Method, system and computer program product for enforcing access controls to features and subfeatures on uncontrolled web application
Embodiments disclosed herein provide feature-level access control functionality useful for enforcing access controls to features and subfeatures on uncontrolled, third party Web Applications such as those associated with social networking sites. Specifically, pages of uncontrolled Web applications are programmatically inspected as they are accessed by users of an enterprise computing environment. Specific features on the pages are located and access to these features is enabled or disabled on a per user basis. A modified page is generated if feature(s) on a Web page is/are to be disabled. To block certain feature(s), content may be rewritten on-the-fly. Because embodiments disclosed herein can programmatically inspect a Web page and understand what is on the page at a much finer granularity, it is possible for enterprises to gain benefits that may come from embracing social networking sites without risking the downsides of allowing enterprise users access to uncontrolled Web applications.
1. A method for feature-level controls on uncontrolled Web applications, comprising:
at a server computer having a processor and a memory storing instructions executable by the processor to monitor network traffic to and from social networking sites and implement a feature-level control functionality:
processing, by the server computer, a request for a Web page of a social networking site having a distinct set of features, wherein the request is associated with a user in a computing environment, and wherein the Web page comprises unstructured application data originated outside and independent of the computing environment;
obtaining, by the server computer, the Web page from a network location outside of the computing environment;
programmatically inspecting, by the server computer, the Web page, wherein programmatically inspecting comprises:
examining the unstructured application data using one or more source-specific filters stored on non-transitory computer memory accessible by the server computer;
identifying each specific type of information contained in the unstructured application data corresponding to one or more features in the distinct set of features of the social networking site; and
determining if any feature of the Web page is to be controlled for the user, the feature provided by the social networking site to allow the user to take a certain action relative to the social networking site via the Web page;
if no feature of the Web page is to be controlled for the user, returning, by the server computer, the Web page for presentation to the user; and
if at least one feature of the Web page is to be controlled for the user, the server computer performing:
generating modified application data that corresponds to the at least one feature of the Web page originated outside of the computing environment according to source-specific application data modification rules, the source-specific application data modification rules being specific to the distinct set of features of the social networking site;
generating a modified page utilizing the modified application data; and
returning the modified page in place of the Web page for presentation to the user.
2. The method according to claim 1 , wherein the Web page is part of the social networking site operating outside of the computing environment.
3. The method according to claim 1 , wherein the at least one feature is part of a Web application originated outside of the computing environment.
4. The method according to claim 1 , wherein the server computer resides in the computing environment, further comprising:
receiving the request for the Web page from a device associated with the user.
5. The method according to claim 1 , wherein the server computer resides outside of the computing environment, further comprising:
at a proxy server residing in the computing environment:
receiving the request for the Web page from a device associated with the user;
determining that the request is destined to a social networking site; and
forwarding the request for the Web page to the server computer programmed with the feature-level control functionality.
6. The method according to claim 5 , wherein the proxy server is operable to:
receive the modified page; and
deliver the modified page to the device associated with the user for presentation of the modified page to the user.
7. The method according to claim 1 , further comprising:
persisting definitions or specifications of source-specific features on one or more non-transitory computer readable media accessible by the server computer programmed with the feature-level control functionality.
8. The method according to claim 1 , wherein the feature-level control functionality comprises a plurality of source-specific control filters for manipulating code of Web applications originated outside and independent of the computing environment to control features, including subfeatures, of the Web applications on a per user basis.
