Network-based permissioning system
Aspects of the present disclosure include a system comprising a computer-readable storage medium storing at least one program and a method for managing access permissions associated with data resources. The method includes providing a user interface for registering a policy to a client device, and receiving a policy registration associated with a data resource stored in a first network database. The method further includes registering a policy associated with the data resource based on the policy registration. The registering of the policy includes creating a policy object that is linked to the data resource and storing the policy object in a second network database.
1. A method comprising:
providing, to a client device, a user interface for registering a policy, the user interface including one or more input fields to receive a policy registration;
receiving, from the client device, a policy registration associated with a data resource stored in a first network database, the policy registration including a resource identifier and a plurality of statements, the resource identifier identifying the data resource, each of the plurality of statements including an operation performable with respect to the data resource based on satisfaction of one or more conditions; and
registering a policy associated with the data resource based on the policy registration, the registering of the policy including:
creating a policy object that is linked to the data resource, the policy object comprising an effective policy for the data resource, the effective policy including the plurality of statements and at least one access permission inherited from at least one parent data resource from which the data resource depends; and
storing the policy object in a second network database.
2. The method of claim 1 , further comprising modifying an additional policy object associated with an additional data resource that depends on the data resource, the modifying of the additional policy object including adding the plurality of statements to the additional policy object.
3. The method of claim 1 , wherein the policy object further includes a hierarchical resource graph that represents a dependency of the data resource on the at least one parent data resource.
4. The method of claim 1 , wherein at least one statement of the plurality of statements defines a condition for permitting or denying the user to perform an application specific operation associated with a particular network application from among a suite of network applications that share access to the first network database.
5. The method of claim 1 , wherein the plurality of statements includes at least one selected from the group comprising:
a first statement granting the user permission to perform a first operation based on satisfaction of a first condition;
a second statement denying the user permission to perform a second operation based on satisfaction of a second condition;
a third statement overriding access permission granted by a fourth statement; or
a fifth statement overriding access permission denied by a sixth statement.
6. The method of claim 1 , wherein:
the one or more conditions include an allowed user identifier, and
the satisfaction of the one or more conditions is based on the user identifier matching the allowed user identifier.
7. The method of claim 1 , wherein:
the one or more conditions include a temporal condition specifying a time range, and
the satisfaction of the one or more conditions is based on the access request being received within the time range.
8. The method of claim 1 , further comprising:
receiving, from a network application, an access request for the data resource, the access request including a user identifier that identifies a user of the network application;
evaluating an access permission of the user with respect to the data resource based on the policy object; and
communicating, to the network application, a response to the access request, the response to the access request including the access permission of the user with respect to the data resource.
9. The method of claim 8 , further comprising:
creating a log of the access request, the log including an identifier of the network application, the user identifier, the access permission of the user, and a timestamp; and
storing the log of the access request in a third network database.
10. The method of claim 8 , wherein the network application is included in a suite of network applications that share access to the first network database.
11. A system comprising:
one or more processors of a machine;
a non-transitory machine-readable medium storing instructions that, when executed by the one or more processors of the machine, cause the machine to perform operations comprising:
providing, to a client device, a user interface for registering a policy, the user interface including one or more input fields to receive a policy registration;
receiving, from the client device, a policy registration associated with a data resource stored in a first network database, the policy registration including a resource identifier and a plurality of statements, the resource identifier identifying the data resource, each of the plurality of statements including an operation performable with respect to the data resource based on satisfaction of one or more conditions; and
registering a policy associated with the data resource based on the policy registration, the registering of the policy including:
creating a policy object that is linked to the data resource, the policy object comprising an effective policy for the data resource, the effective policy including the plurality of statements and at least one access permission inherited from at least one parent data resource from which the data resource depends; and
storing the policy object in a second network database.
12. The system of claim 11 , wherein the operations further comprise modifying an additional policy object associated with an additional data resource that depends on the data resource, the modifying of the additional policy object including adding the plurality of statements to the additional policy object.
13. The system of claim 11 , wherein the policy object further includes a hierarchical resource graph that represents a dependency of the data resource on the at least one parent data resource.
14. The system of claim 11 , wherein at least one statement of the plurality of statements defines a condition for permitting or denying the user to perform an application specific operation associated with a particular network application from among a suite of network applications that share access to the first network database.
15. The system of claim 11 , wherein the plurality of statements includes at least one selected from the group comprising:
a first statement granting the user permission to perform a first operation based on satisfaction of a first condition;
a second statement denying the user permission to perform a second operation based on satisfaction of a second condition;
a third statement overriding access permission granted by a fourth statement; or
a fifth statement overriding access permission denied by a sixth statement.
16. The system of claim 11 , wherein:
the one or more conditions include an allowed user identifier, and
the satisfaction of the one or more conditions is based on the user identifier matching the allowed user identifier.
17. The system of claim 11 , wherein:
the one or more conditions include a temporal condition specifying a time range, and
the satisfaction of the one or more conditions is based on the access request being received within the time range.
18. The system of claim 11 , wherein the operations further comprise:
receiving, from a network application, an access request for the data resource, the access request including a user identifier that identifies a user of the network application;
evaluating an access permission of the user with respect to the data resource based on the policy object; and
communicating, to the network application, a response to the access request, the response to the access request including the access permission of the user with respect to the data resource.
19. The system of claim 18 , wherein the operations further comprise:
creating a log of the access request, the log including an identifier of the network application, the user identifier, the access permission of the user, and a timestamp; and
storing the log of the access request in a third network database.
20. A non-transitory machine-readable storage medium embodying instructions that, when executed by at least one processor of a machine, cause the machine to perform operations comprising:
providing, to a client device, a user interface for registering a policy, the user interface including one or more input fields to receive a policy registration;
receiving, from the client device, a policy registration associated with a data resource stored in a first network database, the policy registration including a resource identifier and a plurality of statements, the resource identifier identifying the data resource, each of the plurality of statements including an operation performable with respect to the data resource based on satisfaction of one or more conditions; and
registering a policy associated with the data resource based on the policy registration, the registering of the policy including:
creating a policy object that is linked to the data resource, the policy object comprising an effective policy for the data resource, the effective policy including the plurality of statements and at least one access permission inherited from at least one parent data resource from which the data resource depends; and
storing the policy object in a second network database.