Security systems, methods, and computer program products for information integration platform
An information integration system may include a set of integration services embodied on one or more server machines in a computing environment. The set of integration services may include connectors communicatively connected to disparate information systems. The connectors may be configured for integrating data stored in the disparate information systems utilizing a common model employed by the set of integration services. The common model may overlay, augment, integrate, or otherwise utilize a content management interoperability services data model and may include common property definitions and a common security model. The common security model may include permissions particularly defined for use by the set of integration services. These common property definitions and permissions may be uniquely defined and utilized by the information integration system.
1. A method, comprising:
responsive to a search request from a device of a user, performing, by a computer, an inbound check on the search request, the inbound check comprising:
determining, utilizing a principals service, what principal is associated with the user across disparate information systems operating in a computing environment;
determining, utilizing a unified index, what content in the disparate information systems the user is allowed to access per association between the user and the principal and based on any respective permission indexed to the principal, the unified index storing permissions indexed from the disparate information systems; and
modifying the search request based on what the user is allowed to access as thus determined, the modifying comprising:
adding a filter to the search request; and
producing an augmented search request;
communicating, by the computer, the augmented search request to the disparate information systems, wherein each of the disparate information systems processes the augmented search request and returns a search result;
performing, by the computer, an outbound check on search results returned from the disparate information systems, the outbound check comprising:
filtering, utilizing an authorization service, the search results returned from the disparate information systems based on what the user is authorized to view, the filtering producing filtered search results; and
providing, by the computer, the filtered search results to the user for presentation on the device.
2. The method according to claim 1 , wherein the inbound check and the outbound check are defined in a security model.
3. The method according to claim 2 , wherein the security model is part of a common model, wherein the common model comprises common model permissions, and wherein the determining what content in the disparate information systems the user is allowed to access further comprises mapping the common model permissions with repository-specific permissions from the disparate information systems.
4. The method according to claim 3 , wherein the common model is employed by integration services that are communicatively connected to the disparate information systems.
5. The method according to claim 1 , wherein the principals service returns a state for each of the disparate information systems and wherein the inbound check further comprises:
determining, based on the state for each of the disparate information systems, whether any of the disparate information systems supports the inbound check.
6. The method according to claim 5 , wherein the filter added to the search request excludes any of the disparate information systems that does not support the inbound check.
7. The method according to claim 1 , wherein the filtering utilizes an authorization post filter based on authorization information provided by the authorization service.
8. A system, comprising:
a processor;
a non-transitory computer-readable medium; and
instructions stored on the non-transitory computer-readable medium and translatable by the processor for:
responsive to a search request from a device of a user, performing an inbound check on the search request, the inbound check comprising:
determining, utilizing a principals service, what principal is associated with the user across disparate information systems operating in a computing environment;
determining, utilizing a unified index, what content in the disparate information systems the user is allowed to access per association between the user and the principal and based on any respective permission indexed to the principal, the unified index storing permissions indexed from the disparate information systems; and
modifying the search request based on what the user is allowed to access as thus determined, the modifying comprising:
adding a filter to the search request; and
producing an augmented search request;
communicating the augmented search request to the disparate information systems, wherein each of the disparate information systems processes the augmented search request and returns a search result;
performing an outbound check on search results returned from the disparate information systems, the outbound check comprising:
filtering, utilizing an authorization service, the search results returned from the disparate information systems based on what the user is authorized to view, the filtering producing filtered search results; and
providing the filtered search results to the user for presentation on the device.
9. The system of claim 8 , wherein the inbound check and the outbound check are defined in a security model.
10. The system of claim 9 , wherein the security model is part of a common model, wherein the common model comprises common model permissions, and wherein the determining what content in the disparate information systems the user is allowed to access further comprises mapping the common model permissions with repository-specific permissions from the disparate information systems.
11. The system of claim 10 , wherein the common model is employed by integration services that are communicatively connected to the disparate information systems.
12. The system of claim 8 , wherein the principals service returns a state for each of the disparate information systems and wherein the inbound check further comprises:
determining, based on the state for each of the disparate information systems, whether any of the disparate information systems supports the inbound check.
13. The system of claim 12 , wherein the filter added to the search request excludes any of the disparate information systems that does not support the inbound check.
14. The system of claim 8 , wherein the filtering utilizes an authorization post filter based on authorization information provided by the authorization service.
15. A computer program product comprising a non-transitory computer-readable medium storing instructions translatable by a processor for:
responsive to a search request from a device of a user, performing an inbound check on the search request, the inbound check comprising:
determining, utilizing a principals service, what principal is associated with the user across disparate information systems operating in a computing environment;
determining, utilizing a unified index, what content in the disparate information systems the user is allowed to access per association between the user and the principal and based on any respective permission indexed to the principal, the unified index storing permissions indexed from the disparate information systems; and
modifying the search request based on what the user is allowed to access as thus determined, the modifying comprising:
adding a filter to the search request; and
producing an augmented search request;
communicating the augmented search request to the disparate information systems, wherein each of the disparate information systems processes the augmented search request and returns a search result;
performing an outbound check on search results returned from the disparate information systems, the outbound check comprising:
filtering, utilizing an authorization service, the search results returned from the disparate information systems based on what the user is authorized to view, the filtering producing filtered search results; and
providing the filtered search results to the user for presentation on the device.
16. The computer program product of claim 15 , wherein the inbound check and the outbound check are defined in a security model.
17. The computer program product of claim 16 , wherein the security model is part of a common model, wherein the common model comprises common model permissions, and wherein the determining what content in the disparate information systems the user is allowed to access further comprises mapping the common model permissions with repository-specific permissions from the disparate information systems.
18. The computer program product of claim 17 , wherein the common model is employed by integration services that are communicatively connected to the disparate information systems.
19. The computer program product of claim 15 , wherein the principals service returns a state for each of the disparate information systems and wherein the inbound check further comprises:
determining, based on the state for each of the disparate information systems, whether any of the disparate information systems supports the inbound check.
20. The computer program product of claim 19 , wherein the filter added to the search request excludes any of the disparate information systems that does not support the inbound check.