Access authorization
View Patent ↗Methods, systems, and computer-readable media with executable instructions stored thereon for managing access authorization to hardware and data resources. A method includes defining a property of a hardware and/or data resource. This example method further includes defining a role such that each defined role can be applied to different users without modification, defining a security domain for the property of the resource in the context of a user-role assignment and assigning a role to a user in a context of the defined security domain.
1. A method for managing access authorization to hardware and data resources, comprising:
using an access engine having a processing resource to execute computer readable instructions stored on a non-transitory medium to:
define a property of a resource;
define a role having permissions, wherein each defined role can be reused with different users without modification;
define a security domain for the property of the resource;
assign the defined role to a user in a context of the defined security domain wherein the context of the defined security domain restricts a permission of the defined role assigned to the user; and
assign a purpose, a condition, and a location attribute to a user-role assignment, wherein the attribute applies to all permissions for the user-role assignment rather than on a permission by permission basis.
2. The method of claim 1 , wherein defining a role includes defining a role including at least one of an administrate role and a viewer role.
3. The method of claim 2 , wherein the method includes assigning a permission to a role, wherein assigning a permission includes at least one of an edit and view permission and a view only permission.
4. A non-transitory computer-readable medium storing a set of instructions executable by a computer, wherein the set of instructions are executed by the computer to:
define a property of a network resource;
define a tenant as associated with the property of the resource;
define a role having permissions, wherein each defined role can be reused with different users without modification;
define a security domain for the property of the resource;
assign the defined role to a user in the context of the defined security domain;
assign at lease one of a purpose, a condition, and a location attribute to a user-role assignment; and
assign the defined security domain to the tenant along with the assigned user-role assignment, wherein the defined security domain restricts a permission of the defined role in the user-role assignment rather than on a permission by permission basis.
5. The non-transitory computer readable medium of claim 4 , wherein the set of instructions are executed to define a security domain include associating a user to a role in defining a security domain in connection with each user of a tenant.
6. The non-transitory computer readable medium of claim 5 , wherein the set of instructions are executed to create the user-role association upon at least one of creating a new tenant, defining a new security domain, adding a new user, removing a user, defining a new role associated with a user.
7. A system for managing access authorization to hardware and data resources, the system comprising:
an access control engine having:
a processing resource; and
a non-transitory computer readable medium, wherein the non-transitory computer readable medium includes instructions segmented into a number of modules, the number of modules including:
a role module including instructions executed by the processing resource to define a role having permissions, wherein each defined role can be reused with different users without modification;
a security domain module including instructions executed by the processing resource to define a security domain according to a property of a resource in a context of a user-role assignment such that the defined security domain distinguishes between different resource scopes according to a classification of resources;
a permission module including instructions executed by the processing resource to grant a role to a user in the context of the security domain; and
an attribute module including instructions executed by the processing resource to assign a purpose, a condition, and a location attribute to a user-role assignment such that the attribute applies to all permissions for the user-role assignment rather than on a permission by permission basis.
8. The system of claim 7 , wherein the security domain module includes instructions executed to distinguish between different classifications of resources selected from a region, a tenant, and a company.