Token-based secure database query result sharing
Techniques for sharing query results in a multi-tenant database system are described. The query results can be shared between users of the same account or organization in the multi-tenant network-based database system using security tokens. A first user executes a query, and the results are stored in the network-based database system. The first user can invoke a function to create a security token to provide access to the stored query results to other users in the same account. The first user can share the security token with the other users, who can directly access the stored results in the network-based database system instead of having to download local copies of the query results.
1 . A method comprising:
receiving, from a first user associated with an account in a multi-tenant database system, a query;
executing, by at least one hardware processor in the multi-tenant database system, the query to generate query results;
storing the query results in at least one storage device in the multi-tenant database system;
generating a security token associated with the stored query results, the security token including a unique string value;
managing lifecycle of the security token separately from lifecycle of the stored query results;
sharing the security token with a second user; and
providing access to the stored query results in the at least one storage device to the second user based on the security token.
2 . The method of claim 1 , further comprising:
receiving, from the second user, a request to access the stored query results, the request including the security token; and
authenticating the second user as belonging to the account in the multi-tenant database system.
3 . The method of claim 1 , wherein metadata associated with the security token is stored in a metadata database separate from the stored query results.
4 . The method of claim 3 , wherein the metadata includes a data persistent object including properties and slices.
5 . The method of claim 1 , further comprising:
tracking access to the stored query results based on usage of the security token to generate tracking information.
6 . The method of claim 5 , further comprising:
generating audit information of access to the stored query results based on the tracking information, wherein the audit information is generated based on slice information stored in metadata associated with the security token.
7 . A non-transitory machine-storage medium embodying instructions that, when executed by a machine, cause the machine to perform actions comprising:
receiving, from a first user associated with an account in a multi-tenant database system, a query;
executing the query to generate query results;
storing the query results in at least one storage device in the multi-tenant database system;
generating a security token associated with the stored query results, the security token including a unique string value;
managing lifecycle of the security token separately from lifecycle of the stored query results;
sharing the security token with a second user; and
providing access to the stored query results in the at least one storage device to the second user based on the security token.
8 . The non-transitory machine-storage medium of claim 7 , further comprising:
receiving, from the second user, a request to access the stored query results, the request including the security token; and
authenticating the second user as belonging to the account in the multi-tenant database system.
9 . The non-transitory machine-storage medium of claim 7 , wherein metadata associated with the security token is stored in a metadata database separate from the stored query results.
10 . The non-transitory machine-storage medium of claim 9 , wherein the metadata includes a data persistent object including properties and slices.
11 . The non-transitory machine-storage medium of claim 7 , further comprising:
tracking access to the stored query results based on usage of the security token to generate tracking information.
12 . The non-transitory machine-storage medium of claim 11 , further comprising:
generating audit information of access to the stored query results based on the tracking information, wherein the audit information is generated based on slice information stored in metadata associated with the security token.
13 . A system comprising:
at least one hardware processor; and
at least one memory storing instructions that, when executed by the at least one hardware processor, cause the at least one hardware processor to perform operations comprising:
receiving, from a first user associated with an account in a multi-tenant database system, a query;
executing the query to generate query results;
storing the query results in at least one storage device in the multi-tenant database system;
generating a security token associated with the stored query results, the security token including a unique string value;
managing lifecycle of the security token separately from lifecycle of the stored query results;
sharing the security token with a second user; and
providing access to the stored query results in the at least one storage device to the second user based on the security token.
14 . The system of claim 13 , the operations further comprising:
receiving, from the second user, a request to access the stored query results, the request including the security token; and
authenticating the second user as belonging to the account in the multi-tenant database system.
15 . The system of claim 13 , wherein metadata associated with the security token is stored in a metadata database separate from the stored query results.
16 . The system of claim 15 , wherein the metadata includes a data persistent object including properties and slices.
17 . The system of claim 13 , the operations further comprising:
tracking access to the stored query results based on usage of the security token to generate tracking information.
18 . The system of claim 17 , the operations further comprising:
generating audit information of access to the stored query results based on the tracking information, wherein the audit information is generated based on slice information stored in metadata associated with the security token.