Role-based security policy for an object-oriented database system

1. A system for adding security data to a search index, comprising:

a processor configured to:

add an entry for a data object of an object-oriented database to the search index, wherein the data object is one of a plurality of data objects;

add field data to a search index entry for the data object, wherein the field data comprises attribute data and relation data associated with the data object;

add security entity data to the search index entry for the data object, wherein the security entity data comprises a reference to a first security entity, wherein the first security entity is one of a plurality of security entities related in a security entity hierarchy, wherein the first security entity has a relation with second security entities, wherein the security entity hierarchy includes the first security entity and the second security entities, wherein the security entity hierarchy corresponds to a security object tree, wherein the first security entity and the second security entities each comprises a permissible operation, wherein the second security entities are subordinate to the first security entity, wherein the data object is associated with the first security entity and is associated with a second security entity, wherein the first security entity is associated with a first set of attributes, wherein the second security entity is associated with a second set of attributes, wherein the first set of attributes is different from the second set of attributes, wherein the second security entities are included in the plurality of security entities, wherein the object-oriented database comprises the plurality of data objects and the plurality of security entities, and wherein the adding of the security entity data to the search index entry for the data object comprises to:

in response to a determination that the permissible operation for the security entity data comprises a read operation, an access operation, a view operation, or any combination thereof:

traverse the security entity hierarchy downwards from the first security entity to all of the second security entities, the second security entities being children of the first security entity; and

add all of the second security entities to the search index entry for the data object, wherein the first security entity inherits the access of all of the second security entities;

determine whether a user has access to the data object, comprising to:

determine whether the user is associated with more than one security entity; and

in response to a determination that the user is associated with the more than one security entity, create another search index for another attribute, another relation, or both, wherein the user has access to a first set of data associated with the data object, and wherein the user does not have access to a second set of data associated with the data object; and

in response to a determination that the user has access to the data object, allowing access to field values associated with the data object based on accessible fields of the data object; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. A system as in claim 1 , wherein the entry is one of a plurality of entries.

3. A method for adding security data to a search index, comprising:

adding, using a processor, an entry for a data object of an object-oriented database to the search index, wherein the data object is one of a plurality of data objects;

adding field data to a search index entry for the data object, wherein the field data comprises attribute data and relation data associated with the data object;

adding security entity data to the search index entry for the data object, wherein the security entity data comprises a reference to a first security entity, wherein the first security entity is one of a plurality of security entities related in a security entity hierarchy, wherein the first security entity has a relation with second security entities, wherein the security entity hierarchy includes the first security entity and the second security entities, wherein the security entity hierarchy corresponds to a security object tree, wherein the first security entity and the second security entities each comprises a permissible operation, wherein the second security entities are subordinate to the first security entity, wherein the data object is associated with the first security entity and is associated with a second security entity, wherein the first security entity is associated with a first set of attributes, wherein the second security entity is associated with a second set of attributes, wherein the first set of attributes is different from the second set of attributes, wherein the second security entities are included in the plurality of security entities, wherein the object-oriented database comprises the plurality of data objects and the plurality of security entities, and wherein the adding of the security entity data to the search index entry for the data object comprises:

in response to a determination that the permissible operation for the security entity data comprises a read operation, an access operation, a view operation, or any combination thereof:

traversing the security entity hierarchy downwards from the first security entity to all of the second security entities, the second security entities being children of the first security entity; and

adding all of the second security entities to the search index entry for the data object, wherein the first security entity inherits the access of all of the second security entities;

determining whether a user has access to the data object, comprising:

determining whether the user is associated with more than one security entity; and

in response to a determination that the user is associated with the more than one security entity, creating another search index for another attribute, another relation, or both, wherein the user has access to a first set of data associated with the data object, and wherein the user does not have access to a second set of data associated with the data object; and

in response to a determination that the user has access to the data object, allowing access to field values associated with the data object based on accessible fields of the data object.

4. A non-transitory computer readable storage medium for adding security data to a search index and comprising computer instructions for:

adding, using a processor, an entry for a data object of an object-oriented database to the search index, wherein the data object is one of a plurality of data objects;

adding field data to a search index entry for the data object, wherein the field data comprises attribute data and relation data associated with the data object;

adding security entity data to the search index entry for the data object, wherein the security entity data comprises a reference to a first security entity, wherein the first security entity is one of a plurality of security entities related in a security entity hierarchy, wherein the first security entity has a relation with second security entities, wherein the security entity hierarchy includes the first security entity and the second security entities, wherein the security entity hierarchy corresponds to a security object tree, wherein the first security entity and the second security entities each comprises a permissible operation, wherein the second security entities are subordinate to the first security entity, wherein the data object is associated with the first security entity and is associated with a second security entity, wherein the first security entity is associated with a first set of attributes, wherein the second security entity is associated with a second set of attributes, wherein the first set of attributes is different from the second set of attributes, wherein the second security entities are included in the plurality of security entities, wherein the object-oriented database comprises the plurality of data objects and the plurality of security entities, and wherein the adding of the security entity data to the search index entry for the data object comprises:

in response to a determination that the permissible operation for the security entity data comprises a read operation, an access operation, a view operation, or any combination thereof:

traversing the security entity hierarchy downwards from the first security entity to all of the second security entities, the second security entities being children of the first security entity; and

adding all of the second security entities to the search index entry for the data object, wherein the first security entity inherits the access of all of the second security entities;

determining whether a user has access to the data object, comprising:

determining whether the user is associated with more than one security entity; and

in response to a determination that the user is associated with the more than one security entity, creating another search index for another attribute, another relation, or both, wherein the user has access to a first set of data associated with the data object, and wherein the user does not have access to a second set of data associated with the data object; and

in response to a determination that the user has access to the data object, allow access to field values associated with the data object based on accessible fields of the data object.

5. A system as in claim 1 , wherein the plurality of data objects are related in a data structure.

6. A system as in claim 1 , wherein the security entity data comprises a first reference to the first security entity and a second reference to the second security entity, wherein the first security entity is associated with a first subset of the field data and the second security entity is associated with a second subset of the field data.