Systems and methods for role-based permission integration
A content server can extend enterprise content management to a leading system in an efficient, automated, and seamless manner by leveraging the permission information provided by the leading system. The content server can sync the permission information with the leading system, evaluate user-manager relations, role-based rule definitions, and user-group associations defined in the leading system, and determine and/or update role memberships for employee workspaces created in the content server for employees in the leading systems. In this way, even though the content server and the leading system have very different types of roles and permission models, the content server can evaluate complex relationships and role-based rules and intelligently, correctly, and quickly assign the right people to the right roles in the right employee workspaces in the content server.
1. A method, comprising:
syncing, by a content server, permission information with a leading system communicatively connected to the content server;
receiving, by the content server from the leading system, the permission information including:
user-manager relations defined in the leading system;
role-based rule definitions defined in the leading system; and
user-group associations associating users of the leading system with a granted group, a target group, or a combination thereof;
evaluating, by the content server, the user-manager relations, the role-based rule definitions, and the user-group associations;
identifying, by the content server based at least on the user-manager relations, a manager or administrator of an employee in the leading system; and
automatically assigning the manager or administrator as a member of a manager or administrator role in an employee workspace of the employee in the content server.
2. The method according to claim 1 , wherein the syncing comprises making a call over an open data protocol to the leading system through an application programming interface provided by the leading system.
3. The method according to claim 1 , wherein the permission information is contained in a JavaScript Object Notation response from the leading system.
4. The method according to claim 1 , further comprising:
persisting the permission information in a content server database.
5. The method according to claim 1 , further comprising:
requesting, by the content server, the leading system to provide a list of any employees whose user-manager relations have changed in the leading system; and
initiating, by the content server, a process flow comprising the synching, the receiving, the evaluating, the identifying, and the automatically assigning such that role memberships for employee workspaces of the employees whose user-manager relations have changed in the leading system are automatically updated in the content server.
6. The method according to claim 1 , further comprising:
requesting, by the content server, the leading system to provide a list of new employees added to the leading system; and
initiating, by the content server, a process flow comprising the synching, the receiving, the evaluating, the identifying, and the automatically assigning such that role memberships for employee workspaces of the new employees in the content server are automatically allocated.
7. The method according to claim 1 , wherein users in the granted group in the leading system have permissions to access employee data of users in the target group through a leading system role and wherein members of the manager or administrator role have permissions to access documents per document type configured in the employee workspace in the content server.
8. An enterprise content management system comprising:
a processor;
a non-transitory computer-readable medium; and
stored instructions translatable by the processor to perform:
syncing permission information with a leading system communicatively connected to the enterprise content management system;
receiving, from the leading system, the permission information including:
user-manager relations defined in the leading system;
role-based rule definitions defined in the leading system; and
user-group associations associating users of the leading system with a granted group, a target group, or a combination thereof;
evaluating the user-manager relations, the role-based rule definitions, and the user-group associations;
identifying, based at least on the user-manager relations, a manager or administrator of an employee in the leading system; and
automatically assigning the manager or administrator as a member of a manager or administrator role in an employee workspace of the employee in the enterprise content management system.
9. The enterprise content management system of claim 8 , wherein the syncing comprises making a call over an open data protocol to the leading system through an application programming interface provided by the leading system.
10. The enterprise content management system of claim 8 , wherein the permission information is contained in a JavaScript Object Notation response from the leading system.
11. The enterprise content management system of claim 8 , wherein the stored instructions are further translatable by the processor to perform:
persisting the permission information in a content server database.
12. The enterprise content management system of claim 8 , wherein the stored instructions are further translatable by the processor to perform:
requesting the leading system to provide a list of any employees whose user-manager relations have changed in the leading system; and
initiating a process flow comprising the synching, the receiving, the evaluating, the identifying, and the automatically assigning such that role memberships for employee workspaces of the employees whose user-manager relations have changed in the leading system are automatically updated in the enterprise content management system.
13. The enterprise content management system of claim 8 , wherein the stored instructions are further translatable by the processor to perform:
requesting the leading system to provide a list of new employees added to the leading system; and
initiating a process flow comprising the synching, the receiving, the evaluating, the identifying, and the automatically assigning such that role memberships for employee workspaces of the new employees in the enterprise content management system are automatically allocated.
14. The enterprise content management system of claim 8 , wherein users in the granted group in the leading system have permissions to access employee data of users in the target group through a leading system role and wherein members of the manager or administrator role have permissions to access documents per document type configured in the employee workspace in the enterprise content management system.
15. A computer program product comprising a non-transitory computer readable medium storing instructions translatable by a content server to perform:
syncing permission information with a leading system communicatively connected to the content server;
receiving, from the leading system, the permission information including:
user-manager relations defined in the leading system;
role-based rule definitions defined in the leading system; and
user-group associations associating users of the leading system with a granted group, a target group, or a combination thereof;
evaluating the user-manager relations, the role-based rule definitions, and the user-group associations;
identifying, based at least on the user-manager relations, a manager or administrator of an employee in the leading system; and
automatically assigning the manager or administrator as a member of a manager or administrator role in an employee workspace of the employee in the content serer.
16. The computer program product of claim 15 , wherein the syncing comprises making a call over an open data protocol to the leading system through an application programming interface provided by the leading system.
17. The computer program product of claim 15 , wherein the permission information is contained in a JavaScript Object Notation response from the leading system.
18. The computer program product of claim 15 , wherein the instructions are further translatable by the content server to perform:
requesting the leading system to provide a list of any employees whose user-manager relations have changed in the leading system; and
initiating a process flow comprising the synching, the receiving, the evaluating, the identifying, and the automatically assigning such that role memberships for employee workspaces of the employees whose user-manager relations have changed in the leading system are automatically updated in the content server.
19. The computer program product of claim 15 , wherein the instructions are further translatable by the content server to perform:
requesting the leading system to provide a list of new employees added to the leading system; and
initiating a process flow comprising the synching, the receiving, the evaluating, the identifying, and the automatically assigning such that role memberships for employee workspaces of the new employees in the content server are automatically allocated.
20. The computer program product of claim 15 , wherein users in the granted group in the leading system have permissions to access employee data of users in the target group through a leading system role and wherein members of the manager or administrator role have permissions to access documents per document type configured in the employee workspace in the content server.