Security systems, methods, and computer program products for information integration platform
An information integration system may include a set of integration services embodied on one or more server machines in a computing environment. The set of integration services may include connectors communicatively connected to disparate information systems. The connectors may be configured for integrating data stored in the disparate information systems utilizing a common model employed by the set of integration services. The common model may overlay, augment, integrate, or otherwise utilize a content management interoperability services data model and may include common property definitions and a common security model. The common security model may include permissions particularly defined for use by the set of integration services. These common property definitions and permissions may be uniquely defined and utilized by the information integration system.
1. A method, comprising:
receiving, by an information integration system, a query from a user device associated with a user, the information integration system having a unified index and adapted for providing a plurality of integration services, the plurality of integration services including a principals service and an authorization service;
performing, by the information integration system, an inbound check on the query utilizing the principals service which provides principals for the user across disparate information systems operating in a computing environment, the inbound check including:
determining a security level associated with the user based at least on the principals provided by the principals service; and
modifying the query from the user device based at least on the security level associated with the user, the modifying including augmenting the query with the principals provided by the principals service;
at query time, performing the query, which has been modified through the inbound check, across the disparate information systems operating in the computing environment, the performing including evaluating the query augmented with the principals, the evaluating including evaluating, in association with the principals for the user, permission information stored in the unified index of the information integration system;
prior to returning search results from the query to the user device, performing, by the information integration system, an outbound check on the search results utilizing the authorization service which provides authorization information from the disparate information systems operating in the computing environment on what search result the user is permitted to view, the outbound check including filtering the search results for the user based on the authorization information provided by the authorization service; and
returning, by the information integration system, the search results filtered through the outbound check to the user device.
2. The method according to claim 1 , wherein the search results reference objects residing in the disparate information systems operating in the computing environment.
3. The method according to claim 1 , wherein the permission information stored in the unified index comprises permissions and wherein the evaluating further comprises evaluating the permissions in order of priorities defined in a security model of the information integration system.
4. The method according to claim 1 , wherein the information integration system is adapted for supporting a plurality of security models including a first security model that comprises the inbound check at query time, a second security model that comprises the outbound check after a search is performed, and a third security model that comprises the inbound check and the outbound check.
5. The method according to claim 1 , wherein the modifying the query from the user device further includes translating the query into a complex Boolean expression.
6. The method according to claim 1 , wherein the inbound check further includes making a call to the principles service and wherein the call to the principles service returns state information across the disparate information systems operating in the computing environment.
7. The method according to claim 6 , wherein the query is augmented with the principals in view of the state information so as not to include any of the disparate information systems that is not available or that does not support the inbound check.
8. An information integration system, comprising:
a processor;
a non-transitory computer readable medium; and
stored instructions translatable by the processor for:
receiving a query from a user device associated with a user;
performing an inbound check on the query utilizing a principals service which provides principals for the user across disparate information systems operating in a computing environment, the inbound check including:
determining a security level associated with the user based at least on the principals provided by the principals service; and
modifying the query from the user device based at least on the security level associated with the user, the modifying including augmenting the query with the principals provided by the principals service;
at query time, performing the query, which has been modified through the inbound check, across the disparate information systems operating in the computing environment, the performing including evaluating the query augmented with the principals, the evaluating including evaluating, in association with the principals for the user, permission information stored in a unified index;
prior to returning search results from the query to the user device, performing an outbound check on the search results utilizing the authorization service which provides authorization information from the disparate information systems operating in the computing environment on what search result the user is permitted to view, the outbound check including filtering the search results for the user based on the authorization information provided by the authorization service; and
returning the search results filtered through the outbound check to the user device.
9. The information integration system of claim 8 , wherein the search results reference objects residing in the disparate information systems operating in the computing environment.
10. The information integration system of claim 8 , wherein the permission information stored in the unified index comprises permissions and wherein the evaluating further comprises evaluating the permissions in order of priorities defined in a security model.
11. The information integration system of claim 8 , wherein the stored instructions are further translatable by the processor for supporting a plurality of security models including a first security model that comprises the inbound check at query time, a second security model that comprises the outbound check after a search is performed, and a third security model that comprises the inbound check and the outbound check.
12. The information integration system of claim 8 , wherein the modifying the query from the user device further includes translating the query into a complex Boolean expression.
13. The information integration system of claim 8 , wherein the inbound check further includes making a call to the principles service and wherein the call to the principles service returns state information across the disparate information systems operating in the computing environment.
14. The information integration system of claim 13 , wherein the query is augmented with the principals in view of the state information so as not to include any of the disparate information systems that is not available or that does not support the inbound check.
15. A computer program product comprising a non-transitory computer-readable medium storing instructions translatable by a processor of an information integration system for:
receiving a query from a user device associated with a user;
performing an inbound check on the query utilizing a principals service which provides principals for the user across disparate information systems operating in a computing environment, the inbound check including:
determining a security level associated with the user based at least on the principals provided by the principals service; and
modifying the query from the user device based at least on the security level associated with the user, the modifying including augmenting the query with the principals provided by the principals service;
at query time, performing the query, which has been modified through the inbound check, across the disparate information systems operating in the computing environment, the performing including evaluating the query augmented with the principals, the evaluating including evaluating, in association with the principals for the user, permission information stored in a unified index;
prior to returning search results from the query to the user device, performing an outbound check on the search results utilizing the authorization service which provides authorization information from the disparate information systems operating in the computing environment on what search result the user is permitted to view, the outbound check including filtering the search results for the user based on the authorization information provided by the authorization service; and
returning the search results filtered through the outbound check to the user device.
16. The computer program product of claim 15 , wherein the permission information stored in the unified index comprises permissions and wherein the evaluating further comprises evaluating the permissions in order of priorities defined in a security model.
17. The computer program product of claim 15 , wherein the instructions are further translatable by the processor for supporting a plurality of security models including a first security model that comprises the inbound check at query time, a second security model that comprises the outbound check after a search is performed, and a third security model that comprises the inbound check and the outbound check.
18. The computer program product of claim 15 , wherein the modifying the query from the user device further includes translating the query into a complex Boolean expression.
19. The computer program product of claim 15 , wherein the inbound check further includes making a call to the principles service and wherein the call to the principles service returns state information across the disparate information systems operating in the computing environment.
20. The computer program product of claim 19 , wherein the query is augmented with the principals in view of the state information so as not to include any of the disparate information systems that is not available or that does not support the inbound check.