Network-based permissioning system
Aspects of the present disclosure include a system comprising a computer-readable storage medium storing at least one program and a method for managing access permissions associated with data resources. Example embodiments involve evaluating user access permissions with respect to shared data resources of a group of network applications. The method includes receiving a request, from one of the network applications, to access a particular data resource. The request includes an identifier of a requesting user. The method further includes accessing a policy object associated with the data resource that includes policy information specifying operations the user is authorized to perform with respect to the data resource based on satisfaction of one or more conditions. The method further includes evaluating the user's access permissions with respect to the data resource based on the policy object, and communicating a response to the network application that includes the access permission of the user.
1. A method comprising:
receiving, from a network application, an access request for a data resource stored in a first network database, the access request including a resource identifier and a user identifier, the resource identifier identifying the data resource, the user identifier identifying a user of the network application;
in response to receiving the access request, using the resource identifier included in the access request to access, from a second network database, a policy object linked to the data resource, the policy object including an effective policy for the data resource, the effective policy including access permissions of the data resource, at least one of the access permissions included in the effective policy of the data resource being inherited from at least one parent data resource from which the data resource depends, the at least one of the access permissions including a statement, the statement including an operation performable with respect to the data resource based on satisfaction of one or more conditions;
evaluating, using a hardware processor, the at least one of the access permissions of the data resource with respect to the user based at least in part on whether the one or more conditions included in the at least one of the access polices are satisfied; and
communicating, to the network application, a response to the access request, the response to the access request including the a result of the evaluating of the at least one of the access permissions of the data resource with respect to the user.
2. The method of claim 1 , further comprising:
providing, to a client device, a user interface for registering a policy, the user interface including one or more input fields to receive a policy registration;
receiving, from the client device, a policy registration associated with an additional data resource stored in the first network database, the policy registration including an additional resource identifier and a plurality of statements, the additional resource identifier identifying the additional data resource, each of the plurality of statements including a condition and an operation; and
registering a policy associated with the additional data resource based on the policy registration.
3. The method of claim 2 , wherein the registering of the policy includes creating and storing, in the second network database, an additional policy object associated with the additional data resource.
4. The method of claim 3 , wherein:
the data resource depends on the additional data resource; and
the additional policy object includes a data structure comprising a hierarchical resource graph that represents a dependency of the data resource on the additional data resource.
5. The method of claim 4 , wherein the registering of the policy includes applying the policy to the data resource by modifying the effective policy associated with the data resource to include at least a portion of the plurality of statements included in the policy associated with the additional data resource.
6. The method of claim 1 , wherein the access request is received from a network application included in a suite of network applications, the suite of network applications sharing access to the first network database.
7. The method of claim 6 , wherein the policy object includes a plurality of statements including the statement, at least one statement of the plurality of statements defining a condition for permitting or denying the user to perform an application specific operation associated with a particular network application from among the suite of network applications.
8. The method of claim 7 , wherein the plurality of statements includes at least one selected from the group comprising:
a first statement granting the user permission to perform a first operation based on satisfaction of a first condition;
a second statement denying the user permission to perform a second operation based on satisfaction of a second condition;
a third statement overriding access permission granted by a fourth statement; or
a fifth statement overriding access permission denied by a sixth statement.
9. The method of claim 1 , further comprising:
creating a log of the access request, the log including an identifier of the network application, the user identifier, the access permission of the user, and a timestamp; and
storing the log of the access request in a third network database.
10. The method of claim 1 , wherein:
the one or more conditions include an allowed user identifier, and
the satisfaction of the one or more conditions is based on the user identifier matching the allowed user identifier.
11. The method of claim 1 , wherein:
the one or more conditions include a temporal condition specifying a time range, and
the satisfaction of the one or more conditions is based on the access request being received within the time range.
12. The method of claim 1 , wherein the access permission includes an operation the user is authorized to perform on the data resource using the network application.
13. A system comprising:
one or more processors of a machine;
a first non-transitory machine-readable medium storing a plurality of policy objects associated with a plurality of data resources, the plurality of data resources stored in a network database accessed by one or more network applications hosted by one or more servers; and
a second non-transitory machine-readable medium storing instructions that, when executed by the one or more processors of the machine, cause the machine to perform operations comprising:
receiving, from a network application from among the plurality of network applications, an access request for a data resource from among the plurality of data resources stored in the network database, the access request including a resource identifier and a user identifier, the resource identifier identifying the data resource, the user identifier identifying a user of the network application;
in response to receiving the access request, using the resource identifier included in the access request to access, from the first non-transitory machine-readable medium, a policy object linked to the data resource, the policy object including an effective policy for the data resource, the effective policy including access permissions of the data resource, at least one of the access permission included in the effective policy of the data resource being inherited from at least one parent data resource from which the data resource depends, the at least one of the access permissions including a statement, the statement including an operation performable with respect to the data resource based on satisfaction of one or more conditions;
evaluating the at least one of the access permissions of the data resource with respect to the user based at least in part on whether the one or more conditions included in the at least one of the access policies are satisfied; and
communicating, to the network application, a response to the access request, the response to the access request including a result of the evaluation of the at least one of the access permissions of the data resource with respect to the user.
14. The system of claim 13 , wherein the operations further comprise:
providing, to a client device, a user interface for registering a policy, the user interface including one or more input fields to receive a policy registration;
receiving, from the client device, a policy registration associated with the data resource, the policy registration including the resource identifier and a plurality of additional statements; and
registering a policy associated with the data resource based on the policy registration.
15. The system of claim 14 , wherein the registering of the policy includes updating the policy object associated with the data resource to include the plurality of additional statements.
16. The system of claim 14 , wherein:
a child resource depends on the data resource, and
the registering of the policy includes updating an effective policy associated with the child resource, the effective policy being updated to include at least a portion of the plurality of additional statements.
17. The system of claim 13 , wherein the policy object includes a data structure comprising a hierarchical resource graph that represents a dependency of the data resource on the at least one parent data resource.
18. The system of claim 13 , wherein the operations further comprise:
creating a log of the access request, the log including an identifier of the network application, the user identifier, the access permission of the user, and a timestamp; and
storing the log of the access request in a third network database.
19. The system of claim 13 , wherein:
the one or more conditions include an allowed user identifier, and
the satisfaction of the one or more conditions is based on the user identifier matching the allowed user identifier.
20. A non-transitory machine-readable storage medium embodying instructions that, when executed by at least one processor of a machine, cause the machine to perform operations comprising:
receiving, from a network application hosted by a server, an access request for a data resource stored in a first network database, the access request including a resource identifier and a user identifier, the resource identifier identifying the data resource, the user identifier identifying a user of the network application;
in response to receiving the access request, using the resource identifier included in the access request to access, from a second network database, a policy object linked to the data resource, the policy object including an effective policy for the data resource, the effective policy including access policies of the data resource, at least one of the access permissions included in the effective policy of the data resource being inherited from at least one parent data resource from which the data resource depends, the at least one of the access permissions including a statement, the statement including an operation performable with respect to the data resource based on satisfaction of one or more conditions;
evaluating the at least one of the access permissions of the data resource with respect to the user based on whether the one or more conditions included in the at least one of the access policies are satisfied; and
communicating, to the network application, a response to the access request, the response to the access request including a result of the evaluating of the at least one of the access permissions the data resource with respect to the user.