Access control in a content management system
Systems and methods for controlling object/document access in a content management system. The content management system may have several layers of access controls, which may include a layer of access control at the object level, a layer of access control at the row level and a layer of access control at the field level. Access may be controlled at the object level by a user's security profile, at the object record level (or row level) by the user's role, and/or at the object field level by the user's role or a state in a document lifecycle. In other words, the object level access control may grant access (e.g., Create, Read, Edit and Delete) on objects, the object record level access control may grant access (e.g., Read, Edit and Delete) on object records, and field level access control may grant access (e.g., Read, Edit and Hidden) on object field level.
1. A method for controlling object or document access in a content management system, wherein the content management system stores a first document and a second document and wherein each of the documents is associated with a set of attributes, the method comprising:
displaying a first user interface;
receiving on the first user interface a first set of access control configuration information for a first user based on a first layer of access control of the content management system, wherein the first set of access control configuration information comprises a first type of access permission;
displaying a second user interface;
receiving on the second user interface a second set of access control configuration information for the first user based on a second layer of access control of the content management system, wherein the second set of access control configuration information comprises a second type of access permission;
receiving a third set of access control configuration information for the first user based on the second layer of access control of the content management system, wherein the third set of access control configuration information overrides the second set of access control configuration information and comprises a third type of access permission; and
determining the first user's right to access based on the first set of access control configuration information and the third set of access control configuration information.
2. The method of claim 1 , wherein the first user's right to access is the more restrictive one of the first set of access control configuration information and the third set of access control configuration information.
3. The method of claim 1 , wherein the first layer of access control is at an object level.
4. The method of claim 1 , wherein the second layer of access control is at an object field level.
5. The method of claim 1 , wherein the second type of access permission is more restrictive than the first type of access permission.
6. The method of claim 1 , wherein the third type of permission is more restrictive than the second type of permission.
7. The method of claim 1 , wherein the third type of permission is less restrictive than the second type of permission.
8. The method of claim 1 , wherein the third set of access control configuration information is based on a user's role.
9. The method of claim 1 , wherein the third set of access control configuration information is based on a state of an object or document in its lifecycle.
10. The method of claim 1 , wherein the second type of access permission comprises: read, edit and hidden.
11. The method of claim 1 , further comprising:
displaying a third user interface;
receiving on the third user interface a fourth set of access control configuration information for the first user based on a third layer of access control of the content management system; and
determining the first user's right to access based on the first set of access control configuration information, the third set of access control configuration information, and the fourth set of access control configuration information.
12. The method of claim 11 , wherein the fourth set of access control configuration information is at a record level.
13. The method of claim 6 , wherein the first user's right to access is the most restrictive one of the first set of access control configuration information, the third set of access control configuration information, and the fourth set of access control configuration information.
14. A system for controlling object or document access in a content management system, wherein the content management system stores a first object and a second object and wherein each of the objects is associated with a set of attributes, the system comprising:
a memory for storing: an operating system and an access controller, wherein the access controller:
displays a first user interface;
receives on the first user interface a first set of access control configuration information for a first user based on a first layer of access control of the content management system, wherein the first set of access control configuration information comprises a first type of access permission;
displays a second user interface;
receives on the second user interface a second set of access control configuration information for the first user based on a second layer of access control of the content management system, wherein the second set of access control configuration information comprises a second type of access permission;
receives a third set of access control configuration information for the first user based on the second layer of access control of the content management system, wherein the third set of access control configuration information overrides the second set of access control configuration information and comprises a third type of access permission; and
determines the first user's right to access based on the first set of access control configuration information and the third set of access control configuration information.
15. The system of claim 14 , wherein the first user's right to access is the more restrictive one of the first set of access control configuration information and the third set of access control configuration information.
16. The system of claim 14 , wherein the second layer of access control is at an object field level.
17. The system of claim 14 , wherein the third type of permission is more restrictive than the second type of permission.
18. The system of claim 14 , wherein the third type of permission is less restrictive than the second type of permission.
19. The system of claim 14 , wherein the third set of access control configuration information is based on a user's role.
20. The system of claim 14 , wherein the third set of access control configuration information is based on a state of an object or document in its lifecycle.