Access controls for external data records
Methods and corresponding systems and apparatuses for configuring user access to data stored in and/or accessed through an external computer system are described. Access permissions can be configured through defining a permission set relative to a proxy entity and assigning the permission set to one or more users. A proxy entity is a local representation of an external data entity. A proxy entity can be a virtual entity in that the proxy entity does not contain underlying data. A proxy entity can, however, include metadata describing its corresponding external data entity. A computer system maintaining a proxy entity can store mapping information linking the proxy entity to an external data entity. The mapping information and the permission set can be used to determine an access permission relative to the external data entity and to communicate this access permission to the external computer system so that access can be provided accordingly.
1. A computer-implemented method comprising:
receiving, by a first computer system, user input from a computing device of a first user, the user input indicating that a second user has permission to access a proxy entity maintained by the first computer system, wherein the proxy entity represents an external data entity maintained by a second computer system, wherein the external data entity is stored in a database accessible to the second computer system but inaccessible to the first computer system;
assigning, by the first computer system, a permission set to the second user based on the user input;
determining, by the first computer system and using the permission set, an access permission relative to the external data entity, wherein the determining of the access permission relative to the external data entity comprises looking up a first stored mapping in response to a request for information about permissions assigned to the second user, the first stored mapping linking an identifier of the proxy entity to an identifier of the external data entity, the first stored mapping being one of a plurality of stored mappings periodically updated in response to synchronization of the first and second computer systems to link identifiers of proxy entities to corresponding identifiers of external data entities; and
communicating, by the first computer system, the access permission relative to the external data entity to the second computer system, wherein the access permission relative to the external data entity is processed by the second computer system to generate an authorization token controlling access to the external data entity by a computing device of the second user, the authorization token configurable to have:
a first state indicating permission to access the external data entity, and
a second state not indicating permission to access the external data entity in response to detecting that the external data entity has been deleted without updating or deleting the first stored mapping.
2. The computer-implemented method of claim 1 , wherein the identifier of the proxy entity is assigned by the first computer system, and wherein the identifier of the external data entity is assigned by the second computer system.
3. The computer-implemented method of claim 1 , wherein the request for information about permissions assigned to the second user is generated through an authorization service running on the second computer system.
4. The computer-implemented method of claim 1 , wherein the request for information about permissions assigned to the second user includes a user identifier, the method further comprising:
determining, by the first computer system, that the user identifier included in the request is associated with the permission set assigned to the second user.
5. The computer-implemented method of claim 1 , wherein the external data entity is a container object for a plurality of data records that are individually accessible.
6. The computer-implemented method of claim 5 , wherein the proxy entity includes metadata describing the plurality of data records.
7. The computer-implemented method of claim 1 , further comprising:
executing, by the first computer system, a software application through which the external data entity is accessed by the computing device of the second user under an appearance of having been provided by the first computer system.
8. A computer system comprising:
one or more processors; and
memory storing instructions that, when executed, cause the one or more processors to:
receive user input from a computing device of a first user, the user input indicating that a second user has permission to access a proxy entity maintained by the computer system, wherein the proxy entity represents an external data entity maintained by a second computer system, wherein the external data entity is stored in a database accessible to the second computer system but inaccessible to the computer system;
assign a permission set to the second user based on the user input;
determine, using the permission set, an access permission relative to the external data entity, wherein to determine the access permission relative to the external data entity, the one or more processors are configured to look up a first stored mapping in response to a request for information about permissions assigned to the second user, the first stored mapping linking an identifier of the proxy entity to an identifier of the external data entity, the first stored mapping being one of a plurality of stored mappings periodically updated in response to synchronization of the computer system and the second computer system to link identifiers of proxy entities to corresponding identifiers of external data entities; and
communicate the access permission relative to the external data entity to the second computer system, wherein the access permission relative to the external data entity is processed by the second computer system to generate an authorization token controlling access to the external data entity by a computing device of the second user, the authorization token configurable to have:
a first state indicating permission to access the external data entity, and
a second state not indicating permission to access the external data entity in response to detecting that the external data entity has been deleted without updating or deleting the first stored mapping.
9. The computer system of claim 8 , wherein the request for information about permissions assigned to the second user is generated through an authorization service running on the second computer system.
10. The computer system of claim 8 , wherein the request for information about permissions assigned to the second user includes a user identifier, and wherein the one or more processors are configured to determine that the user identifier included in the request is associated with the permission set assigned to the second user.
11. The computer system of claim 8 , wherein the external data entity is a container object for a plurality of data records that are individually accessible.
12. The computer system of claim 11 , wherein the proxy entity includes metadata describing the plurality of data records.
13. The computer system of claim 8 , wherein the one or more processors are configured to execute a software application through which the external data entity is accessed by the computing device of the second user under an appearance of having been provided by the computer system.
14. A non-transitory computer-readable medium storing program code, the program code including instructions executable by one or more processors of a computer system to:
receive user input from a computing device of a first user, the user input indicating that a second user has permission to access a proxy entity maintained by the computer system, wherein the proxy entity represents an external data entity maintained by a second computer system, wherein the external data entity is stored in a database accessible to the second computer system but inaccessible to the computer system;
assign a permission set to the second user based on the user input;
determine, using the permission set, an access permission relative to the external data entity, wherein the determining of the access permission relative to the external data entity comprises looking up a first stored mapping in response to a request for information about permissions assigned to the second user, the first stored mapping linking an identifier of the proxy entity to an identifier of the external data entity, the first stored mapping being one of a plurality of stored mappings periodically updated in response to synchronization of the computer system and the second computer system to link identifiers of proxy entities to corresponding identifiers of external data entities; and
communicate the access permission relative to the external data entity to the second computer system, wherein the access permission relative to the external data entity is processed by the second computer system to generate an authorization token controlling access to the external data entity by a computing device of the second user, the authorization token configurable to have:
a first state indicating permission to access the external data entity, and
a second state not indicating permission to access the external data entity in response to detecting that the external data entity has been deleted without updating or deleting the first stored mapping.
15. The non-transitory computer-readable medium of claim 14 , wherein the identifier of the proxy entity is assigned by the computer system, and wherein the identifier of the external data entity is assigned by the second computer system.
16. The non-transitory computer-readable medium of claim 14 , wherein the request for information about permissions assigned to the second user is generated through an authorization service running on the second computer system.
17. The non-transitory computer-readable medium of claim 14 , wherein the request for information about permissions assigned to the second user includes a user identifier, wherein the program code includes further instructions executable by one or more processors of the computer system to:
determine that the user identifier included in the request is associated with the permission set assigned to the second user.
18. The non-transitory computer-readable medium of claim 14 , wherein the external data entity is a container object for a plurality of data records that are individually accessible.
19. The non-transitory computer-readable medium of claim 18 , wherein the proxy entity includes metadata describing the plurality of data records.
20. The non-transitory computer-readable medium of claim 14 , wherein the program code includes further instructions executable by one or more processors of the computer system to:
execute a software application through which the external data entity is accessed by the computing device of the second user under an appearance of having been provided by the computer system.