Selective cache flushing in identity and access management systems

A method for flushing cache memories in a network-based system, the method comprising:

• providing a graphical user interface for an administrator or user having some delegated administrator authority to modify authorization data, said authorization data residing on a directory server and used for determining if a user has authorization to a resource;
• receiving, via the graphical user interface, a change to said authorization data;
• detecting at an administration server for said system said change to said authorization data;
• an administration server transmitting a synchronization record to an Access Server of said system, said synchronization record identifying said changed authorization data, wherein said Access Server determines whether said user has permission to access said resource, when said user accesses said resource;
• comparing said synchronization record with a previous synchronization record identifying said authorization data;
• and
• flushing only said authorization data identified in said previous synchronization record from a cache of said Access server.

One or more processor readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors, said processor readable code comprising:

• code for detecting, at an administration server, a change to authorization data residing on a directory server, wherein said authorization data comprises a rule to access data by a user and said change to said authorization data is caused by an administrator via a graphical user interface;
• code for determining at an Access Server whether said user has permission to access said resource, when said user attempts to access said resource;
• code for transmitting a synchronization record to said Access server of said system from said administration server, said synchronization record identifying said changed authorization data;
• code for comparing said synchronization record with a previous synchronization record identifying said authorization data;
• and
• code for flushing said authorization data identified in said previous synchronization record from a cache of said Access Server.

An apparatus, comprising:

• a communication interface;
• one or more storage devices;
• and
• one or more processors in communication with said one or more storage devices and said communication interface, said one or more storage devices comprising processor readable code for programming said one or more processors, said processor readable code comprising:
• code for detecting a change to authorization data residing on a directory server, wherein said authorization data comprises a rule to access data by a user and said change to said authorization data is caused by an administrator or user having some delegated administrator authority via a graphical user interface;
• code for transmitting a synchronization record from an administration server to an Access Server of said system, said synchronization record identifying said authorization data;
• code for comparing said synchronization record with a previous synchronization record identifying said authorization data;
• and
• code for flushing said authorization data identified in said previous synchronization record from a cache of said Access Server.

A system, comprising:

• a web server comprising a component;
• a directory server in communication with the web server;
• an Access Server in communication with the web server and the directory server;
• and
• an administration server in communication with the Access Server and the directory server, wherein the administration server comprises computer readable code executable by the administration server, the computer readable code comprising:
• code for detecting a change to access rule data residing on the directory server;
• and
• code for transmitting a synchronization record for reception by the Access Server, wherein the synchronization record identifies a set of data to be flushed from a cache at the Access Server;
• code for comparing said synchronization record with a previous synchronization record identifying said authorization data;
• wherein the Access Server causes the component to flush from one or more caches of the component the set of data identified in the previous synchronization record.