Method of transforming database system privileges to object privileges
View Patent ↗Coarse-grained system-wide database privileges are transformed into new finer-grained database object privileges that are user-centric and specific to particular objects by creating an object class defining certain generic operations on objects, and defining within the object class a new object that embodies permissible actions on a particular database object. The new object is stored in a catalog table that comprises an object privilege table and is associated in the object privilege table with a consolidated grouping of object privileges of users relative to the new object.
1. A method for managing access privileges to objects in a database system, comprising:
determining by a processor, from system privileges of a plurality of users applicable to an object type, a set of permissible generic operations applicable to a particular object of that object type;
creating a new object class that encapsulates said set of permissible generic operations as object privileges;
creating a new object corresponding to said particular object within said new object class;
selectively granting individual users of said plurality of users certain ones of said object privileges to said new object based upon each individual user's system privileges applicable to said object type; and
storing in said database system said object privileges of said each individual user to said new object, said object privileges of said each individual user being stored with object privileges of other users to said new object, wherein storing said object privileges of said each individual user to said new object comprises:
listing said new object in an object class table; and
storing, in the object class table, a consolidated listing of different object privileges for each said individual users in association with the new object listing.
2. The method of claim 1 , wherein the new object is a protocol object, the object class table is a protocol class table having a column corresponding to a protocol name of the new object.
3. The method of claim 1 , wherein the object class table is a new object class table created during a database update.
4. The method of claim 3 , wherein said new object is listed in said new object class table on a single row, and said consolidated listing of different object privileges of other users is contained in a column of said row.
5. The method of claim 1 , wherein said selectively granting individual users object privileges to said new object comprises granting said object privileges according to each individual user's role.
6. The method of claim 1 , wherein said user's system privileges are relative to an external table, and comprise no privilege, the privileges to create a readable external table, create a writeable external table, and create both a readable and writeable external table, and where said object privileges to said new object comprise none, create read, create write, and create both read and write.
7. The method of claim 6 , wherein said selectively granting comprises mapping said individual user's system privileges to said new object privileges.
8. The method of claim 1 further comprising deleting system privilege metadata from a system privilege table upon said storing said object privileges to said new object.
9. The method of claim 1 further comprising checking a user's new object privileges before granting a user's request for an action on said new object.
10. Computer readable non-transitory storage medium for storing instructions for controlling the operation of a computer to manage access privileges to object objects in a database system, comprising instructions that when executed perform operations comprising:
determining, from system privileges of a plurality of users applicable to an object type, a set of permissible generic operations applicable to a particular object of that object type;
creating a new object class that encapsulates said set of permissible generic operations as object privileges;
creating a new object corresponding to said particular object within said new object class;
selectively granting individual users of said plurality of users certain ones of said object privileges to said new object based upon each individual user's system privileges applicable to said object type; and
storing in said database system said object privileges of said each individual user to said new object, said object privileges of said each individual user being stored with object privileges of other users to said new object, wherein storing said object privileges of said each individual user to said new object comprises:
listing said new object in an object class table; and
storing, in the object class table, a consolidated listing of different object privileges for each said individual users in association with the new object listing.
11. The computer readable medium of claim 10 , wherein the new object is a protocol object, the object class table is a protocol class table having a column corresponding to a protocol name of the new object.
12. The computer readable medium of claim 10 , wherein said object table is a new object class table created during a database update.
13. The computer readable medium of claim 12 , wherein said new object is listed in said new object class table on a single row, and said consolidated listing of different object privileges of other users is contained in a column of said row.
14. The computer readable medium of claim 10 further comprising instructions for selectively granting individual users object privileges to said new object comprises granting said object privileges according to each individual user's role.
15. The computer readable medium of claim 10 , wherein said user's system privileges are relative to an external table, and comprise no privilege, the privileges to create a readable external table, create a writeable external table, and create both a readable and writeable external table, and where said object privileges to said new object comprise none, create read, create write, and create both read and write.
16. The computer readable medium of claim 15 , wherein said selectively granting comprises mapping said individual user's system privileges to said new object privileges.
17. The computer readable medium of claim 10 further comprising instructions for deleting system privilege metadata from a system privilege table upon said storing said object privileges to said new object.
18. The computer readable medium of claim 10 further comprising instructions for checking a user's new object privileges before granting a user's request for an action on said new object.