Techniques for sharing persistently stored query results between multiple users
View Patent ↗A method, system and article of manufacture for managing access to query results and, more particularly, for managing access by multiple users to persistently stored query results, whereby at least some of the users may have different access rights. One embodiment provides a method of managing access to a query result obtained upon execution of a query against one or more databases. The method comprises creating security information configured for restricting access to the query result. The security information is associated with the query result. Access to some or all of the query result is granted to a requesting entity on the basis of the security information and an attribute of the requesting entity.
1. A method of managing access to a query result, comprising:
a) generating a plurality of persistent data objects, wherein generating comprises, for each persistent data object:
receiving a query result comprising a dataset obtained from one or more databases in response to execution of a query against the one or more databases;
creating security information configured for restricting access to the query result;
associating the security information with the query result, wherein the security information includes security settings for a plurality of potential requesting entities, the security settings defining access rights of each potential requesting entity to at least a portion of the query result; and
storing the query result and the security information together as a rowset in the respective persistent data object, the respective persistent data object being stored in a data repository; whereby each respective persistent data object is independently accessible on the basis of the respective security information contained within the respective persistent data object; and
b) granting access to a requesting entity to at least some of the query result of a given persistent data object on the basis of the security information and an attribute of the requesting entity.
2. The method of claim 1 , wherein the requesting entity is a user and the attribute of the requesting entity is one of:
(i) a user name;
(ii) a role of the user; and
(iii) an authorization level of the user.
3. The method of claim 1 , further comprising:
receiving a first request for accessing the query result from a first requesting entity;
presenting a first portion of the query result to the first requesting entity on the basis of the security information and the attribute of the first requesting entity;
receiving a second request for accessing the query result from a second requesting entity; and
presenting a second portion of the query result to the second requesting entity on the basis of the security information and the attribute of the second requesting entity, wherein the first portion contains one or more data objects not presented in the second portion.
4. The method of claim 1 , wherein granting access to a requesting entity to some or all of the query result on the basis of the security information and an attribute of the requesting entity comprises hiding one or more portions of the query result from the requesting entity on the basis of the security information and the attribute of the requesting entity.
5. The method of claim 1 , wherein the query result is defined using an instance of a Java® RowSet class and the persistent data object is defined using an instance of an extension to the Java® RowSet class.
6. The method of claim 1 , wherein the security information defines a link to security settings in the one or more databases, the security settings defining access rights of potential requesting entities to some or all of the query result.
7. A method of managing access by multiple users to a limited subset of data, comprising:
executing a query against one or more databases;
generating a plurality of persistent data objects, wherein generating comprises, for each persistent data object:
receiving a query result comprising a dataset obtained from one or more databases in response to execution of a query against the one or more databases;
attaching security information to the query result in order to restrict access to the query result, and wherein the security information includes security settings for a plurality of potential requesting entities, the security settings defining access rights of each potential requesting entity to at least a portion of the query result; and
storing the query result and the attached security information as a rowset in a persistent data object in a data repository; whereby each respective persistent data object is independently accessible on the basis of the respective security information contained within the respective persistent data object; and
granting access to the query result by the multiple users, whereby the access by a particular user is dependent on one or more attributes of the particular user and the security information attached to the query result.
8. The method of claim 7 , wherein the one or more attributes of the particular user include at least one of:
(i) a user name;
(ii) a role of the user; and
(iii) an authorization level of the user.
9. The method of claim 7 , further comprising:
allowing one or more of the users to modify the subset of data; and
subsequently synchronizing the one or more databases with the modified subset of data.
10. The method of claim 7 , wherein the query is received from a user, and access to the limited subset of data by the user is restricted by modifying the query received from the user to remove one or more results fields from the query based on the security information attached to the subset of data and one or more attributes of the user.
11. The method of claim 7 , wherein access to the limited subset of data by a user is restricted by presenting the user with only a limited portion of the limited subset of data obtained by executing a query, received from the user, against the limited subset of data, based on the security information attached to the limited subset of data and one or more attributes of the user.
