Transparent enforcement of application-level access privileges on data structures

1 . A computer-implemented method for runtime enforcement of application-level data access controls in querying data structures, the method being executed by one or more processors and comprising:

receiving, from an application and during runtime of the application, a query comprising an artifact identifier that uniquely identifies an artifact;

determining a data access privilege for a user with respect to the artifact by transmitting a request to a data access control (DAC) service, the request comprising a user identifier of the user and the artifact identifier of the artifact, the DAC service querying an authentication system, which returns the data access privilege;

transmitting the query and the data access privilege to a data repository, the data repository inserting a filtering clause in the query to provide a modified query and retrieving data that is responsive to the modified query; and

providing the data that is responsive to the modified query to the application.

2 . The method of claim 1 , further comprising populating a data structure using the data that is responsive to the modified query, the application executing actions using the data structure.

3 . The method of claim 1 , wherein the filtering clause comprises a WHERE clause defining at least one value used to select the data retrieved from the data repository.

4 . The method of claim 1 , wherein the data access privilege is represented in a session variable of a session of the user and the application.

5 . The method of claim 1 , wherein the data access privilege is determined from a policy that is defined for the artifact during a design-time.

6 . The method of claim 5 , wherein the policy is provided by refining a base policy.

7 . A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for enforcement of application-level data access controls in querying data structures, the operations comprising:

receiving, from an application and during runtime of the application, a query comprising an artifact identifier that uniquely identifies an artifact;

determining a data access privilege for a user with respect to the artifact by transmitting a request to a data access control (DAC) service, the request comprising a user identifier of the user and the artifact identifier of the artifact, the DAC service querying an authentication system, which returns the data access privilege;

transmitting the query and the data access privilege to a data repository, the data repository inserting a filtering clause in the query to provide a modified query and retrieving data that is responsive to the modified query; and

providing the data that is responsive to the modified query to the application.

8 . The non-transitory computer-readable storage medium of claim 7 , wherein operations further comprise populating a data structure using the data that is responsive to the modified query, the application executing actions using the data structure.

9 . The non-transitory computer-readable storage medium of claim 7 , wherein the filtering clause comprises a WHERE clause defining at least one value used to select the data retrieved from the data repository.

10 . The non-transitory computer-readable storage medium of claim 7 , wherein the data access privilege is represented in a session variable of a session of the user and the application.

11 . The non-transitory computer-readable storage medium of claim 7 , wherein the data access privilege is determined from a policy that is defined for the artifact during a design-time.

12 . The non-transitory computer-readable storage medium of claim 11 , wherein the policy is provided by refining a base policy.

13 . A system, comprising:

a computing device; and

a computer-readable storage device coupled to the computing device and having instructions stored thereon which, when executed by the computing device, cause the computing device to perform operations for enforcement of application-level data access controls in querying data structures, the operations comprising:

receiving, from an application and during runtime of the application, a query comprising an artifact identifier that uniquely identifies an artifact;

determining a data access privilege for a user with respect to the artifact by transmitting a request to a data access control (DAC) service, the request comprising a user identifier of the user and the artifact identifier of the artifact, the DAC service querying an authentication system, which returns the data access privilege;

transmitting the query and the data access privilege to a data repository, the data repository inserting a filtering clause in the query to provide a modified query and retrieving data that is responsive to the modified query; and

providing the data that is responsive to the modified query to the application.

14 . The system of claim 13 , wherein operations further comprise populating a data structure using the data that is responsive to the modified query, the application executing actions using the data structure.

15 . The system of claim 13 , wherein the filtering clause comprises a WHERE clause defining at least one value used to select the data retrieved from the data repository.

16 . The system of claim 13 , wherein the data access privilege is represented in a session variable of a session of the user and the application.

17 . The system of claim 13 , wherein the data access privilege is determined from a policy that is defined for the artifact during a design-time.