Synchronizing security groups
Documents maintained by a first storage system that supports security groups are synchronized to a second storage system that supports group entities, which are incompatible with security groups. Permissions associated with the synchronized documents, including security groups, can be synchronized from the first storage system to the second storage system when a security group is created, when membership in a security group is modified, and when a security group is deleted. Synchronization of security groups in this manner can also be selectively enabled on a per-site basis or at another level of granularity.
1. A computer-implemented method, comprising:
determining that a first security group has been created at a first storage system to provide permissible access to one or more documents stored at the first storage system, the first security group supporting a first format to identify one or more users;
responsive to determining that the first security group has been created at the first storage system:
causing a second storage system to create a second security group to provide permissible access to the one or more documents and to assign an identifier to the second security group, wherein:
the second security group supports a second format to identify the one or more users; and
the second security group does not support the first format supported by the first security group created at the first storage system;
storing the identifier in association with the one or more documents stored at the first storage system; and
synchronizing the one or more documents from the first storage system to the second storage system by transmitting the identifier and the one or more documents from the first storage system to the second storage system, whereby the second storage system utilizes the identifier to associate the one or more documents with the second security group;
determining that the first security group has been deleted;
responsive to determining that the first security group has been deleted:
deleting the identifier stored in association with the one or more documents from the first storage system;
causing the second storage system to delete the second security group; and
resynchronizing the one or more documents from the first storage system to the second storage system.
2. The computer-implemented method of claim 1 , further comprising:
determining that membership in the first security group has been updated; and
responsive to determining that membership in the first security group has been updated, causing the second storage system to update the membership of the second security group such that membership in the first security group is the same as membership in the second security group.
3. The computer-implemented method of claim 1 , further comprising:
defining a property for a tenant of the first storage system, the property specifying one or more sites for which synchronization of security groups is to be performed;
periodically identifying additional sites associated with the tenant for which synchronization of the security groups is to be performed;
adding the additional sites to the property; and
for each site identified by the property:
synchronizing one or more security groups associated with the site from the first storage system to the second storage system, and
synchronizing documents associated with the site from the first storage system to the second storage system.
4. The computer-implemented method of claim 3 , wherein the additional sites associated with the tenant for which synchronization of the security groups is to be performed are identified based, at least in part, on a number of documents associated with the additional sites.
5. The computer-implemented method of claim 1 , wherein the first storage system comprises a content service.
6. The computer-implemented method of claim 1 , wherein the second storage system comprises an indexing service.
7. A computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by a computing device, cause the computing device to:
determine that a first security group has been created at a first storage system to provide permissible access to one or more documents stored at the first storage system, the first security group supporting a first format to identify one or more users;
responsive to determining that the first security group has been created at the first storage system:
cause a second storage system to create a second security group to provide permissible access to the one or more documents and to assign an identifier to the second security group, wherein:
the second security group supports a second format to identify the one or more users; and
the second security group does not support the first format supported by the first security group created at the first storage system;
store the identifier in association with the one or more documents stored at the first storage system; and
synchronize the one or more documents from the first storage system to the second storage system by transmitting the identifier and the one or more documents from the first storage system to the second storage system, whereby the second storage system utilizes the identifier to associate the one or more documents with the second security group;
determine that the first security group has been deleted;
responsive to determining that the first security group has been deleted:
delete the identifier stored in association with the one or more documents from the first storage system;
cause the second storage system to delete the second security group; and
resynchronize the one or more documents from the first storage system to the second storage system.
8. The computer-readable storage medium of claim 7 , having further computer-executable instructions stored thereupon which, when executed by the computing device, cause the computing device to:
determine that membership in the first security group has been updated; and
responsive to determining that membership in the first security group has been updated, cause the second storage system to update the membership of the second security group such that membership in the first security group is the same as membership in the second security group.
9. The computer-readable storage medium of claim 7 , having further computer-executable instructions stored thereupon which, when executed by the computing device, cause the computing device to:
define a property for a tenant of the first storage system, the property specifying one or more sites for which synchronization of security groups is to be performed;
periodically identify additional sites associated with the tenant for which synchronization of the security groups is to be performed;
add the additional sites to the property; and
for each site identified by the property:
synchronize one or more security groups associated with the site from the first storage system to the second storage system, and
synchronize documents associated with the site from the first storage system to the second storage system.
10. The computer-readable storage medium of claim 9 , wherein the additional sites associated with the tenant for which synchronization of the security groups is to be performed are identified based, at least in part, on a number of documents associated with the additional sites.
11. The computer-readable storage medium of claim 7 , wherein the first storage system comprises a content service.
12. The computer-readable storage medium of claim 7 , wherein the second storage system comprises an indexing service.
13. A computing device, comprising:
at least one processor; and
a computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by the at least one processor, cause the computing device to:
determine that a first security group has been created at a first storage system to provide permissible access to one or more documents stored at the first storage system, the first security group supporting a first format to identify one or more users;
responsive to determining that the first security group has been created at the first storage system:
cause a second storage system to create a second security group to provide permissible access to the one or more documents and to assign an identifier to the second security group, wherein:
the second security group supports a second format to identify the one or more users; and
the second security group does not support the first format supported by the first security group created at the first storage system;
store the identifier in association with the one or more documents stored at the first storage system; and
synchronize the one or more documents from the first storage system to the second storage system by transmitting the identifier and the one or more documents from the first storage system to the second storage system, whereby the second storage system utilizes the identifier to associate the one or more documents with the second security group;
determine that the first security group has been deleted;
responsive to determining that the first security group has been deleted:
delete the identifier stored in association with the one or more documents from the first storage system;
cause the second storage system to delete the second security group; and
resynchronize the one or more documents from the first storage system to the second storage system.
14. The computing device of claim 13 , wherein the computer-readable storage medium has further computer-executable instructions stored thereupon which, when executed by the computing device, cause the computing device to:
determine that membership in the first security group has been updated; and
responsive to determining that membership in the first security group has been updated, cause the second storage system to update the membership of the second security group such that membership in the first security group is the same as membership in the second security group.
15. The computing device of claim 13 , wherein the computer-readable storage medium has further computer-executable instructions stored thereupon which, when executed by the computing device, cause the computing device to:
define a property for a tenant of the first storage system, the property specifying one or more sites for which synchronization of security groups is to be performed;
periodically identify additional sites associated with the tenant for which synchronization of the security groups is to be performed;
add the additional sites to the property; and
for each site identified by the property:
synchronize one or more security groups associated with the site from the first storage system to the second storage system, and
synchronize documents associated with the site from the first storage system to the second storage system.
16. The computing device of claim 15 , wherein the additional sites associated with the tenant for which synchronization of the security groups is to be performed are identified based, at least in part, on a number of documents associated with the additional sites.
17. The computing device of claim 13 , wherein the first storage system comprises a content service and wherein the second storage system comprises an indexing service.