Query conditions-based security
View Patent ↗A method, system and article of manufacture for managing access to queries and, more particularly, for managing access by multiple users to persistently stored queries. One embodiment provides a method of managing access by multiple users to a predefined query against data in a database. The method comprises associating one or more access rights with at least some portion of the predefined query. When a request to access the predefined query by a first user is received, access to the predefined query by the first user is limited on the basis of the access rights.
1. A computer-implemented method of managing access by multiple users to a predefined query against data in a database, comprising:
associating one or more access rights with a first portion of the predefined query, wherein the predefined query is a text string in a query language and wherein the first portion is a substring of the predefined query;
receiving, by a query manager application executing on a processor, a request to access the predefined query by a first user;
limiting access to the first portion of the predefined query by the first user on the basis of the one or more access rights associated with the first portion of the predefined query; and
allowing access to a remainder portion of the predefined query by the first user, wherein the remainder portion does not include the first portion.
2. The method of claim 1 further comprising:
determining one or more attributes of the first user; and
limiting access to the first portion of the predefined query by the first user on the basis of the access rights and the one or more attributes of the first user, wherein limiting access to the predefined query by the first user on the basis of the access rights and the one or more attributes of the first user comprises:
identifying user-specific access rights for the first user from the access rights using the one or more determined attributes, and
wherein access by the first user to some or all of the predefined query is granted on the basis of the user-specific access rights.
3. The method of claim 2 , wherein one of the attributes is
(i) a user name;
(ii) a user role; and
(iii) a user authorization level.
4. The method of claim 3 , wherein limiting access to the predefined query by the first user on the basis of the access rights and the one or more attributes of the first user comprises allowing the user to make a personal copy of the predefined query.
5. The method of claim 4 , wherein limiting access to the predefined query by the first user on the basis of the access rights and the one or more attributes of the first user comprises allowing the user to modify some limited portion of the personal copy.
6. The method of claim 4 , wherein the access rights associated with the predefined query are also associated with the personal copy.
7. The method of claim 1 wherein at least one of the one or more access rights limits access to the first portion of the predefined query by one of:
allowing the first user to append query conditions to the query but not modify the first portion; and
preventing the first user from reading the first portion of the predefined query.
8. A non-transitory computer readable storage medium storing a query manager application, which when executed on a processor performs an operation for managing access by multiple users to a predefined query against data in a database, the operation comprising:
associating one or more access rights with a first portion of the predefined query, wherein a first access right of the one or more access rights associated with the first portion allows a first user to append query conditions to the query but not modify the first portion, wherein the predefined query is a text string in a query language and wherein the first portion is a substring of the predefined query;
receiving, by the query manager application executing on a processor, a request to access the predefined query by the first user;
limiting access to the first portion of the predefined query by the first user on the basis of the one or more access rights associated with the first portion of the predefined query; and
allowing access to a remainder portion of the predefined query by the first user, wherein the remainder portion does not include the first portion.
9. The computer readable storage medium of claim 8 , wherein the operation further comprises:
determining one or more attributes of the first user; and
limiting access to the first portion of the predefined query by the first user on the basis of the access rights and the one or more attributes of the first user, wherein limiting access to the predefined query by the first user on the basis of the access rights and the one or more attributes of the first user comprises:
identifying user-specific access rights for the first user from the access rights using the one or more determined attributes, and
wherein access by the first user to some or all of the predefined query is granted on the basis of the user-specific access rights.
10. The computer readable storage medium of claim 9 , wherein one of the attributes is
(i) a user name;
(ii) a user role; and
(iii) a user authorization level.
11. The computer readable storage medium of claim 9 , wherein limiting access to the predefined query by the first user on the basis of the access rights and the one or more attributes of the first user comprises allowing the user to make a personal copy of the predefined query.
12. The computer readable storage medium of claim 11 , wherein limiting access to the predefined query by the first user on the basis of the access rights and the one or more attributes of the first user comprises allowing the user to modify some limited portion of the personal copy.
13. The computer readable storage medium of claim 11 , wherein the access rights associated with the predefined query are also associated with the personal copy.
14. The computer readable storage medium of claim 8 , wherein a second access right limits access to the first portion of the predefined query by preventing the first user from reading the first portion of the predefined query.
15. A system comprising:
a processor; and
a memory storing (i) a predefined query, (ii) one or more access rights associated with at least some portion of the predefined query, and (iii) a query manager, which, when executed on the processor, performs an operation for managing access by multiple users to the predefined query against data in a database, the operation comprising:
associating one or more access rights with a first portion of the predefined query, wherein a first access right allows a first user to append query conditions to the query but not modify the first portion, wherein the predefined query is a text string in a query language and wherein the first portion is a substring of the predefined query,
receiving, by the query manager application executing on a processor, a request to access the predefined query by the first user,
limiting access to the first portion of the predefined query by the first user on the basis of the one or more access rights associated with the first portion of the predefined query, and
allowing access to a remainder portion of the predefined query by the first user, wherein the remainder portion does not include the first portion.
16. The system of claim 15 , wherein the operation further comprises:
determining one or more attributes of the first user; and
limiting access to the first portion of the predefined query by the first user on the basis of the access rights and the one or more attributes of the first user, wherein limiting access to the predefined query by the first user on the basis of the access rights and the one or more attributes of the first user comprises:
identifying user-specific access rights for the first user from the access rights using the one or more determined attributes, and
wherein access by the first user to some or all of the predefined query is granted on the basis of the user-specific access rights.
17. The system of claim 16 , wherein one of the attributes is
(i) a user name;
(ii) a user role; and
(iii) a user authorization level.
18. The system of claim 16 , wherein limiting access to the predefined query by the first user on the basis of the access rights and the one or more attributes of the first user comprises allowing the user to make a personal copy of the predefined query.
19. The system of claim 18 wherein limiting access to the predefined query by the first user on the basis of the access rights and the one or more attributes of the first user comprises allowing the user to modify some limited portion of the personal copy.
20. The system of claim 18 wherein the access rights associated with the predefined query are also associated with the personal copy.
21. The system of claim 15 , wherein a second access right limits access to the first portion of the predefined query by preventing the first user from reading the first portion of the predefined query.