Evaluating an access control list from permission statements
The disclosed technology addresses the need in the art for a content management system that can be highly flexible to the needs of its subjects. The present technology permits any object to be shared by providing a robust and flexible access control list mechanism. The present technology utilizes a data structure that is highly efficient that both minimizes the amount of information that needs to be written into any database, but also allows for fast reads and writes of information from authoritative tables that are a source of truth for the content management system, while allowing for maintenance of indexes containing more refined data that allow for efficient retrieval of certain information that would normally need to be calculated when it is needed.
1. A method to determine if a user account can access data pertaining to an object ID, the method comprising:
determining a list of ancestors of the object ID;
obtaining a permission statement for each ancestor in the list of ancestors and the object ID;
ordering the obtained permission statements into an ordered list according to inheritance properties of the respective permission statements; and
iterating through the ordered list of the obtained permission statements, in order, until one of the obtained permission statements in the ordered list grants or denies access to the object.
2. The method of claim 1 , wherein the determining the list of ancestors comprises:
recursively performing at least the following steps:
retrieving a next ancestor object ID by looking up a query object ID in a table containing ancestor data;
building the list of ancestors by adding the next ancestor object ID as an ancestor to the query object ID; and
making the next ancestor object ID the query object ID.
3. The method of claim 1 , wherein the ordering the permission statements into the ordered list according to the inheritance properties further comprises:
determining that a respective permission statement for an object ID in the obtained permission statements has an inheritance property of “deny inherit”; and
discarding all permission statements pertaining to an ancestor of the object ID having the inheritance property of “deny inherit”.
4. The method of claim 1 , wherein the ordering the permission statements into the ordered list according to the inheritance properties further comprises:
determining that a respective permission statement for an object ID has an inheritance property of “last”; and
arranging permission statements pertaining to an ancestor of the object ID having the inheritance property of “last” in the ordered list in a same relative order as their respective ancestors are arranged in a directory tree containing the ancestors.
5. The method of claim 1 , wherein the ordering the permission statements into the ordered list according to the inheritance properties further comprises:
determining that a respective permission statement for an object ID in the obtained access permission statements has an inheritance property of “first”; and
arranging the permission statements pertaining to an ancestor of the object ID with the inheritance property of “first” at the top of the ordered list of permission statements.
6. The method of claim 1 , wherein the ordering the permission statements into the ordered list according to the inheritance properties further comprises:
arranging permission statements having an inheritance property of “first” above permission statements having an inheritance property of “last” in the ordered list of permission statements.
7. The method of claim 6 , wherein a particular permission statement having the inheritance property of “first” can be non-suppressible, whereby any subsequent permission statement in the ordered list of permission statements cannot override the particular permission statement.
8. The method of claim 6 , wherein a particular permission statement having the inheritance property of “first” can be suppressible, whereby any subsequent permission statement in the ordered list of permission statements can override the particular permission statement.
9. The method of claim 1 , wherein a permission statement for an object defines at least a user to which the permission statement applies, whether a permission is granted or denied to the user, an action permitted to be performed by the user, and an inheritance property for the permission statement.
10. A non-transitory computer readable medium comprising instructions, the instructions, when executed by a computing system, cause the computing system to:
determine a list of object IDs, each object ID respectively associated with a directory object in a tree of directory objects, wherein a respective permissions statement for each object ID in the list may effect access to a queried object ID;
obtain a permission statement for each object ID in the list;
order the obtained permission statements into an ordered list according to inheritance properties of the respective permission statements; and
iterate through the ordered list of obtained permission statements, in order, until one of the obtained permission statements in the ordered list grants or denies access to the queried object ID.
11. The computer readable medium of claim 10 , wherein the instructions to order the permission statements into the ordered list according to the inheritance properties comprises further instructions to:
determine that a respective permission statement for an object ID in the obtained permission statements has an inheritance property of “deny inherit”; and
discard all permission statements pertaining to an ancestor of the object ID have the inheritance property of “deny inherit”.
12. The computer readable medium of claim 10 , wherein the instructions to order the permission statements into the ordered list according to the inheritance properties comprises further instructions to:
determine that a respective permission statement for an object ID has an inheritance property of “last”; and
arrange the permission statements pertaining to an ancestor of the object ID having the inheritance property of “last” in the ordered list in a same relative order as their respective ancestors are arranged in a directory tree containing the ancestors.
13. The computer readable medium of claim 10 , wherein the instructions to order the permission statements into the ordered list according to the inheritance properties comprises further instructions to:
determine that a respective permission statement for an object ID in the obtained access permission statements has an inheritance property of “first”; and
arrange the permission statements pertaining to an ancestor of the object ID with the inheritance property of “first” at the top of the ordered list of permission statements.
14. The computer readable medium of claim 10 , wherein the instructions to order the permission statements into the ordered list according to the inheritance properties comprises further instructions to:
arrange permission statements having an inheritance property of “first” above permission statements having an inheritance property of “last” in the ordered list of permission statements.
15. The computer readable medium of claim 14 , wherein a particular permission statement having the inheritance property of “first” can be non-suppressible, whereby any subsequent permission statement in the ordered list of permission statements cannot override the particular permission statement.
16. The computer readable medium of claim 14 , wherein a particular permission statement having the inheritance property of “first” can be suppressible, whereby any subsequent permission statement in the ordered list of permission statements can override the particular permission statement.
17. The computer readable medium of claim 10 , wherein a permission statement for an object defines at least a user to which the permission statement applies, whether a permission is granted or denied to the user, an action permitted to be performed by the user, and an inheritance property for the permission statement.
18. A system comprising:
at least one processor; and
at least one non-transitory computer readable medium storing instructions thereon, the instructions are effective to cause the at least one processor to:
determine a list of ancestors of an object ID,
obtain a permission statement for each object ID in the list of ancestors,
order the obtained permission statements into an ordered list according to inheritance properties of the respective permission statements, and
iterate through the ordered list of the permission statements, in order, until one of the permission statements in the ordered list grants or denies access to the object.
19. The system of claim 18 , wherein the instructions further cause the processor to: wherein the ordering the permission statements into the ordered list according to the inheritance properties further comprises:
determine that a respective permission statement for an object ID in the obtained permission statements has an inheritance property of “deny inherit”; and
discard all permission statements pertaining to an ancestor of the object ID have the inheritance property of “deny inherit”.
20. The system of claim 18 , wherein the instructions to order the permission statements into the ordered list according to the inheritance properties comprises further instructions to:
arrange permission statements having an inheritance property of “first” above permission statements having an inheritance property of “last” in the ordered list of permission statements.