Privileged access to managed content
Privileged access to managed content is disclosed. In some embodiments, a privileged portion of application code manages user access to managed content at a level of access greater than the user would otherwise be afforded. The privileged code moves a content management session up or down in levels of access as required to allow a user to perform through the application one or more specific actions it is desired to permit the user to do in a particular context (e.g., at a particular time in the lifecycle of an item of content and/or a particular point in a business process or work flow), including to permit the user to perform an action it is not desired to let the user perform in other contexts, such as write a particular value to a content item it is not desired to allow the user to write to otherwise.
1. A method of controlling access to managed content, comprising:
reviewing a privileged code access control list (ACL) entry associated with a privileged portion of application code;
reviewing a user ACL entry associated with a user;
receiving from a privileged portion of application code an indication that a content management session associated with a user is to be promoted from a first level of access associated with the user ACL entry to a second level of access associated with the privileged code ACL entry based at least in part on the user's particular context;
wherein receiving from a privileged portion of application code an indication that a session associated with a user is to be promoted from a first level of access associated with the user ACL entry to a second level of access associated with the privileged portion of application code includes receiving from the privileged code ACL entry an indication that the user is to be considered with respect to the session a member of a dynamic group associated with the privileged portion of code; and
using a processor to allow a request associated with the content management session to perform with respect to a content item an operation that requires the second level of access through an application associated with the privileged portion of application code.
2. The method as recited in claim 1 , wherein the privileged portion of application code is configured to limit the user to performing with respect to the content item via the application one or more prescribed operations requiring the second level of access.
3. The method as recited in claim 1 , wherein the privileged portion of application code is configured to prevent the user from performing with respect to the content item via the application an operation that having the second level of access would otherwise have entitled the user to perform.
4. The method as recited in claim 1 , further comprising:
receiving from the privileged portion of application code an indication that the session is to be demoted from the second level of access to the first level of access; and
denying a subsequent request associated with the session to perform with respect to a content item an operation that requires the second level of access.
5. The method as recited in claim 4 , wherein receiving from the privileged portion of application code an indication that the session is to be demoted from the second level of access to the first level of access includes receiving from the privileged portion of application code an indication that the user is no longer to be considered with respect to the session a member of a dynamic group associated with the privileged portion of code.
6. The method as recited in claim 1 , wherein receiving from a privileged portion of application code an indication that a session associated with a user is to be promoted from a first level of access associated with the user ACL entry to a second level of access associated with the privileged code ACL entry includes receiving from the privileged portion of code a credential authenticating the received indication as coming from the privileged portion of code.
7. A content management system, comprising:
a communication interface configured to receive from a privileged portion of application code an indication that a content management session associated with a user is to be promoted from a first level of access associated with a user ACL entry to a second level of access associated with a privileged code ACL entry based at least in part on the user's particular context,
wherein receiving from a privileged portion of application code an indication that a session associated with a user is to be promoted from a first level of access associated with the user ACL entry to a second level of access associated with the privileged code ACL entry includes receiving from the privileged portion of application code an indication that the user is to be considered with respect to the session a member of a dynamic group associated with the privileged portion of code;
a processor coupled to the communication interface and memory, and configured to:
review the privileged code ACL entry associated with the privileged portion of application code;
review the user ACL entry associated with the user; and
allow a request associated with the content management session to perform with respect to a content item an operation that requires the second level of access through an application associated with the privileged portion of application code; and
a memory coupled to the processor and configured to provide the processor with stored instructions.
8. The system as recited in claim 7 , wherein the privileged portion of application code is configured to limit the user to performing with respect to the content item via the application one or more prescribed operations requiring the second level of access.
9. The system as recited in claim 7 , wherein the privileged portion of application code is configured to prevent the user from performing with respect to the content item via the application an operation that having the second level of access would otherwise have entitled the user to perform.
10. The system as recited in claim 7 , wherein the communication interface is further configured to receiving from the privileged portion of application code an indication that the session is to be demoted from the second level of access to the first level of access; and the processor is further configured to deny a subsequent request associated with the session to perform with respect to a content item an operation that requires the second level of access.
11. The system as recited in claim 10 , wherein receiving from the privileged portion of application code an indication that the session is to be demoted from the second level of access to the first level of access includes receiving from the privileged portion of application code an indication that the user is no longer to be considered with respect to the session a member of a dynamic group associated with the privileged portion of code.
12. The system as recited in claim 7 , wherein receiving from a privileged portion of application code an indication that a session associated with a user is to be promoted from a first level of access associated with the user ACL entry to a second level of access associated with the privileged code ACL entry includes receiving from the privileged portion of code a credential authenticating the received indication as coming from the privileged portion of code.
13. A computer program product for controlling access to managed content, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
reviewing a privileged code access control list (ACL) entry associated with a privileged portion of application code;
reviewing a user ACL entry associated with a user;
receiving from a privileged portion of application code an indication that a content management session associated with a user is to be promoted from a first level of access associated with the user ACL entry to a second level of access associated with the privileged code ACL entry based at least in part on the user's particular context;
wherein receiving from a privileged portion of application code an indication that a session associated with a user is to be promoted from a first level of access associated with the user ACL entry to a second level of access associated with the privileged code ACL entry includes receiving from the privileged portion of application code an indication that the user is to be considered with respect to the session a member of a dynamic group associated with the privileged portion of code; and
allowing a request associated with the content management session to perform with respect to a content item an operation that requires the second level of access through an application associated with the privileged portion of application code.
14. The computer program product as recited in claim 13 , wherein the privileged portion of application code is configured to limit the user to performing with respect to the content item via the application one or more prescribed operations requiring the second level of access.
15. The computer program product as recited in claim 13 , wherein the privileged portion of application code is configured to prevent the user from performing with respect to the content item via the application an operation that having the second level of access would otherwise have entitled the user to perform.
16. The computer program product as recited in claim 13 , further comprising computer instructions for:
receiving from the privileged portion of application code an indication that the session is to be demoted from the second level of access to the first level of access; and
denying a subsequent request associated with the session to perform with respect to a content item an operation that requires the second level of access.
17. The computer program product as recited in claim 16 , wherein receiving from the privileged portion of application code an indication that the session is to be demoted from the second level of access to the first level of access includes receiving from the privileged portion of application code an indication that the user is no longer to be considered with respect to the session a member of a dynamic group associated with the privileged portion of code.