;
• a database access privileges module for establishing table access rights corresponding to at least a subset of the access rights represented by the second subset of the rule objects;
• and
• a database access engine for receiving user requests for event notification information stored in the database tables, and for limiting user access to the event notification information stored in the database tables in accordance with the table access rights established by the database access privileges module.

A method of controlling access to management objects in a distributed network, comprising the steps of:

• storing an access control database, including access control objects, the access control objects collectively storing information that specifies access rights by users to specified sets of the management objects, the specified access rights including access rights to obtain management information concerning the management objects in the network;
• and
• receiving access requests from the users, a subset of the access requests specifying operations to be performed on specified sets of the management objects, and processing each received access request by granting, denying and partially granting and denying each access request in accordance with the access rights specified in the access control database;
• automatically sending management information concerning the management objects from the network to a database management system distinct from the access control database and from the management objects;
• in the database management system:
• storing in a set of database tables the management information sent by the information transfer mechanism;
• establishing table access rights corresponding to at least a subset of the access rights stored in access control database;
• and
• receiving user requests for management information concerning the management objects in the network, and limiting user access to the management information stored in the database tables in accordance with the established table access rights.

A method of controlling access to management objects in a distributed network, comprising the steps of:

• storing a set of access control objects, including:
• group objects, each defining a group and a set of users who are members of the group;
• and
• rule objects,
• a first subset of the rule objects each specifying:
• a set of the group objects, a set of the management objects, and access rights by the users who are members of the groups defined by the specified set of the group objects to the specified set of management objects;
• and
• a second subset of the rule objects in the access control database each specify:
• a set of the group objects, a set of the management objects, and access rights by the users who are members of the groups defined by the specified set of the group objects to event notifications generated by the specified set of management objects;
• and
• receiving event notifications generated by the management objects and sending corresponding event notification messages only to users in groups who have access rights to those event notifications in accordance with the access rights specified in the access control database;
• and
• receiving access requests from users, a subset of the access requests specifying operations to be performed on specified sets of the management objects, and responding to the access requests by granting, denying and partially granting and denying access to the management objects in accordance with the access rights specified in the access control database.
• automatically sending at least a subset of the event notifications generated by the management objects to a database management system distinct from the access control objects and from the management objects;
• in the database management system:
• storing the event notifications sent by the event router in a set of database tables;
• establishing table access rights corresponding to at least a subset of the access rights represented by the second subset of the rule objects;
• and
• receiving user requests for event notification information stored in the database tables;
• and
• limiting user access to the event notification information stored in the database tables in accordance with the table access rights established by the database access privileges module.