9. A system for feature-level controls on uncontrolled Web applications, comprising:
a server computer communicatively coupled over a network to a plurality of sources outside and independent of a computing environment, wherein the server computer having a processor and a memory storing instructions executable by the processor to monitor network traffic to and from social networking sites and to perform:
processing a request for a Web page of a social networking site having a distinct set of features, the social networking site hosted by a first source of the plurality of sources, wherein the request is associated with a user in the computing environment, and wherein the Web page comprises unstructured application data originated from the first source outside of the computing environment;
obtaining the Web page from the first source;
programmatically inspecting the Web page, wherein programmatically inspecting comprises:
examining the unstructured application data using one or more source-specific filters stored on non-transitory computer memory accessible by the server computer;
identifying each specific type of information contained in the unstructured application data corresponding to one or more features in the distinct set of features of the social networking site; and
determining if any feature of the Web page is to be controlled for the user, the feature provided by the social networking site to allow the user to take a certain action relative to the social networking site via the Web page;
if no feature of the Web page is to be controlled for the user, returning the Web page for presentation to the user; and
if at least one feature of the Web page is to be controlled for the user:
generating modified application data that corresponds to the at least one feature of the Web page according to source-specific application data modification rules, the source-specific application data modification rules being specific to the distinct set of features of the social networking site;
generating a modified page utilizing the modified application data; and
returning the modified page in place of the Web page for presentation to the user.
10. The system of claim 9 , wherein the first source comprises the social networking site and wherein the Web page is part of the social networking site operating outside of the computing environment.
11. The system of claim 9 , wherein the at least one feature is part of a Web application originated from the first source outside of the computing environment.
12. The system of claim 9 , wherein the server computer resides in the computing environment and receives the request for the Web page from a device associated with the user.
13. The system of claim 9 , wherein the server computer resides outside of the computing environment, further comprising:
a proxy server residing in the computing environment, wherein the proxy server is operable to perform:
receiving the request for the Web page from a device associated with the user;
determining that the request is destined to a social networking site; and
forwarding the request for the Web page to the server computer.
14. The system of claim 9 , further comprising:
one or more non-transitory computer readable media storing definitions or specifications of source-specific features.
15. The system of claim 9 , further comprising a plurality of source-specific control filters for manipulating code of Web applications originated from the plurality of sources outside and independent of the computing environment to control features, including subfeatures, of the Web applications on a per user basis.
16. A computer program product for feature-level controls on uncontrolled Web applications, comprising:
at least one non-transitory computer readable medium storing instructions translatable by at least one processor to monitor network traffic to and from social networking sites and to cause a server computer to perform:
processing a request for a Web page of a social networking site having a distinct set of features, wherein the request is associated with a user in a computing environment, and wherein the Web page comprises unstructured application data originated outside and independent of the computing environment;
obtaining the Web page from a network location outside of the computing environment;
programmatically inspecting the Web page, wherein programmatically inspecting comprises:
examining the unstructured application data using one or more source-specific filters stored on non-transitory computer memory accessible by the server computer;
identifying each specific type of information contained in the unstructured application data corresponding to the one or more features in the distinct set of features of the social networking site; and
determining if any feature of the Web page is to be controlled for the user, the feature provided by the social networking site to allow the user to take a certain action relative to the social networking site via the Web page;
if no feature of the Web page is to be controlled for the user, returning the Web page for presentation to the user; and
if at least one feature of the Web page is to be controlled for the user:
generating modified application data that corresponds to the at least one feature of the Web page originated outside of the computing environment according to source-specific application data modification rules, the source-specific application data modification rules being specific to the distinct set of features of the social networking site;
generating a modified page utilizing the modified application data; and
returning the modified page in place of the Web page for presentation to the user.
17. The computer program product of claim 16 , wherein the Web page is part of the social networking site operating outside of the computing environment.
18. The computer program product of claim 16 , wherein the at least one feature is part of a Web application originated outside of the computing environment.
19. The computer program product of claim 16 , wherein the instructions comprise a plurality of source-specific control filters for manipulating code of Web applications originated outside and independent of the computing environment to control features, including subfeatures, of the Web applications on a per user basis.
20. The computer program product of claim 16 , further comprising definitions or specifications of source-specific features.
21. The method according to claim 1 , wherein the modified page being returned to the user has the feature disabled or unavailable to the user for taking the certain action.