Framework for pushing access-privilege information from data environments
The technology disclosed herein enables pushing of access-privilege information from data environments to a graphing service. In a particular embodiment, a method includes registering a data environment to enable the data environment to use Application Programming Interface (API) calls and receiving an API call transmitted from the data environment. The API call provides information about access permissions for the data environment. The method further includes incorporating the information into a privilege graph representing data access authorizations.
1. A method comprising:
in a graphing service:
registering a data environment with the graphing service to enable the data environment to use Application Programming Interface (API) calls of the graphing service;
registering a data source of the data environment with the graphing service;
receiving an API call transmitted from the data environment, wherein the API call provides, to the graphing service, information about access permissions for the data environment and includes a first identifier for the data source and a second identifier for the data environment; and
incorporating the information into a privilege graph representing data access authorizations.
2. The method of claim 1 , wherein the information comprises an incremental update of the access permissions since a previous instance of the API call was received from the data environment.
3. The method of claim 1 , wherein the data environment transmitted the API call after a time has elapsed since a previous instance of the API call was transmitted.
4. The method of claim 1 , wherein the data environment transmitted the API call in response to a change in the access permissions.
5. The method of claim 1 , comprising:
providing a token to the data environment, wherein the token is included with the API call to authenticate the data environment to the graphing service.
6. The method of claim 1 , comprising:
binding the data environment to a type of data environment, wherein the type corresponds to a template to which the information conforms.
7. The method of claim 1 , wherein incorporating the information into the privilege graph comprises:
forming a subgraph of the information; and
combining the subgraph into the privilege graph.
8. The method of claim 7 , comprising:
before combining the subgraph into the privilege graph, translating the subgraph into a canonical schema used by the privilege graph.
9. An apparatus implementing a graphing service, the apparatus comprising:
one or more computer readable storage media;
a processing system operatively coupled with the one or more computer readable storage media; and
program instructions stored on the one or more computer readable storage media that, when read and executed by the processing system, direct the apparatus to:
register a data environment with the graphing service to enable the data environment to use Application Programming Interface (API) calls of the graphing service;
register a data source of the data environment with the graphing service;
receive an API call transmitted from the data environment, wherein the API call provides, to the graphing service, information about access permissions for the data environment and includes a first identifier for the data source and a second identifier for the data environment; and
incorporate the information into a privilege graph representing data access authorizations.
10. The apparatus of claim 9 , wherein the information comprises an incremental update of the access permissions since a previous instance of the API call was received from the data environment.
11. The apparatus of claim 9 , wherein the data environment transmitted the API call after a time has elapsed since a previous instance of the API call was transmitted.
12. The apparatus of claim 9 , wherein the data environment transmitted the API call in response to a change in the access permissions.
13. The apparatus of claim 9 , wherein the program instructions direct the processing system to:
provide a token to the data environment, wherein the token is included with the API call to authenticate the data environment to the graphing service.
14. The apparatus of claim 9 , wherein the program instructions direct the processing system to:
bind the data environment to a type of data environment, wherein the type corresponds to a template to which the information conforms.
15. The apparatus of claim 9 , wherein to incorporate the information into the privilege graph, the program instructions direct the processing system to:
form a subgraph of the information; and
combine the subgraph into the privilege graph.
16. The apparatus of claim 15 , wherein the program instructions direct the processing system to:
before combining the subgraph into the privilege graph, translate the subgraph into a canonical schema used by the privilege graph.
17. One or more non-transitory computer readable storage media having program instructions stored thereon for implementing a graphing service, the program instructions, when read and executed by a processing system, direct the processing system to:
register a data environment with the graphing service to enable the data environment to use Application Programming Interface (API) calls of the graphing service;
register a data source of the data environment with the graphing service;
receive an API call transmitted from the data environment, wherein the API call provides, to the graphing service, information about access permissions for the data environment and includes a first identifier for the data source and a second identifier for the data environment; and
incorporate the information into a privilege graph representing data access authorizations.
18. The one or more computer readable storage media of claim 17 , wherein the information comprises an incremental update of the access permissions since a previous instance of the API call was received from the data environment.