12. A computer-readable storage medium containing a program which, when executed, performs a process for managing access to a query result, the process comprising:
a) generating, by a computer processor executing the program, a plurality of persistent data objects, wherein generating comprises, for each persistent data object:
receiving a query result comprising a dataset obtained from one or more databases in response to execution of a query against the one or more databases;
creating security information configured for restricting access to the query result;
associating the security information with the query result, wherein the security information includes security settings for a plurality of potential requesting entities, the security settings defining access rights of each potential requesting entity to at least a portion of the query result; and
storing the query result and the security information together as a rowset in the respective persistent data object, the respective persistent data object being stored in a data repository; whereby each respective persistent data object is independently accessible on the basis of the respective security information contained within the respective persistent data object; and
b) granting access to a requesting entity to at least some of the query result of a given persistent data object on the basis of the security information and an attribute of the requesting entity.
13. The computer-readable medium of claim 12 , wherein the requesting entity is a user and the attribute of the requesting entity is one of:
(i) a user name;
(ii) a role of the user; and
(iii) an authorization level of the user.
14. The computer-readable medium of claim 12 , wherein the process further comprises:
receiving a first request for accessing the query result from a first requesting entity;
presenting a first portion of the query result to the first requesting entity on the basis of the security information and the attribute of the first requesting entity;
receiving a second request for accessing the query result from a second requesting entity; and
presenting a second portion of the query result to the second requesting entity on the basis of the security information and the attribute of the second requesting entity, wherein the first portion contains one or more data objects not presented in the second portion.
15. The computer-readable medium of claim 12 , wherein granting access to a requesting entity to some or all of the query result on the basis of the security information and an attribute of the requesting entity comprises hiding one or more portions of the query result from the requesting entity on the basis of the security information and the attribute of the requesting entity.
16. The computer-readable medium of claim 12 , wherein the query result is defined using an instance of a Java® RowSet class and the persistent data object is defined using an instance of an extension to the Java® RowSet class.
17. The computer-readable medium of claim 12 , wherein the security information defines a link to security settings in the one or more databases, the security settings defining access rights of potential requesting entities to some or all of the query result.
18. A computer-readable storage medium containing a program which, when executed, performs a process of managing access by multiple users to a limited subset of data, the process comprising:
executing a query against one or more databases;
generating, by a computer processor executing the program, a plurality of persistent data objects, wherein generating comprises, for each persistent data object:
receiving a query result comprising a dataset obtained from one or more databases in response to execution of a query against the one or more databases;
attaching security information to the query result in order to restrict access to the query result, and wherein the security information includes security settings for a plurality of potential requesting entities, the security settings defining access rights of each potential requesting entity to at least a portion of the query result; and
storing the query result and the attached security information as a rowset in a persistent data object in a data repository; whereby each respective persistent data object is independently accessible on the basis of the respective security information contained within the respective persistent data object; and
granting access to the query result by the multiple users, whereby the access by a particular user is dependent on one or more attributes of the particular user and the security information attached to the query result.
19. The computer-readable medium of claim 18 , wherein the one or more attributes of the particular user include at least one of:
(i) a user name;
(ii) a role of the user; and
(iii) an authorization level of the user.
20. The computer-readable medium of claim 18 , wherein the process further comprises:
allowing one or more of the users to modify the subset of data; and
subsequently synchronizing the one or more databases with the modified subset of data.
21. The computer-readable medium of claim 18 , wherein the query is received from a user, and access to the limited subset of data by the user is restricted by modifying the query received from the user to remove one or more results fields from the query based on the security information attached to the limited subset of data and one or more attributes of the user.
22. The computer-readable medium of claim 18 , wherein access to the limited subset of data by a user is restricted by presenting the user with only a limited portion of the limited subset of data obtained by executing a query, received from the user, against the limited subset of data, based on the security information attached to the limited subset of data and one or more attributes of the user.
23. A system, comprising:
one or more databases having data; and
one or more computer processors executing a query manager configured for:
a) executing a query against the one or more databases;
b) generating a plurality of persistent data objects, wherein generating comprises, for each persistent data object:
receiving a query result comprising a dataset obtained from one or more databases in response to execution of a query against the one or more databases;
attaching security information to the query result in order to restrict access to the query result, and wherein the security information includes security settings for a plurality of potential requesting entities, the security settings defining access rights of each potential requesting entity to at least a portion of the query result; and
storing the query result and the attached security information as a rowset in a persistent data object in a data repository; whereby each respective persistent data object is independently accessible on the basis of the respective security information contained within the respective persistent data object; and
c) granting access to the query result by multiple users, whereby the access by a particular user is dependent on one or more attributes of the particular user and the security information attached to the query result.