Network-based permissioning system
Aspects of the present disclosure include a system comprising a computer-readable storage medium storing at least one program and a method for managing access permissions associated with data resources. Example embodiments involve evaluating user access permissions with respect to shared data resources of a group of network applications. The method includes receiving a request to access a data resource. The method further includes accessing a policy object linked to the data resource that includes an effective policy for the data resource. The method further includes evaluating a user's access permissions with respect to the data resource based on the policy object and communicating a response to the network application that includes the access permission of the user.
1. A method comprising:
receiving an access request for a data resource stored in a first network database;
based on receiving the access request, accessing, from a second network database, a policy object linked to the data resource, the policy object including an effective policy for the data resource, the effective policy including at least one access permission inherited from a parent data resource from which the data resource depends, the at least one access permission including a statement that includes an operation performable with respect to the data resource based on one or more conditions;
evaluating, using a hardware processor, the at least one access permissions of the data resource with respect to a user associated with the access request based on whether the one or more conditions included in the at least one access permission are satisfied; and
communicating a response to the access request based on a result.
2. The method of claim 1 , wherein:
the evaluating of the at least one access permission comprises determining whether the one or more conditions included in the at least one access permission are satisfied.
3. The method of claim 2 , wherein:
the one or more conditions include an allowed user identifier, and
the satisfaction of the one or more conditions is based on a user identifier included in the access request matching the allowed user identifier.
4. The method of claim 2 , wherein:
the one or more conditions include a temporal condition specifying a time range, and
the satisfaction of the one or more conditions is based on the access request being received within the time range.
5. The method of claim 1 , wherein the access request is received from a network application included in a suite of network applications, the suite of network applications sharing access to the first network database.
6. The method of claim 5 , wherein the policy object includes at least one statement defining a condition for permitting or denying the user to perform an application specific operation associated with a particular network application from among the suite of network applications.
7. The method of claim 1 , wherein:
the policy object includes a plurality of statements;
the plurality of statements includes at least one selected from the group comprising:
a first statement granting the user permission to perform a first operation based on satisfaction of a first condition;
a second statement denying the user permission to perform a second operation based on satisfaction of a second condition;
a third statement overriding access permission granted by a fourth statement; or
a fifth statement overriding access permission denied by a sixth statement.
8. The method of claim 1 , further comprising:
creating a log of the access request, the log including an identifier of an application from which the access request was received; and
storing the log of the access request in a third network database.
9. The method of claim 1 , further comprising:
providing, to a client device, a user interface for registering a policy, the user interface including one or more input fields to receive a policy registration;
receiving, from the client device, a policy registration associated with the data resource, the policy registration including a resource identifier and a plurality of statements, the resource identifier identifying the data resource, each of the plurality of statements including an operation performable with respect to the data resource based on satisfaction of one or more conditions; and
based on the policy registration, creating the policy object linked to the data resource; and
storing the policy object in the second network database.
10. The method of claim 9 , further comprising modifying an additional policy object associated with an additional data resource that depends on the data resource, the modifying of the additional policy object including adding the plurality of statements to the additional policy object.
11. A system comprising:
one or more processors of a machine;
a non-transitory machine-readable medium storing instructions that, when executed by the one or more processors of the machine, cause the machine to perform operations comprising:
receiving an access request for a data resource stored in a first network database;
based on receiving the access request, accessing, from a second network database, a policy object linked to the data resource, the policy object including an effective policy for the data resource, the effective policy including at least one access permission inherited from a parent data resource from which the data resource depends, the at least one access permission including a statement that includes an operation performable with respect to the data resource based on one or more conditions;
evaluating the at least one access permissions of the data resource with respect to a user associated with the access request based on whether the one or more conditions included in the at least one access permission are satisfied; and
communicating a response to the access request based on a result of the evaluating of the at least one of the access permissions of the resource with respect to the user.
12. The system of claim 11 , wherein:
the evaluating of the at least one access permission comprises determining whether the one or more conditions included in the at least one access permission are satisfied.
13. The system of claim 12 , wherein:
the one or more conditions include an allowed user identifier, and
the satisfaction of the one or more conditions is based on a user identifier included in the access request matching the allowed user identifier.
14. The system of claim 12 , wherein:
the one or more conditions include a temporal condition specifying a time range, and
the satisfaction of the one or more conditions is based on the access request being received within the time range.
15. The system of claim 11 , wherein the access request is received from a network application included in a suite of network applications, the suite of network applications sharing access to the first network database.
16. The system of claim 15 , wherein the policy object includes at least one statement defining a condition for permitting or denying the user to perform an application specific operation associated with a particular network application from among the suite of network applications.
17. The system of claim 11 , wherein:
the policy object includes a plurality of statements;
the plurality of statements includes at least one selected from the group comprising:
a first statement granting the user permission to perform a first operation based on satisfaction of a first condition;
a second statement denying the user permission to perform a second operation based on satisfaction of a second condition;
a third statement overriding access permission granted by a fourth statement; or
a fifth statement overriding access permission denied by a sixth statement.
18. The system of claim 11 , further comprising:
creating a log of the access request, the log including an identifier of an application from which the access request was received; and
storing the log of the access request in a third network database.
19. The system of claim 11 , wherein the access permission includes an operation the user is authorized to perform on the data resource using a network application.
20. A non-transitory machine-readable storage medium embodying instructions that, when executed by at least one processor of a machine, cause the machine to perform operations comprising:
receiving an access request for a data resource stored in a first network database;
based on receiving the access request, accessing, from a second network database, a policy object linked to the data resource, the policy object including an effective policy for the data resource, the effective policy including at least one access permission inherited from a parent data resource from which the data resource depends, the at least one access permission including a statement that includes an operation performable with respect to the data resource based on one or more conditions;
evaluating, using a hardware processor, the at least one access permissions of the data resource with respect to a user associated with the access request based on whether the one or more conditions included in the at least one access permission are satisfied; and
communicating a response to the access request based on a result of the evaluating of the at least one of the access permissions of the resource with respect to the user.