Identifying and consenting to permissions for workflow and code execution
The present invention extends to methods, systems, and computer program products for identifying and consenting to permissions for workflow and code execution. Aspects of the invention can be used to automatically scan a workflow or code definition to identify (potentially all) the actions/triggers a workflow or program intends to perform on behalf of a user. The user is shown the actions/triggers the workflow or program intends to perform (e.g., at a user interface) before consent to perform the actions/triggers is granted. As such, a user is aware of intended actions/triggers of a workflow or program before granting consent. Further, since actions/triggers are identified from the workflow or code definition (and not formulated by an author), permission requests better align with permissions that workflow or program functionality actually uses during execution.
1. A computer system, comprising:
one or more processors;
memory coupled to the one or more processor and storing instructions configured to cause the one or more processor to:
generate a machine code generated permission summary by scanning a workflow definition from which a workflow is to be instantiated to automatically identify one or more of triggers or actions that use a user credential to access a user resource;
receive a user request to instantiate the workflow;
access user consent data indicative of user consent allowing workflow use of the user credential based on an association between the machine code generated permission summary and the user credential;
instantiate the workflow; and
perform a workflow activity defined in the machine code generated permission summary on the user resource using the user credential.
2. The computer system of claim 1 , wherein the instructions configured to cause the processor to instantiate the workflow comprise instructions configured to cause the processor to instantiate the workflow from the workflow definition.
3. The computer system of claim 1 , wherein the machine code generated permission summary indicates the workflow activity's intended use of the user credential.
4. The computer system of claim 3 , wherein the instructions further comprise instructions configured to cause the processor to:
present the workflow activity's intended use of the user credential at a user interface; and
receive user consent to the intended use of the user credential at the user interface.
5. The computer system of claim 4 , wherein the instructions further comprise instructions configured to cause the processor to associate the machine code generated permission summary with the user credential during installation of the workflow based on the received user consent.
6. The computer system of claim 4 , wherein the instructions further comprise instructions configured to cause the processor to cache the user consent data.
7. The computer system of claim 4 , wherein the instructions further comprise instructions configured to cause the processor to:
generate a second machine code generated permission summary from the content of the workflow definition;
determine that the machine code generated permission summary and the second machine code generated permission summary differ; and
evict the user consent from the cache.
8. A method comprising:
generating a machine code generated permission summary by scanning a workflow definition from which a workflow is to be instantiated to automatically identify one or more of triggers or actions that use a user credential to access a user resource;
receiving a user request to instantiate the workflow;
accessing data indicative of user consent allowing workflow use of the user credential based on an association between the machine code generated permission summary and the user credential;
instantiating the workflow; and
performing a workflow activity defined in the machine code generated permission summary on the user resource using the user credential.
9. The method of claim 8 , wherein instantiating the workflow comprises instantiating the workflow from the workflow definition.
10. The method of claim 8 , wherein the machine code generated permission summary indicates the workflow activity's intended use of the user credential.
11. The method of claim 10 , further comprising:
presenting the workflow activity's intended use of the user credential at a user interface; and
receiving user consent to the intended use of the user credential at the user interface.
12. The method of claim 11 , further comprising associating the machine code generated permission summary with the user credential during installation of the workflow based on the received user consent.
13. The method of claim 11 , further comprising caching the user consent data.
14. The method of claim 13 , further comprising:
generating a second machine code generated permission summary from the content of the workflow definition;
determining that the machine code generated permission summary and the second machine code generated permission summary differ; and
evicting the user consent from cache.
15. A computer program product comprising one or more computer storage devices having stored thereon computer-executable instructions that, when executed at one or more processors, cause a computer system to perform operations, comprising:
generating a machine code generated permission summary by scanning a workflow definition from which a workflow is to be instantiated to automatically identify one or more of triggers or actions that use a user credential to access a user resource;
receiving a user request to instantiate the workflow;
accessing user consent data indicative of user consent allowing workflow use of the user credential based on an association between the machine code generated permission summary and the user credential;
instantiating the workflow; and
performing a workflow activity defined in the machine code generated permission summary on the user resource using the user credential.
16. The computer program product of claim 15 , wherein instantiating the workflow comprises instantiating the workflow from the workflow definition.
17. The computer program product of claim 16 , wherein the machine code generated permission summary indicates the workflow activity's intended use of the user credential;
and wherein the operations further comprise:
presenting the workflow activity's intended use of the user credential at a user interface; and
receiving user consent to the intended use of the user credential at the user interface.
18. The computer program product of claim 17 , wherein the operations further comprise:
caching the user consent data.
19. The computer program product of claim 18 , wherein the operations further comprise:
generating a second machine code generated permission summary from the content of the workflow definition;
determining that the machine code generated permission summary and the second machine code generated permission summary differ; and
evicting the user consent from cache.
20. The computer program product of claim 17 , wherein the operations further comprise associating the machine code generated permission summary with the user credential during installation of the workflow based on the received user consent.