Security systems, methods, and computer program products for information integration platform
An information integration system may include a set of integration services embodied on one or more server machines in a computing environment. The set of integration services may include connectors communicatively connected to disparate information systems. The connectors may be configured for integrating data stored in the disparate information systems utilizing a common model employed by the set of integration services. The common model may overlay, augment, integrate, or otherwise utilize a content management interoperability services data model and may include common property definitions and a common security model. The common security model may include permissions particularly defined for use by the set of integration services. These common property definitions and permissions may be uniquely defined and utilized by the information integration system.
1. A method, comprising:
receiving, by a search system, a search query from a client device associated with a user, the search system configured for evaluating search queries according to a security model, the security model having an inbound check and an outbound check;
responsive to the search query, performing the inbound check at query time, the inbound check including determining principals associated with the user, the inbound check performed by the search system embodied on a server machine;
modifying the search query to include a union of the security level principals associated with the user to define a scope of search for the search query, the modifying performed by the search system, the principals obtained or received from a plurality of repositories, wherein the search system performs the search query that has been modified in across the plurality of repositories using the principals obtained or received from the plurality of repositories;
after the search query is performed, performing an outbound check including verifying whether the user has authorization to view search results from the search query, the outbound check performed by the search system;
based on authorization information associated with the user, filtering out documents in the search results for which the user is not authorized to access, the filtering performed by the search system; and
presenting, on the client device, only documents in the search results for which the user is authorized to access based on the authorization information associated with the user.
2. The method according to claim 1 , wherein the inbound check includes checking user permissions with respect to search queries at query time, and wherein the outbound check includes checking user access rights with respect to search results so as to produce filtered search results prior to presentation of the filtered search results on user devices.
3. The method according to claim 1 , wherein the principals associated with the user are obtained by the search system via a principals service running on an information integration server and wherein the information integration server integrates information from disparate information systems communicatively connected to the information integration server.
4. The method according to claim 1 , wherein the authorization information associated with the user is obtained by the search system via an authorization service running on an information integration server and wherein the information integration server integrates information from disparate information systems communicatively connected to the information integration server.
5. The method according to claim 1 , wherein the principals associated with the user and the authorization information associated with the user are obtained by the search system via an information integration server, wherein the information integration server integrates information from disparate information systems communicatively connected to the information integration server, wherein credentials for the user to access the disparate information systems are stored in an encrypted database, and wherein the encrypted database is internal to the information integration server.
6. The method according to claim 1 , wherein the principals associated with the user and the authorization information associated with the user are obtained by the search system via an information integration server, wherein the information integration server integrates information from disparate information systems communicatively connected to the information integration server, wherein credentials for the user to access the disparate information systems are stored in an encrypted database, and wherein the encrypted database is external to the information integration server.
7. The method according to claim 1 , wherein the search system comprises a unified index that implements the security model and wherein the unified index references information stored in disparate information systems.
8. A search system, comprising:
a processor;
a non-transitory computer readable medium; and
stored instructions translatable by the processor to perform:
receiving a search query from a client device associated with a user;
responsive to the search query, performing an inbound check at query time, the inbound check including determining principals associated with the user;
modifying the search query to include a union of the principals associated with the user to define a scope of search for the search query, the principals obtained or received from a plurality of repositories, wherein the search system performs the search query that has been modified across the plurality of repositories using the principals obtained or received from the plurality of repositories;
after the search query is performed, performing an outbound check including verifying whether the user has authorization to view search results from the search query;
based on authorization information associated with the user, filtering out documents in the search results for which the user is not authorized to access; and
presenting, on the client device, only documents in the search results for which the user is authorized to access based on the authorization information associated with the user.
9. The search system of claim 8 , wherein the inbound check includes checking user permissions with respect to search queries at query time, and wherein the outbound check includes checking user access rights with respect to search results so as to produce filtered search results prior to presentation of the filtered search results on user devices.
10. The search system of claim 8 , wherein the principals associated with the user are obtained via a principals service running on an information integration server and wherein the information integration server integrates information from disparate information systems communicatively connected to the information integration server.
11. The search system of claim 8 , wherein the authorization information associated with the user is obtained via an authorization service running on an information integration server and wherein the information integration server integrates information from disparate information systems communicatively connected to the information integration server.
12. The search system of claim 8 , wherein the principals associated with the user and the authorization information associated with the user are obtained via an information integration server, wherein the information integration server integrates information from disparate information systems communicatively connected to the information integration server, wherein credentials for the user to access the disparate information systems are stored in an encrypted database, and wherein the encrypted database is internal to the information integration server.
13. The search system of claim 8 , wherein the principals associated with the user and the authorization information associated with the user are obtained via an information integration server, wherein the information integration server integrates information from disparate information systems communicatively connected to the information integration server, wherein credentials for the user to access the disparate information systems are stored in an encrypted database, and wherein the encrypted database is external to the information integration server.
14. The search system of claim 8 , further comprising a unified index that implements the security model, wherein the unified index references information stored in disparate information systems.
15. A computer program product comprising a non-transitory computer readable medium storing instructions translatable by a processor of a search system to perform:
receiving a search query from a client device associated with a user;
responsive to the search query, performing an inbound check at query time, the inbound check including determining principals associated with the user;
modifying the search query in accordance with to include a union of the principals associated with the user to define a scope of search for the search query, the principals obtained or received from a plurality of repositories, wherein the search system performs the search query that has been modified across the plurality of repositories using the principals obtained or received from the plurality of repositories;
after the search query is performed, performing an outbound check including verifying whether the user has authorization to view search results from the search query;
based on authorization information associated with the user, filtering out documents in the search results for which the user is not authorized to access; and
presenting, on the client device, only documents in the search results for which the user is authorized to access based on the authorization information associated with the user.
16. The computer program product of claim 15 , wherein the inbound check includes checking user permissions with respect to search queries at query time, and wherein the outbound check includes checking user access rights with respect to search results so as to produce filtered search results prior to presentation of the filtered search results on user devices.
17. The computer program product of claim 15 , wherein the principals associated with the user are obtained via a principals service running on an information integration server and wherein the information integration server integrates information from disparate information systems communicatively connected to the information integration server.
18. The computer program product of claim 15 , wherein the authorization information associated with the user is obtained via an authorization service running on an information integration server and wherein the information integration server integrates information from disparate information systems communicatively connected to the information integration server.
19. The computer program product of claim 15 , wherein the principals associated with the user and the authorization information associated with the user are obtained via an information integration server, wherein the information integration server integrates information from disparate information systems communicatively connected to the information integration server, wherein credentials for the user to access the disparate information systems are stored in an encrypted database, and wherein the encrypted database is internal to the information integration server.
20. The computer program product of claim 15 , wherein the principals associated with the user and the authorization information associated with the user are obtained via an information integration server, wherein the information integration server integrates information from disparate information systems communicatively connected to the information integration server, wherein credentials for the user to access the disparate information systems are stored in an encrypted database, and wherein the encrypted database is external to the information integration server.