Controlling search access to assets in a data protection product
A data protection application creates backups of assets. Each asset is mapped in a directory service to one or more asset owners. The directory service is separate from the data protection application. A search query from a user seeking to search the backups is received at the data protection application. The directory service is consulted to identify assets having the user as an asset owner. A search filter is generated including a list of the identified assets. The search filter is applied to the search query to exclude from a search result backups of assets not having the user as the asset owner. The search result is returned to the user, the search result thereby including backups of assets having the user as an asset owner and excluding other backups of other assets not having the user as the asset owner.
1. A method comprising:
creating, by a data protection application, a plurality of backups for a plurality of assets, wherein each asset is mapped in a directory service to one or more asset owners, and the directory service is separate from the data protection application, wherein the directory service is a lightweight directory access protocol (LDAP) directory service of an organization, the mapping of an asset is stored within LDAP objects of the LDAP directory service, the LDAP objects correspond to users and user groups of the organization, and the mapping in an LDAP object comprises an identifier for the asset and a level of access granted to the LDAP object on backups of the asset;
receiving, at the data protection application, a search query from a user seeking to search the backups;
consulting, by the data protection application, the directory service to identify assets having the user as an asset owner;
generating a search filter comprising a list of the identified assets;
applying the search filter to the search query to exclude from a search result backups of assets not having the user as the asset owner; and
returning the search result to the user, the search result thereby comprising backups of assets having the user as an asset owner and excluding other backups of other assets not having the user as the asset owner, wherein consulting the directory service comprises:
retrieving from the directory service a first list comprising first identifications of assets that have been mapped to an LDAP user object representing the user;
querying the directory service to identify LDAP group objects representing groups having the user as a member;
retrieving from the directory service for each identified LDAP group second identifications of assets that have been mapped to an LDAP group object representing a group having the user as a member; and
combining the first and second identifications of assets to form the list of identified assets for the search filter.
2. The method of claim 1 further comprising:
enforcing, by the data protection application, the level of access granted to the LDAP object in the LDAP directory service on backups of the asset.
3. The method of claim 1 wherein each asset comprises a plurality of items backed up and indexed by the data protection application.
4. The method of claim 1 wherein mappings of the assets to the one or more asset owners are stored by the directory service, and the backups of the assets are stored by the data protection application.
5. The method of claim 1 wherein the level of access in the LDAP object indicates whether the LDAP object is permitted to restore a backup of the asset.
6. The method of claim 1 wherein the identifier for the asset comprises an Internet Protocol (IP) address, the level of access granted to the LDAP object on backups of the asset thereby applying to all items backed up from the IP address.
7. The method of claim 1 wherein the level of access comprises a first level of access that allows the LDAP object to view metadata of items in the backups of the asset, a second level of access that allows the LDAP object to view text content of the items in the backups of the asset, or a third level of access that allows the LDAP object to restore the backups of the asset.
8. A system comprising: a processor; and memory configured to store one or more sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of:
creating, by a data protection application, a plurality of backups for a plurality of assets, wherein each asset is mapped in a directory service to one or more asset owners, and the directory service is separate from the data protection application, wherein the directory service is a lightweight directory access protocol (LDAP) directory service of an organization, the mapping of an asset is stored within LDAP objects of the LDAP directory service, the LDAP objects correspond to users and user groups of the organization, and the mapping in an LDAP object comprises an identifier for the asset and a level of access granted to the LDAP object on backups of the asset;
receiving, at the data protection application, a search query from a user seeking to search the backups;
consulting, by the data protection application, the directory service to identify assets having the user as an asset owner;
generating a search filter comprising a list of the identified assets;
applying the search filter to the search query to exclude from a search result backups of assets not having the user as the asset owner; and
returning the search result to the user, the search result thereby comprising backups of assets having the user as an asset owner and excluding other backups of other assets not having the user as the asset owner, wherein the consulting the directory service comprises:
retrieving from the directory service a first list comprising first identifications of assets that have been mapped to an LDAP user object representing the user;
querying the directory service to identify LDAP group objects representing groups having the user as a member;
retrieving from the directory service for each identified LDAP group second identifications of assets that have been mapped to an LDAP group object representing a group having the user as a member; and
combining the first and second identifications of assets to form the list of identified assets for the search filter.
9. The system of claim 8 wherein the processor further carries out the steps of:
enforcing, by the data protection application, the level of access granted to the LDAP object in the LDAP directory service on backups of the asset.
10. The system of claim 8 wherein each asset comprises a plurality of items backed up and indexed by the data protection application.
11. The system of claim 8 wherein mappings of the assets to the one or more asset owners are stored by the directory service, and the backups of the assets are stored by the data protection application.
12. The system of claim 8 wherein the LDAP directory service is an active directory managed by a network administrator of the organization.
13. A computer program product, comprising a non-transitory computer-readable medium having a computer-readable program code embodied therein, the computer-readable program code adapted to be executed by one or more processors to implement a method comprising:
creating, by a data protection application, a plurality of backups for a plurality of assets, wherein each asset is mapped in a directory service to one or more asset owners, and the directory service is separate from the data protection application, wherein the directory service is a lightweight directory access protocol (LDAP) directory service of an organization, the mapping of an asset is stored within LDAP objects of the LDAP directory service, the LDAP objects correspond to users and user groups of the organization, and the mapping in an LDAP object comprises an identifier for the asset and a level of access granted to the LDAP object on backups of the asset;
receiving, at the data protection application, a search query from a user seeking to search the backups;
consulting, by the data protection application, the directory service to identify assets having the user as an asset owner;
generating a search filter comprising a list of the identified assets;
applying the search filter to the search query to exclude from a search result backups of assets not having the user as the asset owner; and
returning the search result to the user, the search result thereby comprising backups of assets having the user as an asset owner and excluding other backups of other assets not having the user as the asset owner, wherein the consulting the directory service comprises:
retrieving from the directory service a first list comprising first identifications of assets that have been mapped to an LDAP user object representing the user;
querying the directory service to identify LDAP group objects representing groups having the user as a member;
retrieving from the directory service for each identified LDAP group second identifications of assets that have been mapped to an LDAP group object representing a group having the user as a member; and
combining the first and second identifications of assets to form the list of identified assets for the search filter.
14. The computer program product of claim 13 wherein the method further comprises:
enforcing, by the data protection application, the level of access granted to the LDAP object in the LDAP directory service on backups of the asset.
15. The computer program product of claim 13 wherein each asset comprises a plurality of items backed up and indexed by the data protection application.
16. The computer program product of claim 13 wherein mappings of the assets to the one or more asset owners are stored by the directory service, and the backups of the assets are stored by the data protection application.
17. The computer program product of claim 13 wherein the level of access in the LDAP object indicates whether the LDAP object is permitted to restore a backup of the asset.