Scenario-based access control
Methods, systems, and computer programs are presented for managing access to resources using scenarios. One method includes an operation for storing first scenario data received for a first control scenario. The first scenario data comprises a control scenario identifier, a first resource, an authorization control, and a scenario trigger that defines an event that causes an activation of the first control scenario for providing access to the first resource. Further, the method includes operations for monitoring for an occurrence of the scenario trigger and detecting an occurrence of the event associated with the scenario trigger. Further, the method determines, in response to the occurrence of the event, a set of users authorized to access the first resource, including accessing the first scenario data to determine the set of users associated with the authorization control. Furthermore, access is provided to the set of users based on the determining.
1. A computer-implemented method comprising:
storing, in a computer memory, first scenario data received for a first control scenario, the first scenario data comprising a control scenario identifier, a first resource, an authorization control, and a scenario trigger that defines an event that causes an activation of the first control scenario for providing access to the first resource;
monitoring for an occurrence of the scenario trigger;
detecting an occurrence of the event associated with the scenario trigger of the first control scenario;
determining, in response to the occurrence of the event, a set of users authorized to access the first resource, wherein determining the set of users includes accessing the stored first scenario data to determine the set of users associated with the authorization control; and
providing access to the set of users based on the determining;
and wherein the method further comprises providing a user interface for finding available control scenarios for a user, the user interface including an entry field for entering search query text to search by at least control scenario name, and wherein the user interface comprises a window presenting results.
2. The method as recited in claim 1 , wherein monitoring for an occurrence of the scenario trigger comprises detecting one or more of: a catastrophic event, a social disturbance, a request for access to the resource from a user, a system outage, a new member added to a group associated with the first control scenario, a member leaving the group associated with the first control scenario, or a security breach.
3. The method as recited in claim 1 , further comprising:
providing a requester user interface to a first user from the set of users authorized to access the first resource, the requester user interface including control scenarios visible to the first user, the control scenarios including the first control scenario, the requester user interface including an option for requesting access to the first resource of the first control scenario.
4. The method as recited in claim 1 , further comprising:
providing a scenario user interface (UI) for creating the control scenario that controls access to the resource, wherein the scenario UI for creating the control scenario includes options for inputting one or more of the control scenario identifier, the first resource, the authorization control, the scenario trigger, and criteria for visibility of the control scenario to users.
5. The method as recited in claim 4 , further comprising:
displaying the first control scenario at the scenario UI to the set of users authorized to access the first resource.
6. The method as recited in claim 4 , wherein the first scenario data further comprises a definition of a scenario set of users eligible for requesting access to the first resource in the first control scenario, wherein the first control scenario is made visible to the scenario set of users via the scenario UI.
7. The method as recited in claim 1 , wherein the authorization control is a mechanism which automatically provides access to the set of users authorized to access the first resource when the occurrence of the event associated with the scenario trigger is detected.
8. The method as recited in claim 1 , wherein the authorization control comprises a mechanism which creates an authorization request for review by an administrator of the first control scenario when the occurrence of the event associated with the scenario trigger is detected.
9. The method as recited in claim 1 , wherein the first scenario data further comprises an expiration date for the first control scenario.
10. The method as recited in claim 1 , wherein the first resource is one or more of a door lock, data stored on a memory, a program, a web page, and an application programming interface.
11. The method as recited in claim 1 , wherein the first resource is a resource managed by an active directory, wherein providing access to the set of users based on the determining comprises:
submitting a request to the active directory to enable access to the first resource by the set of users authorized to access the first resource.
12. The method as recited in claim 1 , further including:
providing an attesting user interface (UI) for attesting that requirements, for accessing assets controlled by the control scenario, are met by a requesting user.
13. The method as recited in claim 1 , further including detecting a scenario access request associated with a user, checking if the associated user is one of the users currently approved for access to the first resource under the control scenario, if the associated user is currently approved, checking to determine the scenario access requires renewal and if the scenario access requires renewal, checking to determine if a scenario owner approves the access request.
14. A system for performing scenario based access control comprising:
a processor; and
a memory device coupled to the processor and having a program stored thereon, which when executed by the processor cause the processor to perform operations comprising:
storing, in a computer memory, first scenario data received for a first control scenario, the first scenario data comprising a control scenario identifier, a first resource, an authorization control, and a scenario trigger that defines an event that causes an activation of the first control scenario for providing access to the first resource;
monitoring for an occurrence of the scenario trigger;
detecting an occurrence of the event associated with the scenario trigger of the first control scenario;
determining, in response to the occurrence of the event, a set of users authorized to access the first resource, wherein determining the set of users includes accessing the stored first scenario data to determine the set of users associated with the authorization control; and
providing access to the set of users based on the determining;
and wherein the method further comprises providing a user interface for finding available control scenarios for a user, the user interface including an entry field for entering search query text to search by at least control scenario name, and wherein the user interface comprises a window presenting results.
15. At least one machine-readable media including instructions that, when executed by a machine, cause the machine to perform:
storing, in a computer memory, first scenario data received for a first control scenario, the first scenario data comprising a control scenario identifier, a first resource, an authorization control, and a scenario trigger that defines an event that causes an activation of the first control scenario for providing access to the first resource;
monitoring for an occurrence of the scenario trigger;
detecting an occurrence of the event associated with the scenario trigger of the first control scenario;
determining, in response to the occurrence of the event, a set of users authorized to access the first resource, wherein determining the set of users includes accessing the stored first scenario data to determine the set of users associated with the authorization control; and
providing access to the set of users based on the determining;
and wherein the method further comprises providing a user interface for finding available control scenarios for a user, the user interface including an entry field for entering search query text to search by at least control scenario name, and wherein the user interface comprises a window presenting results.